Question

A worker node suddenly shows NotReady. On the node, 'systemctl status kubelet' shows the service is active (running), but the kubelet logs repeatedly report: 'Unable to register node with API server' and 'x509: certificate has expired or is not yet valid'. The control plane and other nodes are healthy. What is the most likely root cause and appropriate first action?

Accepted Answer

The kubelet client certificate used to authenticate to the API server has expired; rotate/renew the kubelet's certificate (or approve its pending CSR) so it can re-authenticate.

Answer

CoreDNS is down on the node, so the kubelet cannot resolve the API server hostname; restart the CoreDNS Deployment.

Answer

The node has a NoSchedule taint that prevents registration; remove the taint with 'kubectl taint nodes'.

Answer

The container runtime (containerd) has crashed; restart containerd to restore node readiness.