https://rancher.com/ logo
Join Slack
Powered by
RKE2 1.31.7 (RPM install) on RHEL9.4 I am getting ...
# rke2
h
RKE2 1.31.7 (RPM install) on RHEL9.4 I am getting this in events:
Copy code
Node certificates require attention - restart rke2 on this node to trigger automatic rotation:
I did rke2-killall.sh followed by OS updates and reboot RKE2 started without an issue but looks like these steps did not rotate certs. Do I need to do 
systemctl restart rke2-server
?
or perhaps I should give it some time and check it after few minutes
c
What are you seeing that indicates it did not rotate the certs?
If this is an agent, you may need to check for similar events on server nodes, and rotate (or restart) those first. Some certs are only regenerated on server restart.
h
its just the cluster events that is showing that
this is the message:
Copy code
Node certificates require attention - restart rke2 on this node to trigger automatic rotation: kube-proxy/client-kube-proxy.crt: certificate CN=system:kube-proxy will expire within 90 days at 2025-06-21T22:27:52Z, rke2-controller/client-rke2-controller.crt: certificate CN=system:rke2-controller will expire within 90 days at 2025-06-21T22:27:52Z
and this exact event is for all 3 nodes
c
the event doesn’t go away just because the cert is updated. The event happened, and it will continue to have happened until the event resource expires and is deleted 1 hour after creation.
We don’t emit an “all certs are OK” event, so you’ll just see that event eventually disappear after it expires.
h
oh! thank you I will check back
c
I created https://github.com/k3s-io/k3s/issues/12107 to track this as an enhancement
h
thank you! for all that you do for us users Happy Friday
11 Views
Open in Slack
PreviousNext
Powered by