
Generates all PKI assets necessary to establish the control plane

### Synopsis


Generates a self-signed CA to provision identities for each component in the cluster (including nodes) and client certificates to be used by various components. 

If a given certificate and private key pair both exist, kubeadm skips the generation step and
existing files will be used. 

Alpha Disclaimer: this command is currently alpha.

```
kubeadm alpha phase certs all [flags]
```

### Examples

```
  # Creates all PKI assets necessary to establish the control plane,
  # functionally equivalent to what generated by kubeadm init.
  kubeadm alpha phase certs all
  
  # Creates all PKI assets using options read from a configuration file.
  kubeadm alpha phase certs all --config masterconfiguration.yaml
```

### Options

<table style="width: 100%;">
  <colgroup>
    <col span="1" style="width: 10px;" />
    <col span="1" />
  </colgroup>
  <tbody>

    <tr>
      <td colspan="2">--apiserver-advertise-address string</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">The IP address the API server is accessible on, to use for the API server serving cert</td>
    </tr>

    <tr>
      <td colspan="2">--apiserver-cert-extra-sans stringSlice</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">Optional extra altnames to use for the API server serving cert. Can be both IP addresses and dns names</td>
    </tr>

    <tr>
      <td colspan="2">--cert-dir string&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Default: "/etc/kubernetes/pki"</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">The path where to save the certificates</td>
    </tr>

    <tr>
      <td colspan="2">--config string</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">Path to kubeadm config file (WARNING: Usage of a configuration file is experimental)</td>
    </tr>

    <tr>
      <td colspan="2">-h, --help</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">help for all</td>
    </tr>

    <tr>
      <td colspan="2">--service-cidr string&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Default: "10.96.0.0/12"</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">Alternative range of IP address for service VIPs, from which derives the internal API server VIP that will be added to the API Server serving cert</td>
    </tr>

    <tr>
      <td colspan="2">--service-dns-domain string&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Default: "cluster.local"</td>
    </tr>
    <tr>
      <td></td><td style="line-height: 130%">Alternative domain for services, to use for the API server serving cert</td>
    </tr>

  </tbody>
</table>



