Change:
When the command is run with superuser privileges, it prints the requested information. Print a warning that files could not be read due to insufficient permission, or that information was missing (e.g., when the /etc/kubernetes directory is not initialized). When the directory is readable, it works as expected: where OS and kubeadm version detail was: Issue the command as a normal user when the directory /etc/kubernetes/pki exists but not readable. No response <details</details<detailsBare metal </details<details</details<detailsapt-get install kubeadm (source repo: ) </details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig cluster-lifecycle

Discussion:
return false, errors.Errorf("%s is not a known certificate", name) } <del> return handler.readwriter.Exists(), nil </del> <ins> return handler.readwriter.Exists() </ins> } // GetCertificateExpirationInfo returns certificate expiration info.

return false, errors.Errorf("%s is not a known certificate", name) } <del> return handler.readwriter.Exists(), nil </del> <ins> return handler.readwriter.Exists() </ins> } // GetCAExpirationInfo returns CA expiration info.

cert  *x509.Certificate } <del> func (cr fakecertificateReadWriter) Exists() bool { return cr.exist </del> <ins> func (cr fakecertificateReadWriter) Exists() (bool, error) { return cr.exist, nil </ins> } func (cr fakecertificateReadWriter) Read() (*x509.Certificate, error) {

// read or write a certificate stored/embedded in a file type certificateReadWriter interface { //Exists return true if the certificate exists <del> Exists() bool </del> <ins> Exists() (bool, error) </ins> // Read a certificate stored/embedded in a file Read() (*x509.Certificate, error)

} // Exists checks if a certificate exist <del> func (rw *pkiCertificateReadWriter) Exists() bool { </del> <ins> func (rw *pkiCertificateReadWriter) Exists() (bool, error) { </ins> certificatePath, _ := pkiutil.PathsForCertAndKey(rw.certificateDir, rw.baseName) return fileExists(certificatePath) } <del> func fileExists(filename string) bool { </del> <ins> func fileExists(filename string) (bool, error) { </ins> info, err := os.Stat(filename) <del> if os.IsNotExist(err) { return false </del> <ins> if err != nil { if os.IsNotExist(err) { return false, nil } return false, err </ins> } <del> return !info.IsDir() </del> <ins> return !info.IsDir(), nil </ins> } // Read a certificate from a file the K8s pki managed by kubeadm

} // Exists checks if a certificate embedded in kubeConfig file exists <del> func (rw *kubeConfigReadWriter) Exists() bool { </del> <ins> func (rw *kubeConfigReadWriter) Exists() (bool, error) { </ins> return fileExists(rw.kubeConfigFilePath) }

} for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { <del> if got := fileExists(tt.filename); got != tt.want { </del> <ins> if got, _ := fileExists(tt.filename); got != tt.want { </ins> t.Errorf("fileExists() = %v, want %v", got, tt.want) } })

baseName:       tt.fields.baseName, certificateDir: tt.fields.certificateDir, } <del> if got := rw.Exists(); got != tt.want { </del> <ins> if got, _ := rw.Exists(); got != tt.want { </ins> t.Errorf("pkiCertificateReadWriter.Exists() = %v, want %v", got, tt.want) } })

rw := &kubeConfigReadWriter{ kubeConfigFilePath: tt.kubeConfigFilePath, } <del> if got := rw.Exists(); got != tt.want { </del> <ins> if got, _ := rw.Exists(); got != tt.want { </ins> t.Errorf("kubeConfigReadWriter.Exists() = %v, want %v", got, tt.want) } })