Skip to content

mkectl certs rotate

mkectl certs rotate#

Replace a certificate authority with a newly generated one

Synopsis#

Replace certificate authorities with newly generated ones, in place.

With no flags this rotates every certificate authority that can be replaced without downtime, after listing them and asking for confirmation. Name a specific authority to narrow the run, or pass --force to skip the confirmation.

The rotation runs in three stages, all within a single invocation:

  1. The new CA is added alongside the existing one, so both are trusted.
  2. Every certificate issued by the old CA is reissued from the new one.
  3. Once nothing is signed by the old CA any more, it is removed.

Both CAs stay trusted throughout the middle stage, so certificates that are already in use keep working while the rotation is under way.

The rotation is safe to interrupt. If it stops part-way the cluster is left working with both CAs trusted, and running the command again continues from wherever it stopped: it determines where it is from the certificates themselves rather than from any saved progress. Run 'mkectl certs status' at any point to see which certificates have been reissued.

Certificate authorities that cannot be replaced without taking the cluster down are never included by default and must always be named explicitly.

Take a backup first. Restoring from one is the recovery path if a rotation fails part of the way through and cannot be re-run.

Rotation applies to the cluster the current kubeconfig points at. Managed child clusters keep their own separate certificate authorities and are not affected.

mkectl certs rotate [flags]

Examples#

  # Rotate every certificate authority that can be replaced without downtime
  mkectl certs rotate

  # The same, without the confirmation prompt
  mkectl certs rotate --force

  # Rotate only the MKE Client Root CA
  mkectl certs rotate --client-ca

  # See what a rotation would change, without touching the cluster
  mkectl certs rotate --dry-run

  # Inspect certificates before or after a rotation
  mkectl certs status

Options#

      --client-ca                       rotate only the MKE Client Root CA: the CA that signs the ingress and authentication server certificates, and that the Kubernetes API server trusts when it validates login tokens
      --dry-run                         report what would change without modifying the cluster
      --force                           bypass the confirmation shown when no certificate authority is named
  -h, --help                            help for rotate
      --lease-adopt-stale               if true, matching stale lease would be adopted instead of failing with error
      --lease-renew-interval duration   lease renew interval for cluster-wide/node operations, should be < leaseTTL (default 20s)
      --lease-ttl duration              lease TTL for cluster-wide/node operations (default 1m0s)

Options inherited from parent commands#

  -f, --file string              path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
      --kubeconfig string        path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
  -l, --logLevel string          specify a log level (info, warn, debug, trace, error) (default "info")
      --no-color                 when provided, disables colored output
      --no-pretty-print          when provided, disables pretty print output formatting
      --version version[=true]   --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version