What happened:
The client cert in the generated kubeconfig secret expires after one year. However, the rke2 provider does not regenerate the kubeconfig with a new cert, breaking any tools that depend on reading the clustername-kubeconfig secret to get cluster credentials.

What did you expect to happen:

The kubeconfig secret is renewed a reasonable time before expiration. The cluster-api kubeadm control plane does this here

How to reproduce it:

Create a cluster. Wait one year. Check kubeconfig cert expiration

Anything else you would like to add:

Weirdly the code has a comment "only do rotation on owned secrets", checks that it owns the kubeconfig secret, and then just doesn't rotate it.

Environment:

• rke provider version: 0.8.0
• OS (e.g. from /etc/os-release): ubuntu 22.04 LTS