// Module included in the following assemblies:
//
// * backup_and_restore/control_plane_backup_and_restore/disaster_recovery/scenario-3-expired-certs.adoc
// * etcd/etcd-backup-restore/etcd-disaster-recovery.adoc

:_mod-docs-content-type: PROCEDURE
[id="dr-scenario-3-recovering-expired-certs_{context}"]
= Recovering from expired control plane certificates

[role="_abstract"]
You can restore kubelet certificates by manually approving pending `node-bootstrapper` certificate signing requests (CSRs) and, on user-provisioned installations, kubelet serving CSRs. Approved CSRs return nodes to a healthy state after control plane certificates expire.

.Prerequisites

* You have access to the cluster as a user with the `cluster-admin` role.
* You have access to the {oc-first}.

.Procedure

. Get the list of current CSRs by running the following command:
+
[source,terminal]
----
$ oc get csr
----
+
.Example output
[source,terminal]
----
NAME        AGE    SIGNERNAME                                    REQUESTOR                                                                   CONDITION
csr-2s94x   8m3s   kubernetes.io/kubelet-serving                 system:node:<node_name>                                                     Pending
csr-4bd6t   8m3s   kubernetes.io/kubelet-serving                 system:node:<node_name>                                                     Pending
csr-4hl85   13m    kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending
csr-zhhhp   3m8s   kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending
...
----
+
In the example output, CSRs with a `SIGNERNAME` of `kubernetes.io/kubelet-serving` are kubelet serving CSRs. You see this CSR type on user-provisioned installations. CSRs with a `SIGNERNAME` of `kubernetes.io/kube-apiserver-client-kubelet` and a `node-bootstrapper` requestor are `node-bootstrapper` CSRs that you must approve to restore kubelet certificates.

. Review the details of a CSR to verify that it is valid by running the following command:
+
[source,terminal]
----
$ oc describe csr <csr_name>
----
+
where:

`<csr_name>`:: Specifies the name of a CSR from the list of current CSRs.

. Approve each valid `node-bootstrapper` CSR by running the following command:
+
[source,terminal]
----
$ oc adm certificate approve <csr_name>
----

. For user-provisioned installations, approve each valid kubelet serving CSR by running the following command:
+
[source,terminal]
----
$ oc adm certificate approve <csr_name>
----
