Vmware Vcert Tool ((link)) Direct

vcert auth login --token $(kubectl get secret my-sa-token -o jsonpath='.data.token' | base64 --decode) Test connectivity:

kubectl create secret tls myapp-tls --cert=myapp.crt --key=myapp.key kubectl create configmap ca-bundle --from-file=ca.crt Mount in your deployment: vmware vcert tool

"common_name": "myapp.default.svc.cluster.local", "sans": [ "myapp.default.svc", "myapp.default.pod", "myapp-namespace.svc.cluster.local" ], "key_type": "rsa", "key_bits": 2048, "ttl": "168h" vcert auth login --token $(kubectl get secret my-sa-token

# Linux example wget https://your-vcenter-or-pks-domain/api/cli/vcert-linux-amd64 chmod +x vcert-linux-amd64 sudo mv vcert-linux-amd64 /usr/local/bin/vcert Verify installation: Just set the appropriate policy name: vcert health

# Script: renew.sh vcert renew --cert myapp.crt --key myapp.key --out-dir ./certs kubectl create secret tls myapp-tls --cert=./certs/myapp.crt --key=./certs/myapp.key --dry-run=client -o yaml | kubectl apply -f - Deploy as a Kubernetes CronJob (e.g., run every 5 days for a 7-day cert). In enterprise setups, the VMware CA can forward requests to a Venafi TPP server. vCert transparently supports this. Just set the appropriate policy name:

vcert health | Command | Purpose | |---------|---------| | vcert health | Verify CA server reachability | | vcert gen | Generate key and request certificate | | vcert renew | Renew an existing certificate | | vcert revoke | Revoke a certificate by serial/ID | | vcert list | List issued certificates (RBAC dependent) | | vcert download | Fetch a previously issued certificate | Detailed Example: Generating a TLS Certificate for a Web App Let's walk through generating a server certificate for a web application called myapp.default.svc.cluster.local . Step 1: Create a certificate request configuration Create request.json :

In the modern software-defined data center, certificates are the unsung heroes of security. They authenticate workloads, encrypt data in transit, and establish trust between microservices. However, managing the lifecycle of these certificates—especially in ephemeral Kubernetes or VM environments—is a notorious operational headache.