All Products
Search

This Product

    Container Service for Kubernetes:[Product Change] Announcement on the Change of ACK Cluster API Server Internal Certificate Validity Period

    Document Center

    Container Service for Kubernetes:[Product Change] Announcement on the Change of ACK Cluster API Server Internal Certificate Validity Period

    Last Updated:Oct 23, 2026

    The API Server is a core component of the ACK cluster control plane. It uses an internal certificate for server-side operations with its LoopbackClient. In community versions, this certificate has a 1-year validity period and is not automatically rotated. The certificate is rotated only when an API Server pod restarts. The community has no plans to extend the validity period of this certificate. For more information, see #86552.

    To accommodate different user operations and maintenance (O&M) practices, Container Service for Kubernetes recently changed the default validity period of this built-in certificate to 10 years.

    Impact Scope

    This change affects ACK managed clusters and ACK dedicated clusters in which the built-in LoopbackClient certificate of the API Server has a 1-year validity period.

    • ACK clusters created before March 15, 2023, have an API Server built-in LoopbackClient certificate with a 1-year validity period.

    • ACK clusters are not affected if they were created on or after March 15, 2023, or upgraded to version 1.20.11 or later. These clusters have an API Server built-in LoopbackClient certificate with a 10-year validity period.

    Solutions

    ACK Managed Clusters

    You can check the creation time of your ACK managed clusters to determine if they are affected. For ACK managed clusters with a 1-year LoopbackClient certificate, Container Service for Kubernetes will complete self-checks and rolling restarts on the managed components before November 1, 2023. If you do not want Alibaba Cloud to automatically restart the managed-side API Server, you must promptly upgrade your cluster to version 1.24 or later. For specific instructions, see Manually upgrade a cluster.

    ACK Dedicated Clusters

    Log on to the master node and run the following command to query the expiration time of the LoopbackClient certificate.

    In the command, XX.XX.XX.XX represents the local IP address of the master node.

    curl --resolve apiserver-loopback-client:6443:xx.xx.xx.xx -k -v https://apiserver-loopback-client:6443/healthz 2>&1 |grep expire

    If your cluster has a 1-year certificate that has expired or is about to expire, you must upgrade your ACK cluster to version 1.24 or later. For instructions, see Manually upgrade a cluster. We recommend that you migrate to ACK Managed Cluster Pro Edition. For detailed steps, see Manually upgrade a cluster and hot migrate ACK dedicated clusters to ACK Managed Cluster Pro Edition.

    Important

    If you cannot upgrade your ACK dedicated clusters in the short term, log on to all master nodes in the cluster and manually restart the API Server.