# 2021-06-08-15:22:45+0800 rotate gardener ETCD and APIserver CA cert

- Cause: https://jira.tidbcloud.com/projects/DM/issues/DM-1471?filter=myopenissues
- Operation:

1. after first garden-setup, delete service account and gardenlet-kubeconfig
```bash
kubectl get secret -n garden garden-kubeconfig-for-admin --template={{'.data.kubeconfig'}} | base64 -d > garden
KUBECONFIG=garden kubectl delete sa gardener-apiserver gardener-controller-manager gardener-scheduler -n garden
```

```bash
kubectl config use-context arn:aws:eks:ap-northeast-1:380838443567:cluster/prod-seed-ap-northeast-1 
kubectl delete secret gardenlet-kubeconfig -n garden  
kubectl config use-context arn:aws:eks:ap-northeast-2:380838443567:cluster/prod-seed-ap-northeast-2   
kubectl delete secret gardenlet-kubeconfig -n garden
kubectl config use-context arn:aws:eks:ap-southeast-1:380838443567:cluster/prod-seed-ap-southeast-1 
kubectl delete secret gardenlet-kubeconfig -n garden  
kubectl config use-context arn:aws:eks:us-east-1:380838443567:cluster/prod-seed-us-east-1   
kubectl delete secret gardenlet-kubeconfig -n garden
kubectl config use-context arn:aws:eks:us-west-2:380838443567:cluster/prod-base-us-west-2   
kubectl delete secret gardenlet-kubeconfig -n garden
kubectl config use-context arn:aws:eks:us-west-2:380838443567:cluster/prod-seed-us-west-2  
kubectl delete secret gardenlet-kubeconfig -n garden 
kubectl config use-context gke_dbaas-prod_asia-northeast1_prod-seed-asia-northeast1-85509b9   
kubectl delete secret gardenlet-kubeconfig -n garden
kubectl config use-context gke_dbaas-prod_asia-southeast1_prod-seed-asia-southeast1-f7a3983   
kubectl delete secret gardenlet-kubeconfig -n garden
kubectl config use-context gke_dbaas-prod_us-west1_prod-seed-us-west1-d5ae263 
kubectl delete secret gardenlet-kubeconfig -n garden
kubectl config use-context gke_dbaas-prod_us-central1_prod-seed-us-central1-e5cf570
kubectl delete secret gardenlet-kubeconfig -n garden
```

### after second garden set-up, restart central and observability-controller
```bash
kubectl delete po -l app=central-server -n prod
kubectl delete po -l app=observability -n monitoring
```

- Impact: Customer will got error when call Cluster API in Central. 
- Recovery operation: N/A
- Time window: 2021-06-08-20:00:45+0800 ~ 2021-06-08-21:00:45+0800