mkectl certs status

mkectl certs status

Show certificate subjects, issuers and expiry

Synopsis

Show the certificates MKE manages, with subject, issuer, expiry and days remaining.

By default only certificates reachable through the Kubernetes API are inspected. The node-local k0s control-plane, etcd and kubelet certificates are NOT included unless --include-node-pki is given, and the report states when they were skipped. Those are the certificates whose expiry takes the cluster down, so include them when you are checking for expiry rather than looking at a specific certificate.

Certificates issued by cert-manager are comparatively short-lived and renew on their own; this command shows when that is due, or has failed to happen.

The external identity provider CA bundles (LDAP, SAML, OIDC) are reported too. Those belong to the identity provider and MKE never renews them, so their expiry breaks all authentication while every MKE-owned certificate stays healthy.

mkectl certs status [flags]

Examples

  # Certificates reachable over the Kubernetes API
  mkectl certs status

  # Include the node-local k0s, etcd and kubelet PKI (requires SSH)
  mkectl certs status --include-node-pki

  # Machine-readable, for monitoring
  mkectl certs status -o json

  # Only what expires in the next 30 days
  mkectl certs status --expiring-within 720h

Options

      --expiring-within duration   only report certificates expiring within this duration (for example 720h). Already-expired certificates are always reported
  -h, --help                       help for status
      --include-node-pki           also inspect the node-local k0s, etcd and kubelet certificates over SSH. Requires SSH access to the control-plane hosts listed in the cluster's MKE config. These certificates are not visible through the Kubernetes API, so without this flag they are not inspected at all
  -o, --output string              output format: json or yaml

Options inherited from parent commands

  -f, --file string              path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
      --kubeconfig string        path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
  -l, --logLevel string          specify a log level (info, warn, debug, trace, error) (default "info")
      --no-color                 when provided, disables colored output
      --no-pretty-print          when provided, disables pretty print output formatting
      --version version[=true]   --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version