OC-ADM-OCP-CERTIFICATES-REGENERATE-LEAF(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

💅 oc adm ocp-certificates regenerate-leaf — the glow-up page ✨

bestie, welcome to the oc adm ocp-certificates regenerate-leaf manual — it lives in the Openshift CLI User Manuals collection and honestly? It's giving "I'm about to refresh your whole cluster's certificates" energy. No cap. 🎀

✨ NAME ✨

oc adm ocp-certificates regenerate-leaf — regenerates the client and serving certificates of an OpenShift cluster. That's the whole vibe. 🦋

🌸 SYNOPSIS 🌸

oc adm ocp-certificates regenerate-leaf [OPTIONS]

💖 DESCRIPTION 💖

So what this does: it regenerates the leaf certificates that an OCP v4 cluster hands out. Leaf certs, not the whole dang tree. 🌈

Real talk though — this command does not wait for the cluster to acknowledge your changes. Some of those changes can take a very long time to roll out into the cluster, and each one has different operators and operands doing the work. Basically you're ordering the cert refresh and then dipping — the cluster does the rest on its own timeline, iykyk. 😭

⚠️ Experimental: this command is under active development and may change without notice. Iconic of it, but like… be aware. 💀

🎀 OPTIONS 🎀

  • --all=false — selects all resources in the namespace of the resource types you specified.
  • -A, --all-namespaces=false — if present, lists the requested object(s) across all namespaces. The namespace in your current context gets straight-up ignored, even if you specified it with --namespace. rude but okay ✨
  • --allow-missing-template-keys=true — when true, any errors in templates get ignored if a field or map key is missing from the template. Only applies to golang and jsonpath output formats. no stress 🫶
  • --dry-run=false — set it to true to use server-side dry run. practice round, no commitment 💅
  • --field-selector="" — the selector (field query) to filter on. Supports =, ==, and !=. Example heart: --field-selector key1=value1,key2=value2. heads up though — the server only supports a limited number of field queries per type. 👑
  • -f, --filename=[] — identifying the resource.
  • --local=false — if true, annotation will NOT contact api-server and runs locally instead. introvert mode 🧚
  • -o, --output="" — output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file). pick your fighter ⭐
  • -R, --recursive=true — processes the directory used in -f, --filename recursively. useful when you want to manage related manifests organized within the same directory. so organized of you 🍓
  • -l, --selector="" — selector (label query) to filter on. supports =, ==, and !=. e.g. -l key1=value1,key2=value2 💜
  • --show-managed-fields=false — if true, keeps the managedFields when printing objects in JSON or YAML format. 🔥
  • --template="" — template string or path to template file to use when -o=go-template or -o=go-template-file. The template format is golang templates [⟨http://golang.org/pkg/text/template/#pkg-overview⟩]. 🦋
  • --valid-before="" — only regenerates top level certificates valid before this date. Format: 2023-06-05T14:44:06Z. literally the "only the old ones" filter 🌸

🧚 OPTIONS INHERITED FROM PARENT COMMANDS 🧚

These came from the parent command and they're not optional extras, bestie — they're part of the package. 💖

  • --as="" — username to impersonate for the operation. User could be a regular user or a service account in a namespace. 👑
  • --as-group=[] — group to impersonate for the operation. this flag can be repeated to specify multiple groups. 🔥
  • --as-uid="" — UID to impersonate for the operation.
  • --as-user-extra=[] — user extras to impersonate for the operation. this flag can be repeated to specify multiple values for the same key. 😭
  • --cache-dir="/homeless-shelter/.kube/cache" — default cache directory.
  • --certificate-authority="" — path to a cert file for the certificate authority.
  • --client-certificate="" — path to a client certificate file for TLS.
  • --client-key="" — path to a client key file for TLS. 🔐
  • --cluster="" — the name of the kubeconfig cluster to use.
  • --context="" — the name of the kubeconfig context to use.
  • --disable-compression=false — if true, opts out of response compression for all requests to the server. 🫶
  • --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity. > ⚠️ this will make your HTTPS connections insecure — like, actually insecure, not cute-insecure. 💀
  • --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
  • --kuberc="" — path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off. 🎀
  • --match-server-version=false — require server version to match client version. matchy matchy ✨
  • -n, --namespace="" — if present, the namespace scope for this CLI request.
  • --profile="none" — name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex). 🍓
  • --profile-output="profile.pprof" — name of the file to write the profile to.
  • --request-timeout="0" — the length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. patience is a virtue ngl 🧘
  • -s, --server="" — the address and port of the Kubernetes API server.
  • --tls-server-name="" — server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used. 🌈
  • --token="" — bearer token for authentication to the API server.
  • --user="" — the name of the kubeconfig user to use.
  • --warnings-as-errors=false — treats warnings received from the server as errors and exits with a non-zero exit code. strict queen behavior 💅

🌟 EXAMPLE 🌟

okay so here's the whole thing in action — regenerating a leaf certificate that lives inside a particular secret:

# Regenerate a leaf certificate contained in a particular secret
oc adm ocp-certificates regenerate-leaf -n openshift-config-managed secret/kube-controller-manager-client-cert-key

ate. no notes. 🔥

💜 SEE ALSO 💜

(yes, that trailing comma is canon, don't come for me 😭)

💀 HISTORY 💀

June 2016 — Ported from the Kubernetes man-doc generator. vintage, honestly. a real elder of the manpage world 👑

kisses and cert refreshes 💋 — this page is brought to you by Openshift (the source) and Openshift CLI User Manuals (the vibe), dated June 2016. go forth and regenerate, bestie 🫶✨

📦 where this page comes from