Help Center/ Cloud Container Engine/ User Guide/ Clusters/ Accessing a Cluster/ Accessing a Cluster Using an X.509 Certificate
Updated on 2025-08-19 GMT+08:00
View PDF
Share

Accessing a Cluster Using an X.509 Certificate

X.509 certificates are essential for verifying identities and encrypting communication within CCE clusters. These certificates enable authorized clients to access target clusters while encrypting data transmission between them. This prevents threats like eavesdropping and tampering, ensuring secure communication, authenticated identities, and valid access. To initiate a connection using X.509 certificates, obtain the cluster certificate from the CCE console and use it to configure the client accordingly.

Procedure

  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. On the Overview page, locate the Connection Information area, and click Download next to X.509 certificate.

    Figure 1 Downloading a cluster certificate

  3. In the Obtain Certificate dialog box displayed, select the certificate expiration time and download the X.509 certificate of the cluster as prompted.

    • The downloaded certificate contains three files: client.key, client.crt, and ca.crt. Keep these files secure.
    • Certificates are not required for mutual access between containers in a cluster.
    • An issued X.509 certificate remains valid even if the user who requested it is deleted. To ensure cluster security, manually revoke the user's cluster access credentials. For details, see Revoking a Cluster Access Credential.

  4. Import the X.509 certificate to the client and use the certificate to call Kubernetes native APIs.

    For example, run the curl command to call an API to obtain the pod information. The following is an example:

    curl --cacert ./ca.crt --cert ./client.crt --key ./client.key  https://192.168.0.18:5443/api/v1/namespaces/default/pods/
    • ./ca.crt, ./client.crt, and ./client.key are the paths for uploading the client.key, client.crt, and ca.crt files, respectively.
    • 192.168.0.18:5443 is the private or public network address of the API server in the cluster.

    If the following information is displayed, the X.509 certificate is correctly configured and the API Server of the cluster is running properly:

    {
  "kind": "PodList",
  "apiVersion": "v1",
...

    For more cluster APIs, see Kubernetes API.

Helpful Links

For details about how to manually revoke a cluster access credential, see Revoking a Cluster Access Credential.

Parent Topic: Accessing a Cluster