Validate and approve Certificate Signing Requests (CSRs) as follows. Unless otherwise specified, run the commands as user core.
[core@csah ~]$ oc get nodes
NAME STATUS ROLES AGE VERSION
etcd-0.example.com Ready master 52m v1.16.2
etcd-1.example.com Ready master 52m v1.16.2
etcd-2.example.com Ready master 52m v1.16.2
[core@csah ~]$ oc get csr
NAME AGE REQUESTOR CONDITION
csr-2hkn9 42m system:node:etcd-1.example.com Approved,Issued
csr-9gdsn 15m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-cfl8l 12m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-f7lf4 30m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-mk6kk 42m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Approved,Issued
csr-mq8tm 42m system:node:etcd-2.example.com Approved,Issued
csr-n5tlg 43m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Approved,Issued
csr-rvhwr 33s system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-zlx7p 42m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Approved,Issued
csr-zvkck 42m system:node:etcd-0.example.com Approved,Issued
[core@csah ~]$ oc get csr | grep -i pending | cut -f 1 -d ' ' | xargs -n 1 oc adm certificate approve
certificatesigningrequest.certificates.k8s.io/csr-9gdsn approved
certificatesigningrequest.certificates.k8s.io/csr-cfl8l approved
certificatesigningrequest.certificates.k8s.io/csr-f7lf4 approved
certificatesigningrequest.certificates.k8s.io/csr-ljpbx approved
certificatesigningrequest.certificates.k8s.io/csr-rvhwr approved
[core@csah ~]$ oc get csr | grep -i pending
csr-8zxkk 52s system:node:worker-0.example.com Pending
csr-qjztw 53s system:node:worker-1.example.com Pending
[core@csah ~]$ oc get csr | grep -i pending | cut -f 1 -d ' ' | xargs -n 1 oc adm certificate approve
certificatesigningrequest.certificates.k8s.io/csr-8zxkk approved
certificatesigningrequest.certificates.k8s.io/csr-qjztw approved
[core@csah ~]$ oc get nodes
NAME STATUS ROLES AGE VERSION
etcd-0.example.com Ready master 56m v1.16.2
etcd-1.example.com Ready master 56m v1.16.2
etcd-2.example.com Ready master 56m v1.16.2
worker-0.example.com Ready worker 4m50s v1.16.2
worker-1.example.com Ready worker 4m51s v1.16.2