KubeApiCertExpiresCritical: what to do when it fires

Alert rule

alert: KubeApiCertExpiresCritical
expr: histogram_quantile(0.01, sum by (instance, le) (
  rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m])
)) / 86400 < 1
for: 5m
severity: critical

Alert message: kube-apiserver client certificate expires in less than 1 day ({{ $labels.instance }})

What it means

The client certificates for accessing kube-apiserver expire in less than a day (or have already expired). After expiry, components and users may lose access to the cluster.

Common causes

The same as for KubeApiCertExpiresSoon: the renewal was missed.

Diagnostics

kubeadm certs check-expiration
openssl x509 -noout -enddate -in /etc/kubernetes/pki/apiserver-kubelet-client.crt
ls -l /etc/kubernetes/pki /var/lib/kubelet/pki

How to fix

Renew the certificates immediately (kubeadm certs renew all and restart the control plane components), update administrators' kubeconfigs. Back up /etc/kubernetes before the operation.

When it is OK to silence

Not until renewed.

Related alerts

• KubeApiCertExpiresSoon
• KubeHpaMaxedOut
• KubeNodePressure
• KubeNodeNotReady

The full pack of 44 tested rules + Alertmanager → Telegram: 790 ₽ (≈ $9, card payment in rubles)
Open in Telegram · Free Monitoring Lite kit · All runbook alerts