> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shiftlabs.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificates

> Monitor and renew Kubernetes cluster SSL/TLS certificates

Kubernetes certificates secure communication between cluster components. Monitor expiration dates and renew certificates before they expire to prevent service disruptions.

## Key Concepts

<CardGroup cols={2}>
  <Card title="Certificate" icon="certificate">
    SSL/TLS certificate used by Kubernetes components for secure communication.
  </Card>

  <Card title="Certificate Authority" icon="shield">
    The CA that signs cluster certificates (ca, etcd-ca, front-proxy-ca).
  </Card>

  <Card title="Renewal" icon="rotate">
    Process of regenerating certificates before expiration.
  </Card>

  <Card title="Expiry" icon="clock">
    Default Kubernetes certificates expire after 1 year.
  </Card>
</CardGroup>

## Required Permissions

| Action             | Permission                                    |
| ------------------ | --------------------------------------------- |
| View certificates  | `iam:project:infrastructure:kubernetes:read`  |
| Renew certificates | `iam:project:infrastructure:kubernetes:write` |

## Certificate Status Levels

| Status            | Threshold | Action Required                          |
| ----------------- | --------- | ---------------------------------------- |
| **Valid**         | > 30 days | Monitor regularly                        |
| **Expiring Soon** | 8-30 days | Plan renewal                             |
| **Critical**      | 1-7 days  | Renew immediately                        |
| **Expired**       | \< 0 days | Renew urgently - cluster may be impacted |

## How to Check Certificate Status

<Steps>
  <Step title="Select Cluster">
    Choose a cluster from the dropdown.
  </Step>

  <Step title="View Status">
    The certificate status page shows overall health and individual certificate details.
  </Step>

  <Step title="Review Expiring Certificates">
    Focus on certificates in Critical or Expiring Soon status.
  </Step>
</Steps>

## How to Renew Certificates

<Steps>
  <Step title="Select Cluster">
    Choose the cluster with expiring certificates.
  </Step>

  <Step title="Click Renew All">
    Click **Renew All** to regenerate all cluster certificates.
  </Step>

  <Step title="Confirm">
    Confirm the renewal operation.
  </Step>

  <Step title="Monitor">
    Wait for the operation to complete. Components will restart with new certificates.
  </Step>
</Steps>

<Warning>
  Certificate renewal may cause brief disruption while components restart. Plan renewals during maintenance windows for production clusters.
</Warning>

## Common Kubernetes Certificates

| Certificate                | Purpose                             |
| -------------------------- | ----------------------------------- |
| `apiserver`                | Secures API server connections      |
| `apiserver-kubelet-client` | API server to kubelet communication |
| `apiserver-etcd-client`    | API server to etcd communication    |
| `etcd-server`              | etcd server certificate             |
| `etcd-peer`                | etcd cluster member communication   |
| `front-proxy-client`       | Front proxy client certificate      |
| `admin.conf`               | Admin kubeconfig certificate        |

## Troubleshooting

<AccordionGroup>
  <Accordion title="Certificate shows Expired status">
    * Run **Renew All** immediately
    * If cluster is inaccessible, manually renew via SSH on master nodes
    * Check kubelet and API server logs after renewal
  </Accordion>

  <Accordion title="Renewal operation fails">
    * Verify SSH connectivity to master nodes
    * Ensure kubeadm is available on nodes
    * Check sufficient disk space
    * Review operation logs for specific errors
  </Accordion>

  <Accordion title="Cluster issues after renewal">
    * Components may need time to restart
    * Verify API server is accessible
    * Check kubelet status on all nodes
    * Kubeconfig files may need updating
  </Accordion>

  <Accordion title="Cannot view certificate status">
    * Verify cluster is in Ready state
    * Check you have read permission
    * Ensure at least one master node is accessible
  </Accordion>
</AccordionGroup>

## FAQ

<AccordionGroup>
  <Accordion title="How often should I check certificates?">
    Check monthly. Set up monitoring to alert when certificates enter the 30-day warning threshold.
  </Accordion>

  <Accordion title="Can I renew individual certificates?">
    The platform renews all certificates together. Use kubeadm directly on nodes for individual certificate renewal.
  </Accordion>

  <Accordion title="How long are renewed certificates valid?">
    Renewed certificates are valid for 1 year from the renewal date.
  </Accordion>

  <Accordion title="Does renewal cause downtime?">
    Brief disruption is possible while components restart. High-availability clusters with multiple masters experience minimal impact.
  </Accordion>

  <Accordion title="What about CA certificates?">
    CA certificates have longer validity (typically 10 years). They are not renewed with regular certificate renewal and require special handling.
  </Accordion>
</AccordionGroup>