Platform Component Certificate
The platform component certificate is used to verify the identity of components when they communicate with each other over the network on the platform. An expired certificate will cause the platform to become unavailable.
When the monitoring components have been deployed in the cluster and are running normally, you can view information about the platform component certificate on the Platform Certificate Management page.
Certificate Alert: An alert will be triggered when the certificate is about to expire or has expired, and the platform’s default notification policy (cpaas-admin-notification, manually created during platform deployment) will be used to send alert messages to notification objects. At the same time, you can view detailed alert information on the Operations Center > Firing page.
Before the soon-to-expire certificate is successfully updated, the soon-to-expire certificate alert policy will remain in the Firing state, so please update the certificate in a timely manner.
Common command to query the location of certificates: kubectl get secrets -n <namespace> <certificate name>; for a few certificates, the location or command to query the location may be different, please refer to the description of the Certificate Name for details.
cert-manager: Cert-manager is a Kubernetes addon plugin used to be compatible with different certificate issuers and automate the management and issuance of TLS certificates. Cert-manager ensures the validity of certificates and attempts to automatically rotate certificates before they expire.
Basic platform
| Component Name | Certificate Name | Issuance Method | Validity Period | Expiration Impact | Renewal Method upon Expiration |
|---|---|---|---|---|---|
| elasticsearch | elasticsearch-node0-cert | cert-manager issued | 10 years | Elasticsearch unavailable | cert-manager automatic renewal |
| dex | dex.tls | openssl issued or cert-manager issued | 10 years | Platform user authentication unavailable Global ingress unavailable |
Self-signed certificate automatically renewed by cert-manager Contact technical support for third-party certificate renewal |
| courier | courier-webhook-cert | cert-manager issued | 10 years | Notification function unavailable | cert-manager automatic renewal |
| warlock | warlock-serving-cert | cert-manager issued | 10 years | Alarm status and silence function unavailable | cert-manager automatic renewal |
| prometheus-operator | prometheus-operator-admission | cert-manager issued | 10 years | Unable to create alarms | cert-manager automatic renewal |
| cluster-transformer | cluster-transformer-cert | cert-manager issued | 10 years | Affecting cluster management function | cert-manager automatic renewal |
| auth-controller2 | auth-controller2-webhook-cert | cert-manager issuance | 10 years | Role-based authentication not available | cert-manager automatic renewal |
| TKE related components tke-platform-api tke-platform-controller |
tke-admin-cert tke-etcd-cert tke-server-cert |
cert-manager issuance | 10 years | Cluster management functions not available | cert-manager automatic renewal |
| Disaster recovery cluster related components | etcd-master-mirror-cert etcd-slave-mirror-cert |
kubectl generation | 10 years | Data synchronization of disaster recovery cluster not available | Not supported for update |
| base-operator | tls.crt Certificate location: “/opt/” path in the base-operator container |
Signing of startup script in image | 10 years | Affects platform upgrade | Restart base-operator Pod |
| sentry | tls.crt Certificate location: “/tmp/” path in the sentry container |
Signing of startup script in image | 10 years | Affects platform component deployment and update | Restart sentry Pod |
| apollo | apollo-serving-cert | cert-manager automatic renewal | 10 years | Affects access to advanced APIs for monitoring, users, and logs | cert-manager automatic renewal |
| sentry | cpaas-system | cert-manager automatic update | 10 years | Possible error when accessing the https port (11781) of the business cluster component | cert-manager automatic update |
Container Platform
| Component | Certificate Name | Issuance Method | Validity Period | Expiration Impact | Renewal Method |
|---|---|---|---|---|---|
| metis | metis-serving-cert | cert-manager issuance | 10 years | Container overselling, unavailable update time-related functions Unavailable operator image update function |
cert-manager automatic update |
| kubevirt | - kubevirt-ca - kubevirt-controller-certs - kubevirt-operator-certs - kubevirt-virt-api-certs - kubevirt-virt-handler-certs - kubevirt-virt-handler-server-certs |
cert-manager issuance implemented by kubevirt-operator | ca certificate: 7 days Certificates of various components (including kubevirt-virt-api-certs, virt-controller, virt-handler, virt-operator, virt-launcher) issued by ca: 1 day Tip: The duration of the certificate can be modified by modifying the spec.certificateRotateStrategy.selfSigned field defined in the kubevirt cr. As shown in the following figure: |
Some virtualization functions are unavailable | kubevirt periodic check, automatic update |
| cdi (kubevirt) | - cdi-apiserver-server-cert - cdi-apiserver-signer - cdi-uploadproxy-server-cert - cdi-uploadproxy-singer - cdi-uploadserver-client-cert - cdi-uploadserver-client-signer - cdi-uploadserver-signer |
Self-signed by CDI | cdi-apiserver: 30 days, automatically rotated at 15 days cdi-uploadproxy: 30 days, automatically rotated at 15 days cdi-uploadserver: 10 years, automatically rotated at 8 years Tip: The duration of cdi-apiserver and cdi-uploadproxy certificates can be modified by changing the spec.certConfig.ca.duration field defined in the CDI CR. See the following figure: |
Some virtualization features are unavailable | CDI periodically checks and updates automatically |
| olm | packageserver-service-cert | Self-signed by OLM | 760 days | OperatorHub page cannot be displayed | OLM controller periodically checks and updates automatically |
| kubevela | vela-core-root-cert vela-core-admission |
Issued by cert-manager | vela-core-root-cert: 5 years vela-core-admission: 1 year |
New application features are unavailable | cert-manager updates automatically |
DevOps
| Component Name | Certificate Name | Issuance Method | Validity Period | Expiration Impact | Renewal Method |
|---|---|---|---|---|---|
| devops-apiserver | devops-apiserver-cert | Issued by cert-manager | 10 years | DevOps functionality unavailable | Automatically renewed by cert-manager |
| etcd Certificate | etcd-ca | Generated during Kubernetes installation Generation command: kubectl create secret tls etcd-ca --cert=/etc/kubernetes/pki/etcd/ca.crt --key=/etc/kubernetes/pki/etcd/ca.key -n alauda-system |
10 years | DevOps functionality unavailable | Not supported for automatic renewal |
| devops-next | etcd-peer | Issued by cert-manager | 10 years | Pipeline event trigger functionality unavailable | Automatically renewed by cert-manager |
| devops-next | webhook-server-cert | Issued by cert-manager | 10 years | Pipeline event trigger functionality unavailable | Automatically renewed by cert-manager |
| Component Name | Certificate Name | Issuance Method | Validity Period | Impact of Expiration | Renewal Method |
| ———————– | ———————————— | —————— | ——————- | ————————————————— | ——————————————————- |
| katanomi | katanomi-webhook-server-cert | cert-manager issued | 10 years | Most DevOps functions such as continuous building and deployment are unavailable | cert-manager automatic renewal |
| asm-controller | asm-controller-webhook-serving-cert | cert-manager issued | 90 days | Webhook function is not normal | cert-manager automatic renewal | | global-asm-controller| global-asm-webhook | cert-manager issued | 90 days | Some service governance functions are unavailable | cert-manager automatic renewal | | istiod | cacerts | Automatically generated by code | 100 years | Istio service governance functions are unavailable | Delete cacerts and restart istiod. |
Data services
| Component Name | Certificate Name | Issuance Method | Validity Period | Expiration Impact | Renewal Method |
|---|---|---|---|---|---|
| rds | rds-operator-controller-manager-service-cert | olm generated | 2 years | rds functionality unavailable | olm controller periodically checks and automatically updates |
| Redis | instance name-tls |
cert-manager issued | 10 years | redis instance functionality unavailable | cert-manager automatically updates |
| RabbitMQ | instance name-tls |
cert-manager issued | 10 years | rabbitmq unable to use encrypted port, only non-encrypted port available | cert-manager automatically updates |
| Kafka | instance name-cluster-ca-cert |
operator issued | 10 years | kafka functionality unavailable | operator periodically checks and automatically updates certificate |