beta API version · group certificates.k8s.io

certificates.k8s.io/v1beta1

Partly removed

Kinds in certificates.k8s.io/v1beta1

Kind	Introduced	Deprecated	Stops being served	Use instead
CertificateSigningRequest	1.12	1.19	1.22	certificates.k8s.io/v1
ClusterTrustBundle beta · off by default	1.33	1.37	1.40 (planned)	certificates.k8s.io/v1
PodCertificateRequest beta · off by default	1.35	1.37	1.40 (planned)	certificates.k8s.io/v1

Served in which releases

Kind162025303537

CertificateSigningRequest

ClusterTrustBundle

PodCertificateRequest

served served, deprecated exists but off by default not served · 1.16 to 1.37

Migrating off certificates.k8s.io/v1beta1

CertificateSigningRequest removed in 1.22

Move to certificates.k8s.io/v1, served since 1.19. Existing objects stay readable through the new version.

What changes:

For API clients requesting certificates:
spec.signerName is now required (see known Kubernetes signers), and requests for kubernetes.io/legacy-unknown are not allowed to be created via the certificates.k8s.io/v1 API
spec.usages is now required, may not contain duplicate values, and must only contain known usages
For API clients approving or signing certificates:
status.conditions may not contain duplicate types
status.conditions[*].status is now required
status.certificate must be PEM-encoded, and contain only CERTIFICATE blocks

- apiVersion: certificates.k8s.io/v1beta1
+ apiVersion: certificates.k8s.io/v1
  kind: CertificateSigningRequest

To convert files mechanically: kubectl convert -f old.yaml --output-version certificates.k8s.io/v1 (the kubectl-convert plugin, installed separately). Review defaults it fills in.

Other versions of certificates.k8s.io

certificates.k8s.io/v1 Stable

Check your manifests for certificates.k8s.io/v1beta1 and other removed versions →