Enter . This CLI tool is designed to simplify the generation, signing, and retrieval of X.509 certificates from a centralized VMware Certificate Authority (CA).
"common_name": "myapp.default.svc.cluster.local", "sans": [ "myapp.default.svc", "myapp.default.pod", "myapp-namespace.svc.cluster.local" ], "key_type": "rsa", "key_bits": 2048, "ttl": "168h" vmware vcert tool
# Script: renew.sh vcert renew --cert myapp.crt --key myapp.key --out-dir ./certs kubectl create secret tls myapp-tls --cert=./certs/myapp.crt --key=./certs/myapp.key --dry-run=client -o yaml | kubectl apply -f - Deploy as a Kubernetes CronJob (e.g., run every 5 days for a 7-day cert). In enterprise setups, the VMware CA can forward requests to a Venafi TPP server. vCert transparently supports this. Just set the appropriate policy name: In enterprise setups, the VMware CA can forward
kubectl create secret tls myapp-tls --cert=myapp.crt --key=myapp.key kubectl create configmap ca-bundle --from-file=ca.crt Mount in your deployment: In enterprise setups
# Linux example wget https://your-vcenter-or-pks-domain/api/cli/vcert-linux-amd64 chmod +x vcert-linux-amd64 sudo mv vcert-linux-amd64 /usr/local/bin/vcert Verify installation: