# Certificate generation configuration
# The following certificates will be generated:
# - etcd certificates
# - Kubernetes cluster certificates (replacing the CA certificate generated by kubeadm, which is limited to a 10-year validity)
# - Image registry certificates (for Harbor and similar registries)

# Certificate chain structure:
# CA (self-signed or provided)
# |- etcd.cert
# |- etcd.key
# |
# |- image_registry.cert
# |- image_registry.key
# |
# |- kubernetes.cert
# |- kubernetes.key
# |     |- kubeadm uses this to generate server certificates (kube-apiserver certificate)
# |- front-proxy.cert
# |- front-proxy.key
# |
# |- image-registry.cert
# |- image-registry.key

certs:
  # CA certificate settings
  ca:
    # CA certificate expiration time
    date: 87600h
    # Certificate generation policy:
    # IfNotPresent: Validate the certificate if it exists; generate a self-signed certificate only if it does not exist
    gen_cert_policy: IfNotPresent
  kubernetes_ca:
    date: 87600h
    # How to generate the certificate file. Supported values: IfNotPresent, Always
    gen_cert_policy: IfNotPresent
  front_proxy_ca:
    date: 87600h
    # How to generate the certificate file. Supported values: IfNotPresent, Always
    gen_cert_policy: IfNotPresent
  # etcd certificate
  etcd:
    date: 87600h
    # How to generate the certificate file. Supported values: IfNotPresent, Always
    gen_cert_policy: IfNotPresent
  # image_registry certificate
  image_registry:
    date: 87600h
    # How to generate the certificate file. Supported values: IfNotPresent, Always
    gen_cert_policy: IfNotPresent