kubeadm alpha

Caution: kubeadm alpha provides a preview of a set of features made available for gathering feedbackfrom the community. Please try it out and give us feedback!

kubeadm alpha certs renew

You can renew all Kubernetes certificates using the all subcommand or renew them selectively.For more details about certificate expiration and renewal see the certificate management documentation.

• renew
• all
• admin.conf
• apiserver-etcd-client
• apiserver-kubelet-client
• apiserver
• controller-manager.conf
• etcd-healthcheck-client
• etcd-peer
• etcd-server
• front-proxy-client
• scheduler.conf

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

kubeadm alpha certs renew [flags]

Options

Options inherited from parent commands

Synopsis

Renew all known certificates necessary to run the control plane. Renewals are run unconditionally, regardless of expiration date. Renewals can also be run individually for more control.

kubeadm alpha certs renew all [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew admin.conf [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate the apiserver uses to access etcd.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew apiserver-etcd-client [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate for the API server to connect to kubelet.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew apiserver-kubelet-client [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate for serving the Kubernetes API.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew apiserver [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate embedded in the kubeconfig file for the controller manager to use.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew controller-manager.conf [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate for liveness probes to healthcheck etcd.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew etcd-healthcheck-client [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate for etcd nodes to communicate with each other.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew etcd-peer [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate for serving etcd.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew etcd-server [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate for the front proxy client.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew front-proxy-client [flags]

Options

Options inherited from parent commands

Synopsis

Renew the certificate embedded in the kubeconfig file for the scheduler manager to use.

Renewals run unconditionally, regardless of certificate expiration date; extra attributes such as SANs will be based on the existing file/certificates, there is no need to resupply them.

Renewal by default tries to use the certificate authority in the local PKI managed by kubeadm; as alternative it is possible to use K8s certificate API for certificate renewal, or as a last option, to generate a CSR request.

After renewal, in order to make changes effective, is is required to restart control-plane components and eventually re-distribute the renewed certificate in case the file is used elsewhere.

kubeadm alpha certs renew scheduler.conf [flags]

Options

Options inherited from parent commands

kubeadm alpha certs certificate-key

This command can be used to generate a new control-plane certificate key.The key can be passed as —certificate-key to kubeadm init and kubeadm jointo enable the automatic copy of certificates when joining additional control-plane nodes.

• certificate-key

Synopsis

This command will print out a secure randomly-generated certificate key that can be used withthe “init” command.

You can also use “kubeadm init –upload-certs” without specifying a certificate key and it willgenerate and print one for you.

kubeadm alpha certs certificate-key [flags]

Options

Options inherited from parent commands

kubeadm alpha certs check-expiration

This command checks expiration for the certificates in the local PKI managed by kubeadm.For more details about certificate expiration and renewal see the certificate management documentation.

• check-expiration

Synopsis

Checks expiration for the certificates in the local PKI managed by kubeadm.

kubeadm alpha certs check-expiration [flags]

Options

Options inherited from parent commands

kubeadm alpha kubeconfig user

The user subcommand can be used for the creation of kubeconfig files for additional users.

• kubeconfig
• user

Synopsis

Kubeconfig file utilities.

Alpha Disclaimer: this command is currently alpha.

Options

Options inherited from parent commands

Synopsis

Output a kubeconfig file for an additional user.

Alpha Disclaimer: this command is currently alpha.

kubeadm alpha kubeconfig user [flags]

Examples

  # Output a kubeconfig file for an additional user named foo
  kubeadm alpha kubeconfig user --client-name=foo

Options

Options inherited from parent commands

kubeadm alpha kubelet config

Use the following commands to either download the kubelet configuration from the cluster orto enable the DynamicKubeletConfiguration feature.

• kubelet
• download
• enable-dynamic

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

Options

Options inherited from parent commands

Synopsis

Download the kubelet configuration from a ConfigMap of the form “kubelet-config-1.X” in the cluster, where X is the minor version of the kubelet. Either kubeadm autodetects the kubelet version by exec-ing “kubelet –version” or respects the –kubelet-version parameter.

Alpha Disclaimer: this command is currently alpha.

kubeadm alpha kubelet config download [flags]

Examples

  # Download the kubelet configuration from the ConfigMap in the cluster. Autodetect the kubelet version.
  kubeadm alpha phase kubelet config download
  # Download the kubelet configuration from the ConfigMap in the cluster. Use a specific desired kubelet version.
  kubeadm alpha phase kubelet config download --kubelet-version 1.16.0

Options

Options inherited from parent commands

Synopsis

Download the kubelet configuration from a ConfigMap of the form “kubelet-config-1.X” in the cluster, where X is the minor version of the kubelet. Either kubeadm autodetects the kubelet version by exec-ing “kubelet –version” or respects the –kubelet-version parameter.

Alpha Disclaimer: this command is currently alpha.

kubeadm alpha kubelet config download [flags]

Examples

  # Download the kubelet configuration from the ConfigMap in the cluster. Autodetect the kubelet version.
  kubeadm alpha phase kubelet config download
  # Download the kubelet configuration from the ConfigMap in the cluster. Use a specific desired kubelet version.
  kubeadm alpha phase kubelet config download --kubelet-version 1.16.0

Options

Options inherited from parent commands

kubeadm alpha selfhosting pivot

The subcommand pivot can be used to convert a static Pod-hosted control plane into a self-hosted one.

Documentation

• selfhosting
• pivot

Synopsis

This command is not meant to be run on its own. See list of available subcommands.

Options

Options inherited from parent commands

Synopsis

Convert static Pod files for control plane components into self-hosted DaemonSets configured via the Kubernetes API.

See the documentation for self-hosting limitations.

Alpha Disclaimer: this command is currently alpha.

kubeadm alpha selfhosting pivot [flags]

Examples

  # Convert a static Pod-hosted control plane into a self-hosted one.
  kubeadm alpha phase self-hosting convert-from-staticpods

Options

Options inherited from parent commands

What’s next

• kubeadm init to bootstrap a Kubernetes control-plane node
• kubeadm join to connect a node to the cluster
• kubeadm reset to revert any changes made to this host by kubeadm init or kubeadm join

Feedback

Was this page helpful?

Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it onStack Overflow.Open an issue in the GitHub repo if you want toreport a problemorsuggest an improvement.