diff --git a/cmd/kubeadm/app/cmd/certs.go b/cmd/kubeadm/app/cmd/certs.go
index 0d4635341b7..f5a4ff52b10 100644
--- a/cmd/kubeadm/app/cmd/certs.go
+++ b/cmd/kubeadm/app/cmd/certs.go
@@ -301,14 +301,6 @@ func addRenewFlags(cmd *cobra.Command, flags *renewFlags) {
 	options.AddConfigFlag(cmd.Flags(), &flags.cfgPath)
 	options.AddCertificateDirFlag(cmd.Flags(), &flags.cfg.CertificatesDir)
 	options.AddKubeConfigFlag(cmd.Flags(), &flags.kubeconfigPath)
-
-	// TODO: remove these flags in a future version:
-	// https://github.com/kubernetes/kubeadm/issues/2163
-	const deprecationMessage = "This flag will be removed in a future version. Please use 'kubeadm certs generate-csr' instead."
-	options.AddCSRFlag(cmd.Flags(), &flags.csrOnly)
-	cmd.Flags().MarkDeprecated(options.CSROnly, deprecationMessage)
-	options.AddCSRDirFlag(cmd.Flags(), &flags.csrPath)
-	cmd.Flags().MarkDeprecated(options.CSRDir, deprecationMessage)
 }
 
 func renewCert(flags *renewFlags, kdir string, internalcfg *kubeadmapi.InitConfiguration, handler *renewal.CertificateRenewHandler) error {
diff --git a/cmd/kubeadm/app/cmd/certs_test.go b/cmd/kubeadm/app/cmd/certs_test.go
index 32fbccbb483..18ec56694d2 100644
--- a/cmd/kubeadm/app/cmd/certs_test.go
+++ b/cmd/kubeadm/app/cmd/certs_test.go
@@ -269,31 +269,6 @@ func TestRunRenewCommands(t *testing.T) {
 	}
 }
 
-func TestRenewUsingCSR(t *testing.T) {
-	tmpDir := testutil.SetupTempDir(t)
-	defer os.RemoveAll(tmpDir)
-	cert := certsphase.KubeadmCertEtcdServer()
-
-	cfg := testutil.GetDefaultInternalConfig(t)
-	cfg.CertificatesDir = tmpDir
-
-	caCert, caKey, err := certsphase.KubeadmCertEtcdCA().CreateAsCA(cfg)
-	if err != nil {
-		t.Fatalf("couldn't write out CA %s: %v", certsphase.KubeadmCertEtcdCA().Name, err)
-	}
-
-	if err := cert.CreateFromCA(cfg, caCert, caKey); err != nil {
-		t.Fatalf("couldn't write certificate %s: %v", cert.Name, err)
-	}
-
-	renewCmds := getRenewSubCommands(os.Stdout, tmpDir)
-	cmdtestutil.RunSubCommand(t, renewCmds, cert.Name, "--csr-only", "--csr-dir="+tmpDir, fmt.Sprintf("--cert-dir=%s", tmpDir))
-
-	if _, _, err := pkiutil.TryLoadCSRAndKeyFromDisk(tmpDir, cert.Name); err != nil {
-		t.Fatalf("couldn't load certificate %q: %v", cert.Name, err)
-	}
-}
-
 func TestRunGenCSR(t *testing.T) {
 	tmpDir := testutil.SetupTempDir(t)
 	defer os.RemoveAll(tmpDir)