title: kubernetes + coreos cluster - replacing certificates
body: <p>I have a coreos kubernetes cluster, which I started by following this article: </p>
  
  <p><a href="https://coreos.com/kubernetes/docs/latest/kubernetes-on-aws.html" rel="nofollow">kubernetes coreos cluster on AWS</a></p>
  
  <p>TLDR; </p>
  
  <pre><code>&gt; kube-aws init
  &gt; kube-aws render
  &gt; kube-aws up
  </code></pre>
  
  <p>Everything worked good and I had a kubernetes coreos cluster on AWS. 
  In the article there is a warning that said:</p>
  
  <blockquote>
    <p>PRODUCTION NOTE: the TLS keys and certificates generated by kube-aws
    should not be used to deploy a production Kubernetes cluster. Each
    component certificate is only valid for 90 days, while the CA is valid
    for 365 days. If deploying a production Kubernetes cluster, consider
    establishing PKI independently of this tool first.</p>
  </blockquote>
  
  <p>So I wanted to replace the default certificates, so I followed the following article: </p>
  
  <p><a href="https://coreos.com/kubernetes/docs/latest/openssl.html" rel="nofollow">coreos certificates</a></p>
  
  <p>TLDR;</p>
  
  <ol>
  <li>created the following self signed certificates: ca.pem, ca-key.pem</li>
  <li>created the certificates for the controller: apiserver.pem, apiserver-key.pem</li>
  <li>Replaced the certificates in the controller with the certificates created above, and rebooted the controller</li>
  <li>created a worker certificates and replaced the certificates in the workers and rebooted them</li>
  <li>configured kubectl to use the new certificates i created and also configured the context and user</li>
  </ol>
  
  <p>Im getting a communication error between kubectl and the cluster, complaining about the certificate</p>
  
  <blockquote>
    <p>Unable to connect to the server: x509: certificate signed by unknown
    authority</p>
  </blockquote>
  
  <p>I also tried to use a signed certificate for kubectl which points to the cluster DNS, I set a DNS for the cluster. </p>
  
  <p>How do I make kubectl communicate with my cluster? </p>
  
  <p>Thanks in advance</p>
  
  <p>EDIT:</p>
  
  <p>My <strong>~/.kube/config</strong> looks like this:</p>
  
  <pre><code>apiVersion: v1
  clusters:
  - cluster:
      certificate-authority: /Users/Yariv/Development/workspace/bugeez/bugeez-kubernetes/credentials/ca2.pem
      server: https://kubernetes.bugeez.io
    name: bugeez
  contexts:
  - context:
      cluster: bugeez
      user: bugeez-admin
    name: bugeez-system
  current-context: bugeez-system
  kind: Config
  preferences: {}
  users:
  - name: bugeez-admin
    user:
      client-certificate: /Users/Yariv/Development/workspace/bugeez/bugeez-kubernetes/credentials/admin2.pem
      client-key: /Users/Yariv/Development/workspace/bugeez/bugeez-kubernetes/credentials/admin-key2.pem
  </code></pre>
  
  <p>EDIT:</p>
  
  <p>All my certificates are signed by ca2.pem, I also validated this fact by running: </p>
  
  <pre><code>openssl verify -CAfile ca2.pem &lt;certificate-name&gt;
  </code></pre>
  
  <p>EDIT:</p>
  
  <p>What I think is the cause of the error is this: 
  When I switch the keys in the controller and workers, seems like cloud-config is overwriting my new keys with the old ones. How do I replace the keys and also change cloud-config to adapt to my change?</p>