Version 1.16. This version is no longer supported. For information about how to upgrade to version 1.28, seeUpgrade clustersin the latest documentation. For more information about supported and unsupported versions, see theVersioningpage in the latest documentation.
This document describes periodic maintenance that is required for your
Google Distributed Cloud clusters.
Rotate certificate authorities
The certificate authorities (CAs) in a cluster are valid for five years, so you
mustrotate your CAsat least once every five years.
Certificates for cluster components
Cluster components use certificates for authentication. These components
includekube-apiserver,kube-controller-manager,kube-scheduler,etcdandkubelet. The certificates are valid for one year and are renewed during
clusterupgrade. To prevent the certificates from
expiring, you must upgrade your cluster at least once a year.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eGoogle Distributed Cloud cluster certificate authorities (CAs) need to be rotated at least once every five years because of their five-year validity.\u003c/p\u003e\n"],["\u003cp\u003eCertificates for cluster components like \u003ccode\u003ekube-apiserver\u003c/code\u003e and \u003ccode\u003eetcd\u003c/code\u003e are valid for one year and are renewed during cluster upgrades.\u003c/p\u003e\n"],["\u003cp\u003eClusters must be upgraded at least once a year to prevent the cluster component certificates from expiring.\u003c/p\u003e\n"],["\u003cp\u003eExpired cluster certificates must be renewed manually, following specific instructions provided in the documentation.\u003c/p\u003e\n"]]],[],null,["# Required periodic maintenance\n\n\u003cbr /\u003e\n\nThis document describes periodic maintenance that is required for your\nGoogle Distributed Cloud clusters.\n\nRotate certificate authorities\n------------------------------\n\nThe certificate authorities (CAs) in a cluster are valid for five years, so you\nmust\n[rotate your CAs](/anthos/clusters/docs/bare-metal/1.16/how-to/ca-rotation)\nat least once every five years.\n\nCertificates for cluster components\n-----------------------------------\n\nCluster components use certificates for authentication. These components\ninclude `kube-apiserver`, `kube-controller-manager`, `kube-scheduler`, `etcd`\nand `kubelet`. The certificates are valid for one year and are renewed during\ncluster [upgrade](/anthos/clusters/docs/bare-metal/1.16/how-to/upgrade). To prevent the certificates from\nexpiring, you must upgrade your cluster at least once a year.\n\nIf the cluster certificates have expired, they must be\n[renewed manually](/anthos/clusters/docs/bare-metal/1.16/troubleshooting/expired-certs). For more\ninformation, see\n[Certificate expiration](/anthos/clusters/docs/bare-metal/1.16/troubleshooting/failure-mode-analysis#certificate_expiration)."]]
