A Rancher-provisioned or standalone RKE2 or K3s cluster
Rancher 配置或独立的 RKE2 或 K3s 集群

This article provides a comprehensive guide on the certificate rotation process for RKE2 and K3s clusters. It covers both standalone deployments and downstream clusters managed by Rancher.
本文提供了 RKE2 和 K3s 集群证书轮换流程的全面指南。它涵盖了独立部署和由 Rancher 管理的下游集群。

Rotating certificates is a critical maintenance task. RKE2 and K3s utilize client and server certificates to establish trust and secure communication between the cluster components. If certificates expire, authentication between components (such as the kubelet and the Kubernetes API Server) will fail, leading to cluster instability or total service outages.
轮换证书是一项关键的维护任务。RKE2 和 K3 利用客户端和服务器证书建立信任并安全通信。如果证书过期，组件间的认证（如 Kubelet 和 Kubernetes API 服务器）将失败，导致集群不稳定或服务全面中断。

Per the RKE2 and K3s certification documentation: the client and server certificates are valid for 365 days from their date of issuance. Any certificates that are expired or within 120 days of expiring are automatically renewed every time RKE2 or K3s starts. This renewal reuses the existing keys, and extends the lifetime of the existing certificates. If you want to generate new certificates and keys, instead of extending the validity of the existing certificates, rotate certificates as documented below.
根据 RKE2 和 K3s 认证文件：客户端和服务器证书自签发日起有效期为 365 天。任何已过期或在到期后 120 天内的证书，每次 RKE2 或 K3s 开始时都会自动续期。此次续期重复使用现有密钥，并延长了现有证书的有效期。如果您想生成新的证书和密钥，而不是延长现有证书的有效性，而是按照下面文档轮换证书。

N.B. Prior to the May 2025 releases (RKE2: v1.33.1+rke2r1, v1.32.5+rke2r1, v1.31.9+rke2r1, v1.30.13+rke2r1; K3s: v1.33.1+k3s1, v1.32.5+k3s1, v1.31.9+k3s1, v1.30.13+k3s1), alerts and renewal were triggered at 90 days, instead of 120 days.
注意： 在 2025 年 5 月发布之前（RKE2：v1.33.1+rke2r1，v1.32.5+rke2r1，v1.31.9+rke2r1，v1.30.13+rke2r1;K3s：v1.33.1+k3s1，v1.32.5+k3s1，v1.31.9+k3s1，v1.30.13+k3s1），警报和续期在 90 天触发，而非 120 天。

Monitoring Certificate Expiration
监控证书到期

Manually checking expiration
手动检查有效期

Node certificates and their expiration date can be checked using the rke2 certificate check --output table and k3s certificate check --output table commands, per the RKE2 and K3s documentation.
根据 RKE2 和 K3s 文档，节点证书及其有效期可以通过和 k3s certificate check --output table 命令检查 rke2 certificate check --output table 。

N.B.  Prior to the May 2025 releases (as listed above), the kube-scheduler and kube-controller-manager certificates, for Rancher-provisioned clusters, were not included in the output of the certificate check command. In older versions these two certificates can be checked manually with openssl x509 -enddate -noout -in /var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt and openssl x509 -enddate -noout -in /var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt or  openssl x509 -enddate -noout -in /var/lib/rancher/k3s/server/tls/kube-scheduler/kube-scheduler.crt and openssl x509 -enddate -noout -in /var/lib/rancher/k3s/server/tls/kube-controller-manager/kube-controller-manager.crt
注意：   在 2025 年 5 月版本之前（如上所述），Rancher 配置集群的 kube 调度器和 kube 控制器-manager 证书并未包含在证书检查命令的输出中。在较早的版本中，这两张证书可以通过手动检查，使用 openssl x509 -enddate -noout -in /var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt 和 openssl x509 -enddate -noout -in /var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt 或  openssl x509 -enddate -noout -in /var/lib/rancher/k3s/server/tls/kube-scheduler/kube-scheduler.crt openssl x509 -enddate -noout -in /var/lib/rancher/k3s/server/tls/kube-controller-manager/kube-controller-manager.crt

Automated monitoring  自动化监测

When a certificate is within 120 days of expiring a Kubernetes Warning Event with reason: CertificateExpirationWarning is created, with a relation to the Node using the certificate. These Events can be used as the basis for automated monitoring of certificate expiration.
当证书在到期前 120 天内，会创建一个 Kubernetes reason: CertificateExpirationWarning Warning Event，并与使用该证书的节点建立关联。这些事件可以作为自动监控证书到期的基础。

An alternative approach would be to use the x509-certificate-exporter to track expiration dates and set up proactive alerts using Prometheus and Alertmanager, such as in rancher-monitoring.
另一种方法是使用 x509-certificate-exporter 跟踪到期日，并使用 Prometheus 和 AlertManager 设置主动警报，比如牧场主监控。

Renewal Process  续期流程

To renew certificates that are expired or within 120 days of expiring, reusing the existing keys, simply restart the RKE2 or K3s supervisor process, i.e. systemctl restart rke2-server, systemctl restart rke2-agent, systemctl restart k3s, or systemctl restart k3s-agent
要续期已过期或 120 天内的证书，重复使用现有密钥，只需重启 RKE2 或 K3s 的监督进程，即 systemctl restart rke2-server、systemctl restart rke2-agent、systemctl restart k3s，或 systemctl restart k3s-agent

N.B. Prior to the May 2025 releases (as listed above), the kube-scheduler and kube-controller-manager certificates, for Rancher-provisioned clusters, were not managed by the RKE2 or K3s supervisor process. As a result restarting the supervisor process will not renew these certificates. To rotate these certificates in older K3s and RKE2 versions, perform a rotation using the Rancher UI, as documented below, or remove the certificate and key files manually before restarting the supervisor, i.e.: rm /var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.{crt,key} /var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.{crt,key} or rm /var/lib/rancher/k3s/server/tls/kube-controller-manager/kube-controller-manager.{crt,key} /var/lib/rancher/k3s/server/tls/kube-scheduler/kube-scheduler.{crt,key}
注意： 在 2025 年 5 月版本之前（如上所述），Rancher 配置集群的 kube 调度器和 kube 控制器-manager 证书不由 RKE2 或 K3s 的主管进程管理。因此，重新开始监督流程不会续期这些证书。要在较旧的 K3 和 RKE2 版本中轮换这些证书，请使用 Rancher 界面进行轮换，如下文所述，或在重启监督程序前手动移除证书和密钥文件，即： rm /var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.{crt,key} /var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.{crt,key} 或 rm /var/lib/rancher/k3s/server/tls/kube-controller-manager/kube-controller-manager.{crt,key} /var/lib/rancher/k3s/server/tls/kube-scheduler/kube-scheduler.{crt,key}

Rotation Process  旋转过程

RKE2 and K3s certificates can be rotated - generating new certificates and keys, versus extending the validity of existing certificates - using the following processes for standalone and Rancher-provisioned clusters.
RKE2 和 K3s 证书可以轮换——生成新的证书和密钥，而非延长现有证书的有效性——这可以通过以程进行独立和牧场配置集群。

Standalone clusters  独立集群

To rotate the certificates in a standalone cluster, follow the steps for the certificate rotate subcommand in the RKE2 or K3s documentation.
要在独立集群中轮换证书，请按照 RKE2 或 K3s 文档中的证书 rotate 子命令作。

1. Stop the RKE2 or K3s supervisor process: systemctl stop rke2-server, systemctl stop rke2-agent, systemctl stop k3s, or systemctl stop k3s-agent
   停止 RKE2 或 K3s 的监督进程：systemctl 停止 rke2-server，systemctl 停止 rke2-agent，systemctl 停止 k3s，或 systemctl 停止 k3s-agent
2. Rotate the certificates: rke2 certificate rotate or k3s certificate rotate
   轮换证书：RKE2 证书轮换或 K3S 证书轮换
3. Start the RKE2 or K3s supervisor process: systemctl start rke2-server, systemctl start rke2-agent, systemctl start k3s, or systemctl start k3s-agent
   启动 RKE2 或 K3s 的监督进程：systemctl start rke2-server，systemctl start rke2-agent，systemctl start k3s，或 systemctl start k3s-agent

Per the RKE2 and K3s documentation, it is also possible to specify individual services for which to rotate certificates, using the --service argument.
根据 RKE2 和 K3s 文档，也可以使用 --service 参数指定要轮换证书的各个服务。

Rancher-provisioned clusters
牧场主配置集群

To rotate the certificates of a Rancher-provisioned RKE2 or K3s cluster, follow the steps from the Rancher documentation:
要轮换 Rancher 配置的 RKE2 或 K3s 集群的证书，请按照 Rancher 文档中的步骤作：

1. In the upper left corner, click ☰ > Cluster Management.
   在左上角，点击 ☰ > 集群管理。

2. On the Clusters page, go to the cluster you want to rotate certificates for and click ⋮ > Rotate Certificates.
   在集群页面，进入你想轮换证书的集群，点击 ⋮> 轮换证书 。

3. Choose to Rotate all Service certificates (recommended) or select an individual service.
   选择轮换所有服务证书 （推荐）或选择单项服务。

4. Click Save. Rancher will orchestrate the rotation across the nodes automatically.
   点击保存 。Rancher 会自动协调节点间的旋转。

Rotating CA Certificates - Standalone clusters only
轮换 CA 证书——仅支持独立集群

By default, RKE2 and K3s generate self-signed CA certificates during startup of the first server node. These CA certificates are valid for 10 years and do not renew automatically.
默认情况下，RKE2 和 K3 在启动第一个服务器节点时生成自签名的 CA 证书。这些加州证书有效期为 10 年，不会自动续期。

For standalone clusters, the CA certificate can be rotated, per the RKE2 and K3s documentation. If the cluster was started with the default self-signed CA certificates, CA rotation will be disruptive. If the new CA certificates are not cross-signed by the old CA certificates, or the root CA is replaced when using custom CA certificates, all nodes will also need to be reconfigured to use the new secure cluster token, and pods will need to be restarted.
对于独立集群，CA 证书可以轮换，根据 RKE2 和 K3s 文档。如果集群启动时使用默认的自签名 CA 证书，CA 轮换将会造成干扰。如果新的 CA 证书未被旧 CA 证书交叉签名，或者在使用自定义 CA 证书时更换根 CA，所有节点也需要重新配置以使用新的安全集群令牌，并需要重启 Pod。