How to Increase the Validity of Certificate Based Kubeconfig

Problem

How to increase the validity of certificate-based kubeconfig.

Environment

  • Platform9 Managed Kubernetes - All versions

Warning

  • For PMK (SaaS) support team will carry out the procedure below. Please open a Support Ticket.

  • For PEC/SMCP (air-gapped), the steps can be performed from the management plane.

Procedure

Info

How to access the Qbert Database:

  • If using PEC, SSH to the management plane VM and run mysql qbert.

  • If using SMCP, exec into the mysql exporter pod in the management plane cluster and run mysql qbert.

  • The default validity of certificate-based kubeconfig is 24 hours. Which is set by a parameter certExpiryHrs in Qbert Database.

qbert> select id,name,uuid,status,lastOk,lastOp,taskStatus,kubeRoleVersion,certExpiryHrs from clusters\G;

Example:

qbert> select id,name,uuid,status,lastOk,lastOp,taskStatus,kubeRoleVersion,certExpiryHrs from clusters\G;
*************************** 1. row ***************************
id: 2
name: cluster1
uuid: ed4153e1-0ff9-4bc0-8abb-eebad5f16e70
status: ok
lastOk: 2022-03-30 09:49:16.581
lastOp: 2022-03-30 09:46:20.036
taskStatus: success
kubeRoleVersion: 1.20.15-pmk.2100
certExpiryHrs: 24

  • To increase or decrease the validity of certificate-based kubeconfig, update the certExpiryHrs in Qbert Database for the respective cluster.

qbert> update clusters set certExpiryHrs='<TIME_IN_HOURS>' where uuid='<UUID_OF_CLUSTER>';

Example:

qbert> update clusters set certExpiryHrs='48' where uuid='ed4153e1-0ff9-4bc0-8abb-eebad5f16e70';

# mysql qbert -e "select id,name,uuid,status,lastOk,lastOp,taskStatus,kubeRoleVersion,certExpiryHrs from clusters\G"
*************************** 1. row ***************************
id: 2
name: cluster1
uuid: ed4153e1-0ff9-4bc0-8abb-eebad5f16e70
status: ok
lastOk: 2022-03-30 09:53:37.353
lastOp: 2022-03-30 09:46:20.036
taskStatus: success
kubeRoleVersion: 1.20.15-pmk.2100
certExpiryHrs: 48

  • After updating the Qbert Database, Check the validity of newly generated certificate-based kubeconfigs.

# echo "<client_cert>" | base64 -d| openssl x509 -noout -dates
notBefore=Mar 30 09:57:04 2022 GMT
notAfter=Apr 1 09:57:34 2022 GMT

Example:

# echo "<client_cert>" | base64 -d| openssl x509 -noout -dates
notBefore=Mar 30 09:57:04 2022 GMT
notAfter=Apr 1 09:57:34 2022 GMT
Info

The changes made to the Qbert Database are persistent through Cluster and Management plane upgrades.

Additional Information

Refer to the document for instructions on how to open a support ticket.

© 2025 Platform9. All Rights Reserved

On This Page
How to Increase the Validity of Certificate Based KubeconfigProblemEnvironmentProcedureAdditional Information