Question

A worker node suddenly reports NotReady. The kubelet logs on that node show repeated errors: 'x509: certificate has expired or is not yet valid: current time ... is before ...'. The kubelet certificates were recently rotated and are valid for another year. Other nodes are healthy. What is the MOST likely root cause and appropriate fix?

Accepted Answer

The node's system clock is skewed (out of sync with the control plane), causing TLS validation to fail; sync time via NTP and restart the kubelet.

Answer

The kubelet client certificate was revoked by the API server; delete the node object and rejoin it with kubeadm.

Answer

The CA bundle on the node is corrupted; regenerate the cluster CA with kubeadm on all nodes.

Answer

The kubelet is using an expired bootstrap token; generate a new token and update /etc/kubernetes/bootstrap-kubelet.conf.