> For the complete documentation index, see [llms.txt](https://platform9.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://platform9.com/kb/smcp/frequently-asked-questions/cluster-nodes-in-notready-state-as-the-kube-certificates-expired.md).

# Cluster Nodes in NotReady State as the Kube Certificates Expired

## Problem

* The kube certificates in the directory `/etc/pf9/kube.d/certs/` are not automatically renewed.
* `pf9-nodelet.service` logs the below errors:

{% tabs %}
{% tab title="Bash" %}

```bash
{"L":"ERROR","T":"2025-05-01T13:23:12.660Z","C":"nodelet/nodelet.go:79","M":"Failed to reconcile host: error sending status update to sunpike: rpc error: code = Unknown desc = apiserver storage error: an error on the server (\"Internal Server Error: \\\"/apis/sunpike.platform9.com/v1alpha1/hosts/ed083915-a286-483a-8913-05c579338439\\\": Unauthorized\") has prevented the request from succeeding (get hosts.sunpike.platform9.com ed083915-a286-483a-8913-05c579338439)"}
```

{% endtab %}
{% endtabs %}

## Environment

* Platform9 Edge Cloud - v-5.3.0-2075501 and Higher

## Cause

* This issue only occurs in the below conditions:
  * The parameters `default_lease_ttl` and `max_lease_ttl` in file `etc/pf9-vault.d/server-config.hcl` on the duVM are modified from existing TTL of `26280h` to lower values.
  * `nodelet phases` are restarted on a node/s.
* This causes the certificates on the node to be renewed with the new `default_lease_ttl` expiry date and the certificate is not auto-renewed causing it to become invalid post it's expiry.
* This is known bug already reported internally with ID: **AIR-1459**

## Workaround

* The workaround to this problem is to restart the `nodelet phases` with `--regen-certs` parameter.
* Perform the commands below in the same sequence.

{% tabs %}
{% tab title="Bash" %}

```bash
$ systemctl stop pf9-hostagent pf9-nodeletd
```

{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="Bash" %}

```bash
$ /opt/pf9/nodelet/nodeletd phases restart --regen-certs
```

{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="Bash" %}

```bash
$ systemctl start pf9-hostagent
```

{% endtab %}
{% endtabs %}

* Wait for 5-7 mins for the node to reconcile and observe if the node is Healthy.

## Additional Information

* Reach out to Platform9 Support Team for any additional questions/concerns regarding the bug.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://platform9.com/kb/smcp/frequently-asked-questions/cluster-nodes-in-notready-state-as-the-kube-certificates-expired.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.