kubeadm: include a couple of workarounds in kubeadm-certs.md (#16726)

* kubeadm: include a couple of workarounds in kubeadm-certs.md

- add warning about --certificate-renewal=false bug.
- add warning about disable kubelet cert rotation on "init" nodes.

* Update content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

@@ -59,6 +59,17 @@ Additionally, kubeadm informs the user if the certificate is externally managed;
 `kubelet.conf` is not included in the list above because kubeadm configures kubelet for automatic certificate renewal.
 {{< /note >}}
 
+{{< warning >}}
+On nodes created with `kubeadm init`, prior to kubeadm version 1.17, there is a
+[bug](https://github.com/kubernetes/kubeadm/issues/1753) where you manually have to modify the contents of `kubelet.conf`. After `kubeadm init` finishes, you should update `kubelet.conf` to point to the
+rotated kubelet client certificates, by replacing `client-certificate-data` and `client-key-data` with:
+
+```yaml
+client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
+client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
+```
+{{< /warning >}}
+
 ## Automatic certificate renewal
 
 `kubeadm` renews all the certificates during control plane [upgrade](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/).
@@ -72,6 +83,11 @@ It is a best practice to upgrade your cluster frequently in order to stay secure
 
 If you have more complex requirements for certificate renewal, you can opt out from the default behavior by passing `--certificate-renewal=false` to `kubeadm upgrade apply` or to `kubeadm upgrade node`.
 
+{{< warning >}}
+Prior to kubeadm version 1.17 there is a [bug](https://github.com/kubernetes/kubeadm/issues/1818)
+where the default value for `--certificate-renewal` is `false` for the `kubeadm upgrade node`
+command. In that case, you should explicitly set `--certificate-renewal=true`.
+{{< /warning >}}
 
 ## Manual certificate renewal