{"id":26434,"date":"2023-07-04T08:57:35","date_gmt":"2023-07-04T06:57:35","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=26434"},"modified":"2023-07-04T08:57:36","modified_gmt":"2023-07-04T06:57:36","slug":"kubernetes-certificates-overview-and-regeneration-example","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/","title":{"rendered":"Kubernetes Certificates Overview and Regeneration Example"},"content":{"rendered":"\n<p>Kubernetes certificates is a very important subject matter as it protects the communication of the components inside your cluster. However it is not a very popular topic as it could be quite confusing and adds more complexity to an already complex Kubernetes architecture. In this blog I&#8217;ll try to clarify it and give an example of a single certificate regeneration. If you have no or limited knowledge on that topic and want to learn more, this blog is for you. I&#8217;ll explain it the simpler I can. Please read on!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-kubernetes-certificates-architecture\">Kubernetes Certificates Architecture<\/h2>\n\n\n\n<p>I&#8217;ll use a vanilla Kubernetes cluster installed with <strong>kubeadm<\/strong>. Below you&#8217;ll see an overview of its certificates architecture known as a Public Key Infrastructure (PKI). In short, the PKI is the management of your certificates in the cluster:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png\" alt=\"\" class=\"wp-image-26436\" srcset=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png 1024w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-300x169.png 300w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-768x432.png 768w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1536x864.png 1536w, https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-2048x1152.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Kubernetes requires certificates for authentication over Transport Layer Security (TLS). This authentication is mandatory before a component can communicate with another one. TLS is using asymmetric encryption with a public and private key for this authentication. A public and private key are computed together and are called a certificate pair. This authentication process ensures that the communication between 2 components is legit. Once it is completed, the communication is then encrypted which means it is protected against eavesdropping. The PKI diagram shown above focus on this authentication part between the components of a Kubernetes cluster by using certificate pairs.<\/p>\n\n\n\n<p>There are 2 sides for those certificate pairs: The client and the server. Each side has then a pair of keys, one public (.crt file) and one private (.key file). Those certificates are signed by the same certificate authority (CA) that is trusted by all components in the cluster. This is how we can make sure the certificates are valid and authorized in our Kubernetes cluster. The same CA is used by all components in the cluster (and so the same ca.crt file is used by each component).<\/p>\n\n\n\n<p>When the certificate pair name contains &#8220;client&#8221;,  the component on the client side uses them to initiate a communication with the server certificate of another component. A client uses the public crt file of the server to encrypt its request. Only that server can decrypt this request by using its associated private key of the pair. The server then authenticates this client is legit by checking its client certificate has been signed by the same CA as itself.<\/p>\n\n\n\n<p>In the diagram above, the same line color of the box shows certificates of components that are designed to communicate together in a Kubernetes cluster. In red we can see for example that clients are <strong>kubectl<\/strong>, <strong>kubelet<\/strong>, <strong>scheduler<\/strong> and <strong>controller-manager<\/strong>. Their certificates are one of the parameters that can be found in their respective .conf file. Those clients communicate with the <strong>apiserver<\/strong> who is the server side of these communications. All use the same ca.crt file. So for example when the <strong>kubelet<\/strong> needs to communicate with the <strong>apiserver<\/strong>, it uses its certificates from the kubelet.conf file and the public apiserver.crt file of the <strong>apiserver<\/strong>. However when the <strong>apiserver<\/strong> needs to communicate with the <strong>kubelet<\/strong>, it uses its apiserver-kubelet-client certificate with the public kubelet.crt certificate of the <strong>kubelet<\/strong> component.<\/p>\n\n\n\n<p>I feel you need a break from this flow of knowledge so let&#8217;s tackle an easier piece of information. On the master node, the certificates are stored in the <strong>\/etc\/kubernetes\/pki<\/strong> folder. All the configuration files of the components of the cluster are stored into the <strong>\/etc\/kubernetes<\/strong> folder of the master node. In these configuration files, you&#8217;ll find the public and private key themselves or a path to those key files stored on the host. Simple and easy!<\/p>\n\n\n\n<p>By understanding this PKI you can also learn which components are communicating together. The front-proxy certificate are used for a specific case. Also the <strong>etcd<\/strong> component communicates with another one when you are using multiple <strong>etcd<\/strong> in your cluster. Otherwise only the <strong>apiserver<\/strong> component communicates with the <strong>etcd<\/strong>. The <strong>etcdctl<\/strong> tool, when used, also communicates with the <strong>etcd<\/strong>.<\/p>\n\n\n\n<p>The <strong>service account<\/strong> component is a special case of certificate as it is not signed by the CA.<\/p>\n\n\n\n<p>Finally let&#8217;s wrap up this section by checking our understanding of how those certificates work using an example. In a vanilla Kubernetes installation, we use the tool <strong>kubectl<\/strong> (read the &#8220;Wrap up&#8221; section at the end of my <a href=\"https:\/\/www.dbi-services.com\/blog\/kubecon-cloudnativecon-2023-day-3\/\" target=\"_blank\" rel=\"noreferrer noopener\">blog KubeCon 2023 &#8211; Day 3<\/a> if you want to check how you pronounce it!). <strong>kubectl<\/strong> is a client that communicate with the <strong>apiserver<\/strong> and so it uses its client keys from its configuration file (admin.conf) to communicate with the public key (.crt file) of the <strong>apiserver<\/strong>. <strong>kubectl<\/strong> client key is signed with the same CA as the <strong>apiserver<\/strong> and this can be checked by using the public CA certificate (ca.crt) that is also part of <strong>kubectl<\/strong> configuration file (admin.conf). Easy enough?<\/p>\n\n\n\n<p>If that is not so easy or so-so, let me provide you with more details about it. This <strong>kubectl<\/strong> configuration file is copied locally to any user authorized to connect to this Kubernetes cluster. So this admin.conf file is copied locally and renamed as .kube\/config for this authorized user. If you edit it you&#8217;ll see the following:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nclusters:\n- cluster:\n    certificate-authority-data: &lt;ca.crt certificate&gt;\n...\nusers:\n- name: ...\n  user:\n    client-certificate: &lt;client.crt certificate&gt;\n    client-key: &lt;client.key certificate&gt;\n<\/pre><\/div>\n\n\n<p>You can see now how the certificates are linked and stored into the configuration file of the component or tool as shown in the diagram above.<\/p>\n\n\n\n<p>Congrats if you&#8217;ve read this far, that is a lot to process if you are quite new to it. If you feel up to it, you can read more details about those certificates in the <a href=\"https:\/\/kubernetes.io\/docs\/setup\/best-practices\/certificates\/\" target=\"_blank\" rel=\"noreferrer noopener\">Kubernetes documentation<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-regeneration-of-the-apiserver-certificate\">Regeneration of the apiserver certificate<\/h2>\n\n\n\n<p>So you&#8217;ve got this vanilla Kubernetes cluster you&#8217;ve installed with <strong>kubeadm<\/strong>. You&#8217;ve also configured the certificates infrastructure and all is working well.<\/p>\n\n\n\n<p>You are currently using 2 master nodes but you want to add a third one because you&#8217;ve learned that this is the proper number to use to support the loss of one of them. So you need to regenerate the apiserver certificates because you need to add this new master as per this example. I didn&#8217;t mention it in the previous overview section but now you are a subject matter expert and we can push it a little bit further! In addition to the signed certificate (done by the CA) and those certificates communication process there is also some information inside the certificate (public key file). This is an additional protection that allows only communication to a host declared here. Listing all hosts in the certificate allows multiple hostnames to be protected by a single certificate. So in our example all <strong>apiserver<\/strong> will use the same field called <strong>Subject Alternate Name<\/strong>\u00a0(or\u00a0<strong>SAN<\/strong>) in the certificate that list the hostname of each <strong>apiserver<\/strong>.<\/p>\n\n\n\n<p>This <strong>SAN<\/strong> list is a configmap associated with <strong>kubeadm<\/strong> which is then called kubeadm-config. This configuration can be seen as follows on a master node:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: yaml; title: ; notranslate\" title=\"\">\n$ kubectl -n kube-system get cm kubeadm-config -o yaml\n...\n    apiServer:\n      certSANs:\n      - hostname1\n      - hostname2\n<\/pre><\/div>\n\n\n<p>This configuration can then be exported with the following command into a yaml file:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ kubectl get cm kubeadm-config -n kube-system -o jsonpath=&#039;{.data.ClusterConfiguration}&#039; &gt; kubeadm.yaml\n<\/pre><\/div>\n\n\n<p>Modify this kubeadm.yaml file by adding the hostname of the new <strong>apiserver<\/strong> as follows:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: yaml; highlight: [5]; title: ; notranslate\" title=\"\">\n    apiServer:\n      certSANs:\n      - hostname1\n      - hostname2\n      - hostname3\n<\/pre><\/div>\n\n\n<p>Then you have to delete the current <strong>apiserver<\/strong> certificates:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ rm -f \/etc\/kubernetes\/pki\/apiserver.*\n<\/pre><\/div>\n\n\n<p>You can now regenerate the <strong>apiserver<\/strong> certificates that will take into account the new hostname you&#8217;ve just added:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ kubeadm init phase certs apiserver --config kubeadm.yaml\n<\/pre><\/div>\n\n\n<p>Then you have to restart the <strong>apiserver<\/strong> pods in order to use those new generated certificates. However you must do it on the container level and not on the pod level (by using <strong>kubectl<\/strong>). We use containerd in our Kubernetes cluster and so we use the <strong>crictl<\/strong> tool:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ crictl pods|grep kube-apiserver|cut -d&#039; &#039; -f1\n$ crictl stopp &lt;pod-id&gt;\n$ crictl rmp &lt;pod-id&gt;\n<\/pre><\/div>\n\n\n<p>You can check the content of the new generated certificate with the following command:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n$ openssl x509 -in \/etc\/kubernetes\/pki\/apiserver.crt -text -noout\n<\/pre><\/div>\n\n\n<p>You are all set and you&#8217;ll need to repeat this operation on all master nodes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-summary\">Summary<\/h2>\n\n\n\n<p>I hope this blog helped you better understand the certificates architecture in Kubernetes. This topic is already a bit advanced. If you want to start your journey or consolidate your knowledge in Docker containers and Kubernetes, have a look at our <a href=\"https:\/\/www.dbi-services.com\/courses\/docker-and-kubernetes-essential-skills\/\" target=\"_blank\" rel=\"noreferrer noopener\">Workshop<\/a> on this topic. You&#8217;ll learn everything you need to get started and have plenty of opportunities to practice on a live lab. See you there!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kubernetes certificates is a very important subject matter as it protects the communication of the components inside your cluster. However it is not a very popular topic as it could be quite confusing and adds more complexity to an already complex Kubernetes architecture. In this blog I&#8217;ll try to clarify it and give an example [&hellip;]<\/p>\n","protected":false},"author":109,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1320,1522],"tags":[1149,151,89],"type_dbi":[3019,3017,2943],"class_list":["post-26434","post","type-post","status-publish","format-standard","hentry","category-devops","category-kubernetes","tag-certificate","tag-devops","tag-kubernetes","type-certificate","type-devops","type-kubernetes"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Kubernetes Certificates Overview and Regeneration Example - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kubernetes Certificates Overview and Regeneration Example\" \/>\n<meta property=\"og:description\" content=\"Kubernetes certificates is a very important subject matter as it protects the communication of the components inside your cluster. However it is not a very popular topic as it could be quite confusing and adds more complexity to an already complex Kubernetes architecture. In this blog I&#8217;ll try to clarify it and give an example [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-04T06:57:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-04T06:57:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png\" \/>\n<meta name=\"author\" content=\"DevOps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"DevOps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/\"},\"author\":{\"name\":\"DevOps\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4cd1b5f8a3de93f05a16ab8d7d2b7735\"},\"headline\":\"Kubernetes Certificates Overview and Regeneration Example\",\"datePublished\":\"2023-07-04T06:57:35+00:00\",\"dateModified\":\"2023-07-04T06:57:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/\"},\"wordCount\":1364,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/certificates-1024x576.png\",\"keywords\":[\"Certificate\",\"DevOps\",\"kubernetes\"],\"articleSection\":[\"DevOps\",\"Kubernetes\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/\",\"name\":\"Kubernetes Certificates Overview and Regeneration Example - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/certificates-1024x576.png\",\"datePublished\":\"2023-07-04T06:57:35+00:00\",\"dateModified\":\"2023-07-04T06:57:36+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4cd1b5f8a3de93f05a16ab8d7d2b7735\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/certificates-1024x576.png\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/certificates-1024x576.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kubernetes-certificates-overview-and-regeneration-example\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kubernetes Certificates Overview and Regeneration Example\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4cd1b5f8a3de93f05a16ab8d7d2b7735\",\"name\":\"DevOps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cdd2dd7441774355062c0f0f68612296b059cd1e2ff6c7af0b15dba0ed64a85f?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cdd2dd7441774355062c0f0f68612296b059cd1e2ff6c7af0b15dba0ed64a85f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cdd2dd7441774355062c0f0f68612296b059cd1e2ff6c7af0b15dba0ed64a85f?s=96&d=mm&r=g\",\"caption\":\"DevOps\"},\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/devops\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kubernetes Certificates Overview and Regeneration Example - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/","og_locale":"en_US","og_type":"article","og_title":"Kubernetes Certificates Overview and Regeneration Example","og_description":"Kubernetes certificates is a very important subject matter as it protects the communication of the components inside your cluster. However it is not a very popular topic as it could be quite confusing and adds more complexity to an already complex Kubernetes architecture. In this blog I&#8217;ll try to clarify it and give an example [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/","og_site_name":"dbi Blog","article_published_time":"2023-07-04T06:57:35+00:00","article_modified_time":"2023-07-04T06:57:36+00:00","og_image":[{"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png","type":"","width":"","height":""}],"author":"DevOps","twitter_card":"summary_large_image","twitter_misc":{"Written by":"DevOps","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/"},"author":{"name":"DevOps","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4cd1b5f8a3de93f05a16ab8d7d2b7735"},"headline":"Kubernetes Certificates Overview and Regeneration Example","datePublished":"2023-07-04T06:57:35+00:00","dateModified":"2023-07-04T06:57:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/"},"wordCount":1364,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png","keywords":["Certificate","DevOps","kubernetes"],"articleSection":["DevOps","Kubernetes"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/","url":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/","name":"Kubernetes Certificates Overview and Regeneration Example - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png","datePublished":"2023-07-04T06:57:35+00:00","dateModified":"2023-07-04T06:57:36+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4cd1b5f8a3de93f05a16ab8d7d2b7735"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2023\/06\/certificates-1024x576.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/kubernetes-certificates-overview-and-regeneration-example\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kubernetes Certificates Overview and Regeneration Example"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4cd1b5f8a3de93f05a16ab8d7d2b7735","name":"DevOps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/cdd2dd7441774355062c0f0f68612296b059cd1e2ff6c7af0b15dba0ed64a85f?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/cdd2dd7441774355062c0f0f68612296b059cd1e2ff6c7af0b15dba0ed64a85f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cdd2dd7441774355062c0f0f68612296b059cd1e2ff6c7af0b15dba0ed64a85f?s=96&d=mm&r=g","caption":"DevOps"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/devops\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/26434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=26434"}],"version-history":[{"count":85,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/26434\/revisions"}],"predecessor-version":[{"id":26537,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/26434\/revisions\/26537"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=26434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=26434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=26434"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=26434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}