X.509 certificates are essential for verifying identities and encrypting communication within CCE clusters. These certificates enable authorized clients to access target clusters while encrypting data transmission between them. This prevents threats like eavesdropping and tampering, ensuring secure communication, authenticated identities, and valid access. To initiate a connection using X.509 certificates, obtain the cluster certificate from the CCE console and use it to configure the client accordingly.
Procedure
Log in to the CCE console and click the cluster name to access the cluster console.
On the Overview page, locate the Connection Information area, and click Download next to X.509 certificate.
In the Obtain Certificate dialog box, select the certificate validity period and download the X.509 certificate of the cluster as prompted.
Notice
The downloaded certificate contains three files: client.key, client.crt, and ca.crt. Keep these files secure.
Certificates are not required for mutual access between containers in a cluster.
An issued X.509 certificate remains valid even if the user who requested it is deleted. To ensure cluster security, manually revoke the user's cluster access credentials. For details, see Revoking a Cluster Access Credential.
Import the X.509 certificate to the client and use the certificate to call Kubernetes native APIs.
For example, run the curl command to call an API to obtain the pod information. The following is an example: