title: Is phase kubeconfig required after phase certs in kubeadm?
body: <p>I've recently upgraded with kubeadm, which I expect to rotate all certificates, and for good measure, I also ran <code>kubeadm init phase certs all</code>, but I'm not sure what steps are required to verify that the certs are all properly in place and not about to expire.</p>
  
  <p>I've seen a <a href="https://stackoverflow.com/a/56334732/238322">SO answer reference</a> <code>kubeadm init phase kubeconfig all</code> is required in addition, but cannot find in the <a href="https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/" rel="nofollow noreferrer">kubernetes kubeadm documentation</a> telling me that it needs to be used in conjunction with phase certs. </p>
  
  <p>What do I need to do to make sure that the cluster will not encounter expired certificates?</p>
  
  <p>I've tried verifying by connecting to the secure local port: <code>echo -n | openssl s_client -connect localhost:10250 2&gt;&amp;1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout | grep Not</code>, which gives me expirations next month.</p>
  
  <p>While <code>openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text</code> and <code>openssl x509 -in /etc/kubernetes/pki/apiserver-kubelet-client.crt -noout -text</code> yield dates over a year in advance.</p>
  
  <p>These conflicting dates certainly have me concerned that I will find myself like many others with expired certificates. How do I get in front of that?</p>
  
  <p>Thank you for any guidance.</p>