Why do k3s cluster certificates need to be updated manually

[CharesLee]

Is your feature request related to a problem? Please describe.

We are maintaining a lot of k3s deployed projects, about 60+, including other environments about 90+, at present, there is a terrible problem, each k3s cluster certificate is only valid for one year, when the cluster certificate is about to expire, we need to manually log in the environment and rotate it. In some projects, we can get the warning of the certificate expiration by adding monitoring, but there are many projects that are delivered to other enterprises in a pure internal network deployment. In this bad network environment, we cannot know the status of the certificate (whether it is expired or not) at the first time, so the expiration of the cluster certificate often causes the cluster node anomaly. It also brings a lot of trouble for us to maintain, and after the final project is delivered, we can't do a special certificate rotation operation for them every year, so is there any best practice for our situation?
PS: Why do certificates need to be rotated annually?
Thanks!
Describe the solution you'd like

Preferably, no certificate rotation is needed, so we don't have to do it every year

Describe alternatives you've considered

Not yet.

Additional context

[brandond]

when the cluster certificate is about to expire, we need to manually log in the environment and rotate it.

No you don't. If you restart K3s when the certificates are within 90 days of expiring, they will be rotated automatically when the service starts. This is covered in the docs.

https://docs.k3s.io/cli/certificate#client-and-server-certificates

If you are regularly upgrading your nodes, this shouldn't be a problem. If you are not applying patches every month or two, then just schedule periodic restart of K3s, or do so when the certificates are within 3 months of expiring.

[CharesLee]

If we use k3s internally, restarting k3s within 90 days is fine, but as I said above, a lot of projects have already been delivered and we also need to restart k3s for each project every year to solve the certificate rotation issue 😱
Can I add restarting k3s to the system's regular task and restart it regularly every month 🤔

[brandond]

yes, setting up something to restart k3s on a regular monthly schedule would be a good way to address this without manual action. You could also deploy automated upgrades, to ensure that k3s is upgraded regularly - this would have a side effect of restarting k3s every time a new release comes out, to apply the upgrade.

[CharesLee]

All right, maybe I need to write a script to restart k3s periodically
Also, restarting the k3s master has reached the rotation certificate, whether the worker node also needs to be restarted ？
I have encountered many times that after restarting the master, although the master's certificate was updated, my worker node was disconnected from the master when the old certificate expired

[brandond]

You need to restart servers first, then agents.

[CharesLee]

ok, I see, Thank you very much