If you are seeing certificate has expired in your Kubernetes cluster, this guide will help you fix it fast.
What This Error Means
A TLS certificate used by the API server, kubelet, or etcd has expired.
Quick Diagnosis
# Check pod status and events
kubectl get pods -o wide
kubectl describe pod <pod-name>
kubectl get events --sort-by='.lastTimestamp' --field-selector involvedObject.name=<pod-name>
# Check node status
kubectl get nodes -o wide
kubectl describe node <node-name>
# Check logs
kubectl logs <pod-name> --previousHow to Fix It
Step 1: Identify the Root Cause
Look at the Events section in kubectl describe pod. The message will tell you exactly what went wrong.
Step 2: Apply the Fix
The most common fix for certificate has expired:
A TLS certificate used by the API server, kubelet, or etcd has expired.
Check the pod spec, resource requests, and cluster capacity. Adjust as needed.
Step 3: Verify
# Watch the pod recover
kubectl get pods -w
# Check events are clean
kubectl get events --sort-by='.lastTimestamp' | head -10Prevention Tips
- Set appropriate resource requests and limits for all pods
- Use monitoring (Prometheus + Grafana) to catch issues early
- Implement proper readiness and liveness probes
- Use Pod Disruption Budgets for critical workloads
- Keep cluster components (kubelet, etcd, API server) healthy
