Code change:
You can renew your certificates manually at any time with the `kubeadm certs renew` command. <del> This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. </del> <ins> This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. After running the command you should restart the control plane Pods. This is required since dynamic certificate reload is currently not supported for all components and certificates. [Static Pods](/docs/tasks/configure-pod-containerstatic-pod/) are managed by the local kubelet and not by the API Server, thus kubectl cannot be used to delete and restart them. To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/ reference/config-api/kubelet-config.v1beta1/). The kubelet will terminate the Pod if it's no longer in the manifest directory. You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate the Pod and the certificate renewal for the component can complete. </ins> {{< warning >}} If you are running an HA cluster, this command needs to be executed on all the control-plane nodes.

Related discussion:
text: This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: After manually certificate renewal, , and need to be properly restarted. This should be described in (maybe) this section: , and currently not. Ref: Proposed Solution: Describe if , and need to be restarted, and also describe the proper way to restart them. Page to Update:
/sig cluster-lifecycle /help PRs welcome /priority backlog given prints instructions that users must restart. etcd should be included in this list. there are multiple ways to restart the static pods: rename the folder for more than 20 seconds []. the containers using the container runtime CLI (setup specific). ... i'd prefer option 1. [] see
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /sig cluster-lifecycle /help PRs welcome given prints instructions that users must restart. temporary rename the folder for more than 20 seconds []. restart the containers using the container runtime CLI (setup specific). ... see </details
/remove-kind bug
/triage accepted /kind cleanup
Hi, I would like to help but I have a question first. How does changing the name of help? I mean the behavior of Kubelet is not clear for me regarding this fileFrequencyCheck and the corresponding docs do not help, too. I like to explain that in certificate renewal docs, too.
The better place to document details about the static pod refresh timeouts is the "creating static pods page: If you remove a manifest file, the kubelet will find out about that every ~20sec and remove the pod from managent. If the file is then brought back the kubelet will recreate the pod acting like a restart.