Skip to content

mkectl certs dump

mkectl certs dump#

Export certificate material

Synopsis#

Export MKE certificate material as PEM, on stdout by default so it can be piped into openssl or redirected to a file.

Which certificate is exported depends on the flags:

(none) the customer-facing server certificate and its CA --cluster the Kubernetes cluster CA --etcd the etcd server certificate, read from a control-plane node --ca narrows any of the above to CA material only

Only public material is exported unless --include-keys is given, and private keys can only be written to files, never to stdout.

If you are coming from MKE 3, this replaces the 'dump-certs' command and keeps its flag names, so existing procedures translate directly:

dump-certs -> mkectl certs dump dump-certs --ca -> mkectl certs dump --ca dump-certs --cluster -> mkectl certs dump --cluster dump-certs --etcd -> mkectl certs dump --etcd

One difference to be aware of: in MKE 3, --cluster returned the Swarm root CA. Swarm is not part of MKE 4, so here --cluster returns the Kubernetes cluster CA. It is the nearest equivalent, not the same certificate.

mkectl certs dump [flags]

Examples#

  # The customer-facing server certificate and its CA
  mkectl certs dump

  # Just the CA, for configuring an external load balancer or MSR
  mkectl certs dump --cluster --ca > mke-cluster-ca.pem

  # Inspect an exported certificate
  mkectl certs dump --ca | openssl x509 -noout -subject -enddate

  # Export everything to files, including private keys
  mkectl certs dump --output-dir ./mke-certs --include-keys

Options#

      --ca                  print only CA material
      --cluster             print the Kubernetes cluster CA instead of the customer-facing server certificate
      --etcd                print the etcd server certificate. etcd certificates exist only as files on the control-plane nodes, so this requires SSH access to a host listed in the cluster's MKE config
      --force               bypass the private key export confirmation
  -h, --help                help for dump
      --include-keys        also export private key material. Requires --output-dir; keys are never written to stdout, and are not available with --ca or --cluster, which export CA certificates only
      --output-dir string   write PEM files into this directory instead of printing to stdout

Options inherited from parent commands#

  -f, --file string              path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
      --kubeconfig string        path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
  -l, --logLevel string          specify a log level (info, warn, debug, trace, error) (default "info")
      --no-color                 when provided, disables colored output
      --no-pretty-print          when provided, disables pretty print output formatting
      --version version[=true]   --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version