You maintain a kubeadm-provisioned cluster that has been running for just over a year. This morning, kubectl commands from the admin workstation begin failing with 'x509: certificate has expired or is not yet valid', and the API server static pod is repeatedly restarting. Investigation shows the cluster's PKI certificates were never rotated. Which single command should you run on the control-plane node to renew all kubeadm-managed certificates at once, after which you must restart the control-plane components?