lab-certs

Overview ¶

Command lab-certs issues the mutation-capture lab's certificates before its cluster exists: one CA, a serving certificate for the lab's Service, and a client certificate for the API server, which it writes into the audit webhook kubeconfig the cluster is created with. The API server reads that kubeconfig only at startup, so issuing first is what lets the lab cluster come up complete, without the node restart the e2e cluster needs.

It is idempotent: when every output exists it leaves them alone, because the running cluster already trusts the CA they were issued from.