How to fix certificate not ready in Kubernetes

View all CSRs and their status:

kubectl get csr
kubectl describe csr <csr-name>

Look for status: Pending, Approved, or Failed condition.

If CSR is Pending, manually approve it:

kubectl certificate approve <csr-name>
kubectl get csr <csr-name> -o yaml | grep -A 2 conditions

After approval, the signer should issue the certificate.

After approval, verify certificate field has content:

kubectl get csr <csr-name> -o jsonpath='{.status.certificate}'

If empty, the signer failed to issue the certificate.

Check if kube-controller-manager is configured with CA:

kubectl get deployment -n kube-system kube-controller-manager -o yaml | grep -i "cluster-signing"

Look for --cluster-signing-cert-file and --cluster-signing-key-file arguments.

List signers and their approval/signing rules:

kubectl get csr -o jsonpath="{.items[*].spec.signerName}"

Common signers: kubernetes.io/kube-apiserver-client, kubernetes.io/kubelet-serving

Check logs for certificate signing errors:

kubectl logs -n kube-system -l component=kube-controller-manager | grep -i cert

Look for missing CA files or signing operation failures.

Ensure service account has permission to request certificates:

kubectl auth can-i create certificatesigningrequests --as=system:serviceaccount:kube-system:kubelet

Once approved and signed, extract certificate from CSR:

kubectl get csr <csr-name> -o jsonpath='{.status.certificate}' | base64 -d > cert.crt
kubectl get csr <csr-name> -o jsonpath='{.status.certificate}' | base64 -d | openssl x509 -text