This message was deleted.

Did you upgrade directly from 1.26 to 1.31? Or did you step through the intermediate minors as required by Kubernetes?

we did not upgrade directly from 1.26 to 1.31. Instead, we followed the required steps as outlined in the Kubernetes upgrade guidelines. Specifically, we upgraded sequentially through the intermediate minor versions: • From 1.26 to 1.27, • From 1.27 to 1.28, • From 1.28 to 1.29, • And so on until 1.31. We used Rancher’s System Upgrade Controller to perform each step, as described in the official documentation: Automated Upgrades.

All rke2-managed leaf certs are automatically renewed when they are <=90 days to expiry. You shouldn’t need to do anything to manually rotate them, as long as you’ve restarted the server nodes within that 90 day window.

Just to confirm, is

rke2-serving

not one of the certificates that are automatically renewed when they are within the 90-day expiry window?

It is

Effectively, your certificate is still valid, the upgrades didn't invalidate it.

Thanks