Linux Worms: August 2026

Monday, August 10, 2026

Renew k8s certificates

Check If certificate expires:

amikum@~:03:06:54(⎈ |local-cluster:default):sudo kubeadm certs check-expiration

CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED

admin.conf Jan 12, 2024 03:08 UTC 1y no

apiserver Jun 08, 2023 09:36 UTC 364d ca no

apiserver-etcd-client Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

apiserver-kubelet-client Apr 15, 2022 06:46 UTC <invalid> ca no

controller-manager.conf Apr 15, 2022 06:46 UTC <invalid> no

etcd-healthcheck-client Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

etcd-peer Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

etcd-server Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

front-proxy-client Apr 15, 2022 06:46 UTC <invalid> front-proxy-ca no

scheduler.conf Apr 15, 2022 06:46 UTC <invalid> no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED

ca Apr 13, 2031 06:46 UTC 8y no

etcd-ca Apr 13, 2031 06:46 UTC 8y no

front-proxy-ca Apr 13, 2031 06:46 UTC 8y no

===========================================

renew the certificate

amikum@~:03:07:35(⎈ |local-cluster:default):sudo kubeadm certs renew apiserver-etcd-client

[renew] Reading configuration from the cluster...

[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate the apiserver uses to access etcd renewed

amikum@~:03:09:06(⎈ |local-cluster:default):sudo kubeadm certs check-expiration

CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED

admin.conf Jan 12, 2024 03:08 UTC 1y no

apiserver Jun 08, 2023 09:36 UTC 364d ca no

apiserver-etcd-client Jun 08, 2023 09:37 UTC 364d etcd-ca no

apiserver-kubelet-client Jun 08, 2023 09:38 UTC 364d ca no

controller-manager.conf Jun 08, 2023 09:38 UTC 364d no

etcd-healthcheck-client Jun 08, 2023 09:38 UTC 364d etcd-ca no

etcd-peer Jun 08, 2023 09:38 UTC 364d etcd-ca no

etcd-server Jun 08, 2023 09:38 UTC 364d etcd-ca no

front-proxy-client Jun 08, 2023 09:38 UTC 364d front-proxy-ca no

scheduler.conf Jun 08, 2023 09:38 UTC 364d no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED

ca Apr 13, 2031 06:46 UTC 8y no

etcd-ca Apr 13, 2031 06:46 UTC 8y no

front-proxy-ca Apr 13, 2031 06:46 UTC 8y no

=======================

Regenerate new admin kubeconfig

root@NO2ECIVM03:/etc/kubernetes# kubeadm init phase kubeconfig admin

I0608 15:27:16.743911 30150 version.go:254] remote version is much newer: v1.24.1; falling back to: stable-1.21

[kubeconfig] Writing "admin.conf" kubeconfig file

Allow internet access through proxy and ssh port forwarding

Step 1) install squid on 132.1.16.100 box

dev@kvm2:~$ sudo apt-get install squid3

dev@kvm2:~$ ps ax|grep squid

11700 ? Ss 0:00 /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

11704 ? Ss 0:00 (logfile-daemon) /var/log/squid3/access.log

11783 pts/3 S+ 0:00 grep --color=auto squid

dev@kvm2:~$ telnet localhost 3128

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

dev@kvm2:~$ export HTTP_PROXY="localhost:3128"

dev@kvm2:~$ wget --proxy=on google.com

[ <=> ] 14,396 --.-K/s in 0.01s

2018-10-19 11:32:09 (1.21 MB/s) - ‘index.html’ saved [14426]

dev@kvm2:~$ export HTTPS_PROXY="localhost:3128"

dev@kvm2:~$ wget --proxy=on google.com

[ <=> ] 14,396 --.-K/s in 0.01s

2018-10-19 11:32:26 (1.19 MB/s) - ‘index.html.1’ saved [14396]

root@kvm2:~# grep "http_access allow all" /etc/squid3/squid.conf

http_access allow all

root@kvm2:~#

restart the squid service

root@kvm2:~# ps -ef | grep squid

root 13143 1 0 11:38 ? 00:00:00 sudo /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

proxy 13144 13143 0 11:38 ? 00:00:07 /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

proxy 13145 13144 0 11:38 ? 00:00:00 (logfile-daemon) /var/log/squid3/access.log

root 37164 37034 0 16:44 pts/6 00:00:00 grep --color=auto squid

root@kvm2:~#

step 2) ssh port forward on 172.16.30153

C:\Users\opsadmin>ssh -R 9002:132.1.16.100:3128 ansible@172.16.30.153

Last login: Fri Oct 19 11:45:22 2018 from 10.212.134.202

ansible@ubuntuTest:~$ telnet localhost 9002

Trying ::1...

Connected to localhost.

Escape character is '^]'.

ansible@ubuntuTest:~$ export http_proxy="localhost:9002"

ansible@ubuntuTest:~$ export https_proxy="localhost:9002"

ansible@ubuntuTest:~$ wget --proxy=on google.com

--2018-10-19 11:49:20-- http://google.com/

Resolving localhost (localhost)... ::1, 127.0.0.1

Connecting to localhost (localhost)|::1|:9002... connected.

Proxy request sent, awaiting response... 301 Moved Permanently

Location: http://www.google.com/ [following]

--2018-10-19 11:49:21-- http://www.google.com/

Reusing existing connection to [localhost]:9002.

Proxy request sent, awaiting response... 200 OK

Length: unspecified [text/html]

Saving to: ‘index.html’

[ <=> ] 14,393 --.-K/s in 0.03s

2018-10-19 11:49:21 (550 KB/s) - ‘index.html’ saved [14393]

root@ubuntuTest:/var/www/html/zabbix# cat /etc/apt/apt.conf

Acquire::http::Proxy "http://localhost:9002";

Acquire::https::Proxy "https://localhost:9002";

Acquire::ftp::Proxy "ftp://localhost:9002";

root@ubuntuTest:/var/www/html/zabbix#