Lubomir I. Ivanov
6ea5318972
The "kubelet-finalize" step does not work on worker nodes, because commonly they do not have the cluster CA key and all "init" phases have a pre-step to check for the existence of the CA key, designating the cluster as one that uses external CA or not. Changing this behavior is complicated in kubeadm, thus manually instruct the user how to do edit the file and to restart the kubelet. This is already what we do in: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration