Is there a documented way to rotate CAs?

[faraonc]

Doing a proof-of-concept on kubeone, and trying to practice rotating CAs. I ran into an issue with kubelet and etcd, which I was able to resolve, but keep a hitting another issue e.g. metrics-server cert issue, cilium cert issue

Essentially, I want to use new /etc/kubernetes/pki/ca.crt and /etc/kubernetes/pki/ca.key . Iskubeadm the only way?

[kron4eg]

The best what's available is from upstream: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/