Customers are getting misguided by the note in the below doc. They are assuming that absolutely no manual step is required when restarting the cluster before the expiry date of kube-apiserver-to-kubelet-signer.

https://docs.openshift.com/container-platform/4.14/backup_and_restore/graceful-cluster-shutdown.html#graceful-shutdown_graceful-shutdown-cluster

A clarification needs to be added in the note that they might be needed to approve the pending CSRs for renewing the expired kubelet certificates.