Managing Cluster Certificates
1. Viewing Certificate Expiration
sudo kubeadm certs check-expiration
| Certificate | Path |
|---|
| apiserver | /etc/kubernetes/pki/apiserver.crt |
| apiserver-kubelet-client | /etc/kubernetes/pki/apiserver-kubelet-client.crt |
| front-proxy-client | /etc/kubernetes/pki/front-proxy-client.crt |
| etcd-server | /etc/kubernetes/pki/etcd/server.crt |
2. Renewing Certificates
sudo kubeadm certs renew all
sudo systemctl restart kubelet
# restart control-plane static pods (kubeadm does automatically on next sync)
3. Generating New Certificates
openssl req -new -newkey rsa:4096 -nodes -keyout user.key -out user.csr \
-subj "/CN=alice/O=devs"
kubectl create -f csr.yaml
kubectl certificate approve alice-csr
4. Configuring Certificate Rotation
# kubelet config
rotateCertificates: true
serverTLSBootstrap: true
Note: Kubelet auto-rotates client certs (90% of validity). Server cert rotation requires CSR approver.
5. Installing cert-manager
helm repo add jetstack https://charts.jetstack.io
helm install cert-manager jetstack/cert-manager \
-n cert-manager --create-namespace \
--set crds.enabled=true
6. Creating Certificate Resources
apiVersion: cert-manager.io/v1
kind: Certificate
metadata: { name: web-tls, namespace: prod }
spec:
secretName: web-tls
dnsNames: [app.example.com]
issuerRef: { name: letsencrypt-prod, kind: ClusterIssuer }
duration: 2160h
renewBefore: 360h
7. Configuring Issuers
| Issuer Kind | Source |
|---|
| SelfSigned | Self-signed for internal |
| CA | Use existing CA secret |
| ACME | Let's Encrypt, ZeroSSL |
| Vault | HashiCorp Vault PKI |
| Venafi | Enterprise CA |
8. Using ACME Protocol
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata: { name: letsencrypt-prod }
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: ops@example.com
privateKeySecretRef: { name: acme-key }
solvers:
- http01: { ingress: { class: nginx } }
- dns01:
route53: { region: us-east-1 }
9. Troubleshooting Certificate Issues
| Symptom | Check |
|---|
| Certificate not ready | kubectl describe certificate events |
| ACME challenge fails | DNS/HTTP solver reachability |
| Rate limit hit | Use staging issuer first |
10. Updating kubeconfig After Renewal
sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config