🪩 Cluster is broken after shutdown

[rbo]

Nodes can not connect to api server anymore:

Jan 13 10:43:00 disco-cp-0 kubenswrapper[2785]: I0113 10:43:00.347463    2785 csi_plugin.go:887] Failed to contact API server when waiting for CSINode publishing: Get "https://api-int.disco.coe.muc.redhat.com:6443/apis/storage.k8s.io/v1/csinodes/disco-cp-0?resourceVersion=0": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-01-13T10:43:00Z is after 2026-01-11T05:51:03Z

[rbo]

Not the nodes are the problem, the API server has a expired cert:

echo "" | openssl s_client -connect api.disco.coe.muc.redhat.com:6443 | head -n20
Connecting to 10.32.98.157
depth=1 OU=openshift, CN=kube-apiserver-lb-signer
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=1 OU=openshift, CN=kube-apiserver-lb-signer
verify return:1
depth=0 CN=api.disco.coe.muc.redhat.com
verify error:num=10:certificate has expired
notAfter=Jan 11 09:45:04 2026 GMT
verify return:1
depth=0 CN=api.disco.coe.muc.redhat.com
notAfter=Jan 11 09:45:04 2026 GMT
verify return:1
CONNECTED(00000005)
---
Certificate chain
 0 s:CN=api.disco.coe.muc.redhat.com
   i:OU=openshift, CN=kube-apiserver-lb-signer
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Dec 12 09:45:03 2025 GMT; NotAfter: Jan 11 09:45:04 2026 GMT
DONE
 1 s:OU=openshift, CN=kube-apiserver-lb-signer
   i:OU=openshift, CN=kube-apiserver-lb-signer
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Apr  1 09:10:48 2025 GMT; NotAfter: Mar 30 09:10:48 2035 GMT
---