Azure Operator Nexus PKI implementation

Azure Operator Nexus deploys an in-cluster public key infrastructure (PKI) on every cluster. Each cluster maintains a self-signed certificate authority (CA) hierarchy that never leaves the site, ensuring that cryptographic trust is isolated per deployment. This isolation minimizes the impact of any compromise.

PKI architecture overview

• Per-cluster trust boundary: Each Azure Operator Nexus instance provisions an independent root CA. There's no shared CA across clusters, and certificates are never reused between sites.
• Self-contained issuance: Certificate issuance and renewal are performed locally inside the Kubernetes control plane. Certificates aren't requested from external or centralized PKI services.
• Purpose-specific issuers: Dedicated intermediate issuers sign certificates for distinct workloads (human-operated consoles versus internal services) to minimize privilege scope.

This architecture allows customers to operate in disconnected or semi-connected environments while retaining the benefits of TLS authentication, encryption in transit, and cryptographic auditability.

Certificate management with cert-manager

Azure Operator Nexus relies on cert-manager to automate certificate lifecycles:

• Issuer objects are defined for each certificate purpose (interface access, internal services, and other specialized workloads).
• Certificate resources request leaf certificates from the appropriate issuer, including Subject Alternative Names (SANs) required by platform components.
• Renewal automation is driven by cert-manager, which renews leaf certificates before expiration and rotates them transparently across the platform.
• Secret distribution to pods and services is handled through Kubernetes secrets and projected volumes, ensuring workloads always present valid certificates.

Certificate rotation and lifetime

• Automatic rotation: cert-manager renews certificates before they expire based on the Certificate resource settings (such as duration and renewBefore).
• Default certificate lifetime: Most Azure Operator Nexus leaf TLS certificates are issued for 70 days.
• Exceptions: Some components use different lifetimes.
  • Etcd snapshotter: Issues server and client certificates with a 1-year lifetime.
  • Token service: Issues its CA and server certificates with a 3-year lifetime.
• Renewal window: Certificates are typically renewed about 23 days before expiration.

Because all issuance is in-cluster, operators retain full control over the trust fabric without depending on external connectivity or services.

Issuer hierarchy

Two primary issuers are deployed per cluster to align with the different trust requirements of human-operated interfaces and service workloads.

Interface issuer

• Purpose: Signs TLS certificates used by resource interfaces, including bare metal machine BMC/iDRAC and storage appliance management endpoints.
• Scope: Only certificates for management endpoints.
• Rotation: cert-manager renews interface certificates before expiration. These certificates are typically issued for 70 days and renewed before expiry.

Infra issuer

• Purpose: Issues certificates for platform microservices and service-to-service APIs.
• Scope: Internal webhook services and other platform workloads.
• Rotation: Certificates are automatically rotated. These certificates are typically issued for 70 days and renewed before expiry.

Certificate usage scenarios

Viewing CA certificates and hashes

Operators often need to verify that TLS endpoints present the expected CA certificate and fingerprint. Azure Operator Nexus exposes this information through both the Azure portal and Azure CLI.

Bare metal machine resources

1. Azure portal:

   1. Navigate to Azure Operator Nexus > Bare metal machines.
   2. Open the target bare metal machine resource.
   3. Select JSON View.
   4. Select 2025-09-01 or later API version.
   5. Review the CA certificate value and the SHA-256 hash of the issuer that signed the active TLS certificate.

2. Azure CLI:

   az networkcloud baremetalmachine show \
     --subscription <subscription>
     --resource-group <cluster-managed-resource-group> \
     --name <bareMetalMachineName> \
     --query "caCertificate" \
     --output tsv
   

   This command returns the PEM-encoded CA certificate that issued the current TLS certificate and its SHA-256 hash (fingerprint) for quick comparison against trusted values.

Storage appliance resources

1. Azure portal:

   1. Navigate to Azure Operator Nexus > Storage appliances.
   2. Open the target storage appliance resource.
   3. Select JSON View.
   4. Select 2025-09-01 or later API version.
   5. Review the CA certificate value and the SHA-256 hash of the issuer that signed the active TLS certificate.

2. Azure CLI:

   az networkcloud storageappliance show \
     --subscription <subscription>
     --resource-group <cluster-managed-resource-group> \
     --name <storageApplianceName> \
     --query "caCertificate" \
     --output tsv
   

Related content

PKI is one component of Azure Operator Nexus security. The PKI system works with these credential rotation mechanisms to provide comprehensive authentication and encryption across the platform.

• Azure Operator Nexus security
• Access and identity management
• Baseboard Management Controller credential rotation
• Network Fabric password rotation
• Credential rotation management