Implement certificate check with file-oriented view and usage types

[ErikJiang]

Proposed Changes

This PR implements a certificate check feature that:

• Adds USAGES field to distinguish between CertSign/ServerAuth/ClientAuth
• Changes CERTIFICATE column to FILENAME for clarity
• Supports multiple output formats (text, table, json, yaml)

Types of Changes

New Feature

Verification

# k3s certificate check -o table -s kubelet

FILENAME              SUBJECT                    USAGES       EXPIRES                  RESIDUAL TIME   STATUS
--------              -------                    ------       -------                  -------------   ------
client-kubelet.crt    system:node:ubuntu         ClientAuth   May 07, 2026 02:31 UTC   1 year          OK
client-kubelet.crt    k3s-client-ca@1746585073   CertSign     May 05, 2035 02:31 UTC   10 years        OK
serving-kubelet.crt   ubuntu                     ServerAuth   May 07, 2026 02:31 UTC   1 year          OK
serving-kubelet.crt   k3s-server-ca@1746585073   CertSign     May 05, 2035 02:31 UTC   10 years        OK

# k3s certificate check -o text -s api-server
INFO[0000] client-kube-apiserver.crt: certificate system:apiserver (ClientAuth) is ok, expires at 2026-05-07T02:31:13Z
INFO[0000] client-kube-apiserver.crt: certificate k3s-client-ca@1746585073 (CertSign) is ok, expires at 2035-05-05T02:31:13Z
INFO[0000] serving-kube-apiserver.crt: certificate kube-apiserver (ServerAuth) is ok, expires at 2026-05-07T02:31:13Z
INFO[0000] serving-kube-apiserver.crt: certificate k3s-server-ca@1746585073 (CertSign) is ok, expires at 2035-05-05T02:31:13Z

# k3s certificate check -o yaml -s admin
certificates:
- filename: client-admin.crt
  subject: system:admin
  issuer: k3s-client-ca@1746585073
  usages:
  - ClientAuth
  expirytime: 2026-05-07T02:31:13Z
  residualtime: 8732h19m4.95429994s
  status: OK
- filename: client-admin.crt
  subject: k3s-client-ca@1746585073
  issuer: k3s-client-ca@1746585073
  usages:
  - CertSign
  expirytime: 2035-05-05T02:31:13Z
  residualtime: 87572h19m4.95429994s
  status: OK

# k3s certificate check -o json -s kube-proxy | jq
{
  "Certificates": [
    {
      "Filename": "client-kube-proxy.crt",
      "Subject": "system:kube-proxy",
      "Issuer": "k3s-client-ca@1746585073",
      "Usages": [
        "ClientAuth"
      ],
      "ExpiryTime": "2026-05-07T02:31:15Z",
      "ResidualTime": 31436339036987915,
      "Status": "OK"
    },
    {
      "Filename": "client-kube-proxy.crt",
      "Subject": "k3s-client-ca@1746585073",
      "Issuer": "k3s-client-ca@1746585073",
      "Usages": [
        "CertSign"
      ],
      "ExpiryTime": "2035-05-05T02:31:13Z",
      "ResidualTime": 315260337036987915,
      "Status": "OK"
    }
  ]
}

Testing

Linked Issues

#12049

User-Facing Change

Implement certificate check with file-oriented view and usage types

Further Comments

[brandond]

The current certificate check table output mixes certificates with their CAs in a single list

The output is file-oriented. Each file contains both an end entity certificate (either a client/server cert or an intermediate cert) as well as the chain back to the root CA certificate. The root and intermediate CA certs expire, just as the EE certs do; it is possible for the copy of the root or intermediates to be different in different files, so the check output shows a full list of each certificate found in each file.

Reorganizing the output to group by certificate subject instead of simply listing each certificate in each file would not be something we want to do.

[ErikJiang]

😁 Hi @brandond, Based on the discussion, I've implemented a file-oriented certificate check with:

• "FILENAME" column header
• "USAGES" field to show CA/Server/Client types

Sample output:

FILENAME                          SUBJECT                            USAGES          EXPIRES                  RESIDUAL TIME   STATUS
--------                          -------                            ------          -------                  -------------   ------
client-auth-proxy.crt             system:auth-proxy                  Client          Apr 30, 2026 07:02 UTC   363d            OK
client-auth-proxy.crt             k3s-request-header-ca@1745996558   CA              Apr 28, 2035 07:02 UTC   9y              OK
client-k3s-cloud-controller.crt   k3s-cloud-controller-manager       Client          Apr 30, 2026 07:02 UTC   363d            OK
client-k3s-cloud-controller.crt   k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client.crt                        etcd-client                        Client          Apr 30, 2026 07:02 UTC   363d            OK
client.crt                        etcd-server-ca@1745996558          CA              Apr 28, 2035 07:02 UTC   9y              OK
server-client.crt                 etcd-server                        Server,Client   Apr 30, 2026 07:02 UTC   363d            OK
server-client.crt                 etcd-server-ca@1745996558          CA              Apr 28, 2035 07:02 UTC   9y              OK
peer-server-client.crt            etcd-peer                          Server,Client   Apr 30, 2026 07:02 UTC   363d            OK
peer-server-client.crt            etcd-peer-ca@1745996558            CA              Apr 28, 2035 07:02 UTC   9y              OK
client-kube-proxy.crt             system:kube-proxy                  Client          Apr 30, 2026 07:02 UTC   363d            OK
client-kube-proxy.crt             k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-k3s-controller.crt         system:k3s-controller              Client          Apr 30, 2026 07:02 UTC   363d            OK
client-k3s-controller.crt         k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-admin.crt                  system:admin                       Client          Apr 30, 2026 07:02 UTC   363d            OK
client-admin.crt                  k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-controller.crt             system:kube-controller-manager     Client          Apr 30, 2026 07:02 UTC   363d            OK
client-controller.crt             k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-scheduler.crt              system:kube-scheduler              Client          Apr 30, 2026 07:02 UTC   363d            OK
client-scheduler.crt              k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-supervisor.crt             system:k3s-supervisor              Client          Apr 30, 2026 07:02 UTC   363d            OK
client-supervisor.crt             k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-kubelet.crt                system:node:ubuntu                 Client          Apr 30, 2026 07:02 UTC   363d            OK
client-kubelet.crt                k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
serving-kubelet.crt               ubuntu                             Server          Apr 30, 2026 07:02 UTC   363d            OK
serving-kubelet.crt               k3s-server-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
client-kube-apiserver.crt         system:apiserver                   Client          Apr 30, 2026 07:02 UTC   363d            OK
client-kube-apiserver.crt         k3s-client-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK
serving-kube-apiserver.crt        kube-apiserver                     Server          Apr 30, 2026 07:02 UTC   363d            OK
serving-kube-apiserver.crt        k3s-server-ca@1745996558           CA              Apr 28, 2035 07:02 UTC   9y              OK

Does this meet expectations? 🤝

[brandond]

Thanks, that looks good to me!

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 118 lines in your changes missing coverage. Please review.

Project coverage is 19.78%. Comparing base (0b48e36) to head (b70d7d7).
Report is 7 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/cli/cert/cert.go	0.00%	83 Missing ⚠️
pkg/util/cert.go	0.00%	24 Missing ⚠️
pkg/certmonitor/certmonitor.go	0.00%	10 Missing ⚠️
pkg/cli/cmds/certs.go	0.00%	1 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (0b48e36) and HEAD (b70d7d7). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (0b48e36)	HEAD (b70d7d7)
e2etests	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #12226       +/-   ##
===========================================
- Coverage   40.39%   19.78%   -20.62%     
===========================================
  Files         187      184        -3     
  Lines       19211    19196       -15     
===========================================
- Hits         7760     3797     -3963     
- Misses      10268    14969     +4701     
+ Partials     1183      430      -753     

Flag	Coverage Δ
e2etests	?
unittests	19.78% <0.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.