Municipal operators run kubectl against the cluster and receive TLS certificate errors talking to the API server after a long uptime without cert renewal. What is the most likely root cause?
Select an answer to reveal the explanation.
Short Explanation
kubectl's TLS yell is often just an expired API server ID card. After long uptime without renewal, rotate control-plane certs so the handshake trusts the API again.
Full Explanation
kubectl speaks TLS to the API server. After long municipal uptime without certificate renewal, the most likely root cause of TLS certificate errors is expired API server serving certificates or related control-plane client certificates in the trust path. Renewing those certificates restores a trusted handshake so operators can manage the cluster again. PodDisruptionBudgets do not expire into TLS handshake errors; PDBs govern voluntary disruptions such as drains, not certificate validity periods, so that distractor mixes unrelated APIs. Closed VXLAN ports break pod overlay traffic between workers; they do not present as kubectl client TLS failures when talking to the API server endpoint. Missing metrics-server breaks the metrics API, HPA, and kubectl top—not kubectl’s authenticating TLS session to kube-apiserver—so it is the wrong root cause for certificate errors. Exam caveat: Also verify the client kubeconfig CA bundle and clock skew, because notAfter checks fail if node time is wrong. kubeadm certs check-expiration and certs renew are common CKA tools—name the certificate concept even if exact flags vary by version. Operational check: On control-plane nodes, inspect certificate expiration, renew with the platform’s documented procedure, restart static pods if required, and retest kubectl get nodes for civic operators without TLS errors.