Update the certificate in your kubeconfig
Your kubeconfig embeds the certificate of the authority (the CA) that signs Bunker's Kubernetes endpoint. That certificate lasts 90 days and a new copy is issued every 60 days. A kubeconfig that still carries an older copy stops working the day that copy expires, and kubectl then answers x509: certificate has expired or is not yet valid.
Below you will find the current certificate for each endpoint, its fingerprint and the command that replaces it in your kubeconfig. Your token and your permissions stay the same.
Page updated on 20 October 2026.
A kubeconfig that points to kube.france-nuage.fr:31443 and still carries the previous copy stops working on 21 October 2026 at 09:34 UTC. For kube-dc05.france-nuage.fr:31443, the date is 30 October 2026 at 02:55 UTC. The command in Read the certificate in your kubeconfig tells you whether yours is affected.
Deadlines
The endpoint you use is on the server: line of your kubeconfig. All times are UTC.
| Endpoint | Previous copy expires on | Current copy expires on |
|---|---|---|
kube.france-nuage.fr:31443 | 21 October 2026 at 09:34 | 20 December 2026 at 09:34 |
kube-dc05.france-nuage.fr:31443 | 30 October 2026 at 02:55 | 29 December 2026 at 02:55 |
The next copy is expected on 20 November 2026 for kube.france-nuage.fr and on 29 November 2026 for kube-dc05.france-nuage.fr.
Read the certificate in your kubeconfig
The following command prints the end date and the fingerprint of the certificate your kubeconfig embeds, for the current context:
kubectl config view --raw --minify \
-o jsonpath='{.clusters[0].cluster.certificate-authority-data}' \
| base64 --decode \
| openssl x509 -noout -enddate -fingerprint -sha256
Compare the fingerprint printed by openssl with the one for your endpoint:
| Endpoint | SHA-256 fingerprint of the current copy |
|---|---|
kube.france-nuage.fr:31443 | 1D:26:E9:FE:1D:A4:4B:1B:E0:D6:BF:5C:42:7E:57:93:28:94:7E:C1:EA:69:9A:42:19:ED:25:E5:EE:49:13:F7 |
kube-dc05.france-nuage.fr:31443 | CC:67:50:FE:1A:43:C5:CE:B7:A7:D1:52:E3:CC:68:4B:91:79:E5:AC:F8:1F:70:EC:83:7F:AA:EA:CF:D6:EF:A5 |
If the two fingerprints match, your kubeconfig is good until the date in the deadlines table. Otherwise, replace the certificate.
Replace the certificate
1. Save the current copy
Paste the block for your endpoint into a terminal. It writes the certificate to a file named kube-ca.crt in the current directory.
Here is the block for kube.france-nuage.fr:31443:
cat > kube-ca.crt <<'EOF'
-----BEGIN CERTIFICATE-----
MIIBjTCCATOgAwIBAgIRAMaNsPSXv9htDLV2DvdE80UwCgYIKoZIzj0EAwIwJjEk
MCIGA1UEAxMbY2Fwc3VsZS1wcm94eS1zZWxmc2lnbmVkLWNhMB4XDTI2MDkyMTA5
MzQ1M1oXDTI2MTIyMDA5MzQ1M1owJjEkMCIGA1UEAxMbY2Fwc3VsZS1wcm94eS1z
ZWxmc2lnbmVkLWNhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGrXhE1R7sh7E
MQSm457hAWEXPrvRJQnY/oJXxI1is3yk2jB8kgiK4akWDfhWIT9xjkWrv3FvhxZM
iqwMmd9hJaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYD
VR0OBBYEFAj276YmMu4nTrQ9CuE53qbDlI82MAoGCCqGSM49BAMCA0gAMEUCIAgV
uVPEYQBIgB5AyIfWs0b7kZCs87IZDP3xuw8UCuQlAiEA8VdRsx+6KGIEpt/HQTj7
ND9KC2ezHjtqLi4qkX/YhGQ=
-----END CERTIFICATE-----
EOF
And the one for kube-dc05.france-nuage.fr:31443:
cat > kube-ca.crt <<'EOF'
-----BEGIN CERTIFICATE-----
MIIBjTCCATKgAwIBAgIQX3QLhBsNkEbVL0/AH9Ok9TAKBggqhkjOPQQDAjAmMSQw
IgYDVQQDExtjYXBzdWxlLXByb3h5LXNlbGZzaWduZWQtY2EwHhcNMjYwOTMwMDI1
NTIxWhcNMjYxMjI5MDI1NTIxWjAmMSQwIgYDVQQDExtjYXBzdWxlLXByb3h5LXNl
bGZzaWduZWQtY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARRW25+S7P4msWN
pBJ1EQhYsPcYRRi0yzJcOIzAXQfqOU1wyNbQZ4rWRm9fJoRNoMthSmw5rm2uNGww
LGgOhvKIo0IwQDAOBgNVHQ8BAf8EBAMCAqQwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
HQ4EFgQUPRFQYvIVj6oELeJx3UX5Cr8DMtwwCgYIKoZIzj0EAwIDSQAwRgIhAKdl
zSkOEXIq7+TwMVs1bu+yBVUCk5LuKUpqH/uJ3jROAiEApAVHMpKdSRUHxYa+mF7/
m/8K13UochIThTKD4lYqECo=
-----END CERTIFICATE-----
EOF
2. Check the fingerprint of the file
Before using it, check that kube-ca.crt carries the fingerprint from the table above, using the following command:
openssl x509 -in kube-ca.crt -noout -fingerprint -sha256 -enddate
3. Put the certificate into the kubeconfig
The kubectl config set-cluster command replaces the certificate of the current context:
kubectl config set-cluster \
"$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')" \
--certificate-authority=kube-ca.crt --embed-certs=true
It writes to ~/.kube/config, or to the file named by the KUBECONFIG variable if you have set it. Only the certificate changes, the server address and your token stay in place.
4. Check the access
A read command on one of your Kubernetes namespaces is enough to confirm the connection goes through:
kubectl get pods -n <your-namespace>
Your CI pipelines
A kubeconfig stored in a CI variable expires on the same date as the one on your machine, and nothing warns you before the first deployment fails. Once your file is updated, paste its content back into the variable. If you followed the tutorial Deploy to Kubernetes from GitLab CI, that is the KUBE_CONFIG variable, of type File.
Troubleshooting
"certificate has expired or is not yet valid"
This message means the certificate embedded in your kubeconfig is past its end date. The date kubectl quotes after is after is the end date of your old copy. Go through the steps in Replace the certificate.
"certificate signed by unknown authority"
This message means the certificate in your kubeconfig belongs to another endpoint. Read the server: line of the kubeconfig again, then take the matching block, since kube and kube-dc05 each have their own certificate.
"i/o timeout"
A timeout comes from the network. Both endpoints only answer through your VPN, so check that it is connected first.