Skip to content

mkectl certs

mkectl certs#

Inspect and export cluster certificates

Synopsis#

Inspect and export the TLS certificates used by an MKE cluster.

Use 'certs status' to see what expires when, 'certs dump' to export certificate material for external systems such as load balancers, registries or monitoring, and 'certs rotate' to replace a certificate authority with a newly generated one.

MKE keeps certificate material in three places:

  • Kubernetes Secrets, for the customer-facing (ingress), authentication and webhook certificates. These are reachable with a kubeconfig alone.
  • cert-manager Certificate resources, which own the renewal schedule for the certificates above and renew them automatically.
  • Files on the control-plane nodes, for the Kubernetes, etcd and kubelet PKI. These have no Secret representation and are only reachable over SSH.

Commands that need the node-local tier say so explicitly; see the --include-node-pki flag on 'certs status' and the --etcd flag on 'certs dump'.

If you are coming from MKE 3, 'certs dump' replaces the 'dump-certs' command and keeps its flag names; see 'mkectl certs dump --help' for the flag-by-flag mapping. 'certs rotate --client-ca' replaces 'ca --client --rotate'. 'certs status' has no MKE 3 equivalent - certificate expiry was not reported by any MKE 3 command.

Options#

  -h, --help   help for certs

Options inherited from parent commands#

  -f, --file string              path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
      --kubeconfig string        path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
  -l, --logLevel string          specify a log level (info, warn, debug, trace, error) (default "info")
      --no-color                 when provided, disables colored output
      --no-pretty-print          when provided, disables pretty print output formatting
      --version version[=true]   --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version