Kubernetes Certificates

In this video, I describe about certificates generation and usage in Kubernetes and related products.

[@vitusyu9583]

Good presentation, useful info for my deeper understanding of how certs work in k8s! Thx!

[@SridCloud]

Thanks for your visit and comments. Thanks!

[@shantanupareek6631]

Thank you so much for this video. Good efforts!

[@krishnachaitu17]

Thanks for this very insightful

[@JitenPalaparthi]

One of the best videos abt certificate

[@SridCloud]

Wow, thanks!

[@robertsarnapeta5825]

These certs are self-signed. In baremetal kubernetes cluster, how do we manage these certs. Usually, in PROD, do we replace the certs by getting them from security team? Please explain on how we renew them or manage them in realtime PROD scenario. From where do we get the certs and do we replace ca.crt and ca.key and all the certs for different components etc... My understanding is that we dont use self-signed certs for PROD environment. Hope, you got my query. Thanks!

[@mazharabbas871]

Thank you so much. This is all about Kubernetes certificates :)

[@SridCloud]

You're most welcome!

[@dakshithamevandias8949]

I'm bit confused with clients private key. For example when and how will admins(kubectl) private key be used? Isnt it only the client certificate that is required for the server side?

[@NamLe-fl4sz]

From Viet Nam. Thanks

[@pengumind151]

the way you created the kube-apiserver cert is wrong cause the alternate dns names were not defined, it does work partially in a k8s cluster

[@mIbrahim1981]

Thanks.. Very good explanation ... Just have one question, How api-server validate the certificate sent by admin user ? Does he has the Admin certificate installed ?

[@SridCloud]

Trust is the answer..

[@inadmemmedov6116]

Really liked the concept, thanks for the detailed information provided. One question, if the api-server cert is expired , do we need to generate a new api-server.key and new csr or we sign the same csr with the ca.key and ca.crt?

[@SridCloud]

Thanks for visiting my channel. Please refer to kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ for setting up automatic or manual renewal of certs.

[@nileshwagh3601]

Hi Can you guide me,my cluster ca.crt is going to expire in 2days, how should I renew the ca.crt in running cluster.

[@otherwize12]

Does a pod or container on the worker node also recieve a certificate? How can the communication with the applications in them or the pods/containers themselves take place in a secure manner?

[@SridCloud]

This is a good question, this video is to discuss how components of the kubernetes communicate with each other. What you are asking is at the application level, your application needs to manage its own certificate on client and server sides. I will do some research and post a video on this interesting topic!

[@filipstojiljkovic4711]

You didn't really explain, are you on filesystem of master node or ?

[@YouTubers-rj9xv]

Bro super teaching

[@SridCloud]

Thank you so much 🙂

[@viswaviswa8616]

Hi can you please help me where I can find ca.key inside the eks cluster 1.26

[@vamshikrishna5521]

Hello, we have a single box K8S cluster and i see cert is expired as i am getting 509x error while get pods. So how do i renew them, also as i am unable to connect to cluster or get pots etc..... do i need to take backup of pods or any config ? if yes how to see them and what configs should i take backup. i know bit of k8s but the team who managed this cluster, are not supporting anymore. could me help me in this regard's - suggesting any links

[@SridCloud]

Hi Vamshi, thanks for watching this video! Refer to kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ to answers to your question. It has steps on how to do certificate renewal.

[@SuperKrishnavamsi]

Hi I want to replace my ca.crt and I don't have .key file for it as it a corporate certificate how can I create other certs using this cert and i have already deployed cluster with default certs which are created when we ran kubeadm init

[@SridCloud]

Hi Super! Thanks for visiting.. I think you can creaet and place the certs on an existing kube environment.

[@vkgiddu]

Put lot of effort, with out any context of linking between various certificates. If kubectl certificate and api-server are two completely different certificates, how do both know each other is the key and missing price. Waste of time of everyone.

[@SridCloud]

Can you explain more!?

[@fanily4072]

Nice Video. I realized just how insecure Kubernetes is because the ca.key is stored in plain text in /etc/kubernetes/pki. That is the private key of the root CA for every other service. Don't let that file get compromised!

[@SridCloud]

Agree!!

[@praveenmail2him]

Great video!!

[@SridCloud]

Glad you enjoyed it