Kubernetes
Copy link to the page “Kubernetes”
Renews Kubernetes TLS Secrets and JKS/PKCS12 stores and checks the certificate served by the Ingress or application.
What happens
- The appliance connects to Kubernetes through Kubernetes HTTPS API on port 6443.
- Finds existing certificates, keystore identities and Ingress consumers. Secrets owned by cert-manager or another controller are retained.
- Validates the certificate, key and chain and updates only the selected TLS identity or keystore alias in an existing mutable Secret. Other data, aliases and metadata are retained.
- The existing Ingress controller or application loads the change through its reload mechanism. The agent checks the served leaf certificate and complete intermediate chain against trusted roots. If it fails: On failure, previous selected data is restored if it still matches the agent's write, and the previous served certificate is checked. Concurrent changes to selected data are retained.
Technical details
- Connection
- The package runs on the appliance, which connects over HTTPS to Kubernetes HTTPS API, port 6443. No agent is installed.
- You need
- ServiceAccount token with get/patch on the designated Secret, read access to relevant Ingress resources and API discovery. Namespace inventory needs list; cert-manager needs Certificate list access in the same namespace. A Role with resourceNames can restrict Secret access to one name.
- Actions
- Discovery, Installation, Verification, Rollback
- Packages
-
kubernetes-api1.0.0 - Note
-
- Set API_URL with the cluster HTTPS port (normally 6443 or 443 through a proxy), NAMESPACE and SECRET_NAME. INGRESS_NAME can restrict reads to one Ingress. The agent selects the API version advertised by the cluster; TLS bindings are retained and immutable Secrets are never deleted or recreated.
- API TLS is verified by default; a private CA, MANAGEMENT_TLS_PIN_SHA256 or explicit ignore can be selected. The served certificate uses separate VERIFY_CA_BUNDLE or system roots. Use CA trust for unattended renewal of the API certificate itself; a leaf pin must be kept current.
- A sole concrete Ingress host can be selected automatically for verification. Otherwise set VERIFY_HOST, optionally VERIFY_PORT and VERIFY_SERVER_NAME for SNI. Wildcard bindings need a concrete host. Verification normally waits up to 180 seconds; VERIFY_TIMEOUT accepts 1–420 seconds.
- JKS/PKCS12 needs Java keytool with password-file support and OpenSSL on the appliance. Set SECRET_DATA_KEY, store password and KEYSTORE_ALIAS when several identities exist. Passwords can come from another data entry in the same Secret. Existing passwords are retained; characters must be supported by the Java provider. Java 17 SunJCE uses printable ASCII for PKCS12 passwords. Existing store protection selects the legacy or modern PKCS12 path.
- Explicit rollback needs the previous certificate and key or previous keystore, plus a current-certificate identity guard. The history store can contain only the selected identity; its base64 input accommodates 768 KiB decoded. The agent does not restart workloads; the Ingress controller or application must already reload changed Secrets.