Municipal operators run kubectl against the cluster and receive TLS certificate errors talking to the API server after a long uptime without cert renewal. What is the most likely root cause?
Select an answer to reveal the explanation.
Short Explanation
kubectl's TLS yell is often just an expired API server ID card. After long uptime without renewal, rotate control-plane certs so the handshake trusts the API again.
Full Explanation
Expired kube-apiserver serving certificates or related client certificates break TLS for kubectl and other API clients. Administrators renew certificates (for example with kubeadm certs renew workflows) to restore access. PDBs, VXLAN firewall gaps, and metrics-server absence do not typically surface as kubectl TLS certificate verification failures.