### Running One-Command Autocert Installation

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command executes a one-time Kubernetes job to install `autocert` automatically. It uses the `smallstep/autocert-init` image to perform the necessary setup within the cluster.

```bash
kubectl run autocert-init -it --rm --image smallstep/autocert-init --restart Never
```

--------------------------------

### Installing Smallstep Autocert via Helm (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

These commands install autocert using the Helm package manager. First, the Smallstep Helm chart repository is added, then the local Helm repositories are updated, and finally, autocert is installed from the smallstep chart.

```Bash
helm repo add smallstep https://smallstep.github.io/helm-charts/
helm repo update
helm install smallstep/autocert
```

--------------------------------

### Installing Smallstep Autocert via Kubectl (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command installs autocert using kubectl by running a one-off initialization container. It pulls the autocert-init image and executes it to set up the necessary components in the Kubernetes cluster.

```Bash
kubectl run autocert-init -it --rm --image cr.smallstep.com/smallstep/autocert-init --restart Never
```

--------------------------------

### Verifying Autocert Installation in Kubernetes (Shell)

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

These commands verify the successful installation of `autocert`. The first command checks if the `ca` and `controller` pods are running in the `step` namespace, while the second confirms that the `autocert-webhook-config` mutation webhook has been registered.

```Shell
kubectl -n step get pods
NAME                          READY   STATUS    RESTARTS   AGE
ca-7577d7d667-vtfq5           1/1     Running   0          1m
controller-86bd99bd96-s9zlc   1/1     Running   0          28s
kubectl get mutatingwebhookconfiguration
NAME                      CREATED AT
autocert-webhook-config   2019-01-17T22:57:57Z
```

--------------------------------

### Creating Kubernetes Namespace for Autocert

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command creates a new Kubernetes namespace named `step`. This namespace will house the `step` CA and the `autocert` controller, providing a dedicated environment for their deployment.

```bash
kubectl create namespace step
```

--------------------------------

### Verifying Kubernetes Prerequisites

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This snippet verifies that `kubectl` is installed and the Kubernetes cluster meets the minimum version requirement (1.9+) with admission webhooks enabled, which are necessary for `autocert` to function correctly.

```bash
kubectl version --short
Client Version: v1.13.1
Server Version: v1.10.11
kubectl api-versions | grep "admissionregistration.k8s.io/v1beta1"
admissionregistration.k8s.io/v1beta1
```

--------------------------------

### Deploying mTLS Client and Server with Kubernetes

Source: https://github.com/smallstep/autocert/blob/master/examples/hello-mtls/README.md

This command deploys the built mTLS server and client applications to a Kubernetes cluster. It applies the respective YAML configuration files, which define the necessary Kubernetes resources to run these services. This enables the deployment and orchestration of the mTLS examples within a Kubernetes environment.

```Shell
kubectl apply -f hello-mtls.server.yaml
kubectl apply -f hello-mtls.client.yaml
```

--------------------------------

### Installing Autocert Controller in Kubernetes (Shell)

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command installs the core `autocert` controller components into the Kubernetes cluster by applying the provided YAML manifest from the official GitHub repository. It sets up the necessary deployments and services for `autocert` to function.

```Shell
kubectl apply -f https://raw.githubusercontent.com/smallstep/autocert/master/install/02-autocert.yaml
```

--------------------------------

### Verifying Step CLI Version

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command checks the installed version of the `step` CLI tool. A minimum version of `0.18.2` is required for manual `autocert` installation.

```bash
step version
Smallstep CLI/0.18.2 (darwin/amd64)
Release Date: 2022-03-30 06:08 UTC
```

--------------------------------

### Initializing Step CA for Autocert

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command initializes a new `step` Certificate Authority with specific configurations for `autocert`. It sets the CA name, DNS names for the CA service, listening address, and defines an 'admin' provisioner. It also prompts for a password to encrypt key material.

```bash
step ca init \
    --name Autocert \
    --dns "ca.step.svc.cluster.local,127.0.0.1" \
    --address ":4443" \
    --provisioner admin \
    --with-ca-url "ca.step.svc.cluster.local"
```

--------------------------------

### Verifying Kubernetes and Admission Webhook Prerequisites (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This snippet demonstrates how to verify the kubectl client and server versions, and confirm that Kubernetes admission webhooks are enabled. It ensures the environment meets the basic requirements for autocert installation.

```Bash
$ kubectl version
Client Version: v1.26.1
Kustomize Version: v4.5.7
Server Version: v1.25.3
$ kubectl api-versions | grep "admissionregistration.k8s.io/v1"
admissionregistration.k8s.io/v1
```

--------------------------------

### Creating Kubernetes ConfigMaps for CA Artifacts

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

These commands create three Kubernetes ConfigMaps in the `step` namespace. They store the CA's configuration, certificates, and encrypted secrets (key material), making them accessible to the `step` CA pod.

```bash
kubectl -n step create configmap config --from-file $(step path)/config
kubectl -n step create configmap certs --from-file $(step path)/certs
kubectl -n step create configmap secrets --from-file $(step path)/secrets
```

--------------------------------

### Applying Step CA Kubernetes Manifest

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command applies the main Kubernetes manifest for the `step` CA from a remote URL. This manifest defines the necessary deployments, services, and other Kubernetes resources to run the `step` CA within the cluster.

```bash
kubectl apply -f https://raw.githubusercontent.com/smallstep/autocert/master/install/01-step-ca.yaml
```

--------------------------------

### Adding Autocert Provisioner to Step CA

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command adds a new provisioner named 'autocert' to the `step` CA. This provisioner will be used by the `autocert` controller to issue certificates. The command will prompt for a password for the 'autocert' provisioner.

```bash
step ca provisioner add autocert --create
```

--------------------------------

### Building Docker Images for mTLS Client and Server

Source: https://github.com/smallstep/autocert/blob/master/examples/hello-mtls/README.md

This command builds Docker images for both the mTLS server and client components. It leverages multi-stage Docker builds, allowing the creation of self-contained images without requiring local dependencies beyond Docker itself. The `-f` flag specifies the Dockerfile, and `-t` tags the resulting image for easy identification.

```Shell
docker build -f Dockerfile.server -t hello-mtls-server-<lang> .
docker build -f Dockerfile.client -t hello-mtls-client-<lang> .
```

--------------------------------

### Building Autocert Container Images - Shell

Source: https://github.com/smallstep/autocert/blob/master/README.md

These commands build the four core Docker container images for the Autocert project: `autocert-controller`, `autocert-bootstrapper`, `autocert-renewer`, and `autocert-init`. They utilize multi-stage builds and require Docker to be installed. Each command specifies the target image name, tag, and the path to its respective Dockerfile.

```Shell
docker build -t smallstep/autocert-controller:latest -f controller/Dockerfile .
docker build -t smallstep/autocert-bootstrapper:latest -f bootstrapper/Dockerfile .
docker build -t smallstep/autocert-renewer:latest -f renewer/Dockerfile .
docker build -t smallstep/autocert-init:latest -f init/Dockerfile .
```

--------------------------------

### Setting Temporary STEPPATH for CA Artifacts

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

These commands set the `STEPPATH` environment variable to a temporary directory, which will be used to stage CA artifacts generated by `step`. This directory can be safely deleted after the installation is complete.

```bash
export STEPPATH=$(mktemp -d /tmp/step.XXX)
step path
/tmp/step.0kE
```

--------------------------------

### Creating Kubernetes Secrets for CA Passwords

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

These commands create two generic Kubernetes secrets in the `step` namespace. These secrets store the passwords required to decrypt the CA's key material and the `autocert` provisioner's key, ensuring secure access.

```bash
kubectl -n step create secret generic ca-password --from-literal password=<ca-password>
kubectl -n step create secret generic autocert-password --from-literal password=<autocert-password>
```

--------------------------------

### Registering Autocert Mutation Webhook in Kubernetes (Shell/YAML)

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command registers the `autocert` mutation webhook with Kubernetes. It defines a `MutatingWebhookConfiguration` that intercepts pod creation requests, allowing `autocert` to inject bootstrap tokens. The `caBundle` is dynamically populated using `step path` to ensure secure communication.

```Shell
cat <<EOF | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: autocert-webhook-config
  labels: {app: autocert}
webhooks:
  - name: autocert.step.sm
    clientConfig:
      service:
        name: autocert
        namespace: step
        path: "/mutate"
      caBundle: $(cat $(step path)/certs/root_ca.crt | base64 | tr -d '\n')
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    failurePolicy: Ignore
    namespaceSelector:
      matchLabels:
        autocert.step.sm: enabled
EOF
```

--------------------------------

### Granting Cluster-Admin Rights on GKE

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command grants the current `gcloud` account cluster-admin permissions within a GKE cluster. This is often necessary because GKE cluster owners do not have these rights by default, but they are required for installing `autocert`'s RBAC rules.

```bash
kubectl create clusterrolebinding cluster-admin-binding \
    --clusterrole cluster-admin \
    --user $(gcloud config get-value account)
```

--------------------------------

### Configuring Autocert RBAC Permissions in Kubernetes (Shell)

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

This command applies the RBAC (Role-Based Access Control) configuration for `autocert`, granting it the necessary permissions to create and delete secrets within the Kubernetes cluster. This is crucial for `autocert`'s token management functionality.

```Shell
kubectl apply -f https://raw.githubusercontent.com/smallstep/autocert/master/install/03-rbac.yaml
```

--------------------------------

### Adjusting CA URL in Step Defaults (Older Versions)

Source: https://github.com/smallstep/autocert/blob/master/INSTALL.md

For older versions of the `step` CLI, this command modifies the `defaults.json` configuration file to remove the port from the CA URL, ensuring compatibility with `autocert`'s expected CA endpoint.

```bash
sed -i "" "s|ca.step.svc.cluster.local:4443|ca.step.svc.cluster.local|" $(step path)/config/defaults.json
```

--------------------------------

### Verifying Autocert Mounted Certificates (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

These bash commands retrieve the name of the deployed `hello-mtls` pod and then use `kubectl exec` to list the certificate files (`root.crt`, `site.crt`, `site.key`) mounted by `autocert` inside the container at `/var/run/autocert.step.sm`, confirming successful certificate provisioning.

```bash
$ export HELLO_MTLS=$(kubectl get pods -l app=hello-mtls -o jsonpath='{$.items[0].metadata.name}')
$ kubectl exec -it $HELLO_MTLS -c hello-mtls -- ls /var/run/autocert.step.sm
root.crt  site.crt  site.key
```

--------------------------------

### Enabling Autocert for a Kubernetes Namespace

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This command labels a Kubernetes namespace, enabling `autocert` for it. The label `autocert.step.sm=enabled` signals `autocert` to manage certificates within that namespace.

```bash
kubectl label namespace <namespace> autocert.step.sm=enabled
```

--------------------------------

### Exposing Deployment as Service (Kubectl)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command exposes the `hello-mtls` deployment as a Kubernetes Service, making it discoverable and accessible to other workloads within the cluster on port 443. This is a prerequisite for inter-service communication.

```bash
kubectl expose deployment hello-mtls --port 443
```

--------------------------------

### Deploying mTLS Client with Autocert Annotation (Bash/YAML)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This bash command uses a heredoc to apply a Kubernetes Deployment manifest for the `hello-mtls-client`. The manifest includes the `autocert.step.sm/name` annotation, which instructs Smallstep Autocert to provision a certificate for this pod. The `HELLO_MTLS_URL` environment variable specifies the target server's internal cluster URL for the mTLS connection.

```bash
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata: {name: hello-mtls-client, labels: {app: hello-mtls-client}}
spec:
  replicas: 1
  selector: {matchLabels: {app: hello-mtls-client}}
  template:
    metadata:
      annotations:
        # AUTOCERT ANNOTATION HERE -v ######################################
        autocert.step.sm/name: hello-mtls-client.default.pod.cluster.local #
        # AUTOCERT ANNOTATION HERE -^ ######################################
      labels: {app: hello-mtls-client}
    spec:
      containers:
      - name: hello-mtls-client
        image: smallstep/hello-mtls-client-curl:latest
        env: [{name: HELLO_MTLS_URL, value: https://hello-mtls.default.svc.cluster.local}]
EOF
```

--------------------------------

### Retrieving Client Pod Logs (Kubectl)

Source: https://github.com/smallstep/autocert/blob/master/README.md

These commands first retrieve the name of the `hello-mtls-client` pod and then display its logs. The logs are expected to show successful 'Hello' messages, indicating that the client is able to establish mTLS connections and communicate with the server.

```bash
export HELLO_MTLS_CLIENT=$(kubectl get pods -l app=hello-mtls-client -o jsonpath='{$.items[0].metadata.name}')
kubectl logs $HELLO_MTLS_CLIENT -c hello-mtls-client
```

--------------------------------

### Enabling Autocert for a Kubernetes Namespace (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command labels the default Kubernetes namespace with autocert.step.sm=enabled, which is required to activate autocert's certificate injection functionality for pods within that namespace.

```Bash
kubectl label namespace default autocert.step.sm=enabled
```

--------------------------------

### Checking Autocert Enabled Namespaces in Kubernetes (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command lists all Kubernetes namespaces and displays the value of the autocert.step.sm label, allowing users to quickly identify which namespaces have autocert enabled.

```Bash
$ kubectl get namespace -L autocert.step.sm
NAME          STATUS   AGE   AUTOCERT.STEP.SM
default       Active   59m   enabled
...
```

--------------------------------

### Checking Autocert Enabled Namespaces

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This command lists all Kubernetes namespaces and displays the value of the `autocert.step.sm` label, allowing users to identify which namespaces have `autocert` enabled.

```bash
kubectl get namespace -L autocert.step.sm
```

--------------------------------

### Obtaining Client Certificates with step CLI (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

These commands use the 'step' CLI to obtain the root certificate from the CA, generate a client key pair ('mike.key'), and request a client certificate ('mike.crt') for mutual TLS authentication. The process requires the CA URL, fingerprint, and an admin password.

```bash
export CA_POD=$(kubectl -n step get pods -l app=ca -o jsonpath='{$.items[0].metadata.name}')
step ca root root.crt --ca-url https://127.0.0.1:4443 --fingerprint <fingerprint>
step ca certificate mike mike.crt mike.key --ca-url https://127.0.0.1:4443 --root root.crt
```

--------------------------------

### Verifying Custom Autocert Certificate Properties (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

These bash commands first retrieve the pod name and then use `ls -ln` to verify the custom owner (999:999) and permissions (0600) of the certificate files. Subsequently, `step certificate inspect` is used to confirm the certificate's subject and its 1-hour validity duration, demonstrating the effect of the `autocert` annotations.

```bash
$ export HELLO_MTLS_1H=$(kubectl get pods -l app=hello-mtls-1h -o jsonpath='{$.items[0].metadata.name}')
$ kubectl exec -it $HELLO_MTLS_1H -c hello-mtls -- ls -ln /var/run/autocert.step.sm
-rw------- 1 999 999  623 Jun  6 21:17 root.crt
-rw------- 1 999 999 1470 Jun  6 21:37 site.crt
-rw------- 1 999 999  227 Jun  6 21:17 site.key
$ kubectl exec -it $HELLO_MTLS_1H -c hello-mtls -- cat /var/run/autocert.step.sm/site.crt | step certificate inspect --short -
X.509v3 TLS Certificate (ECDSA P-256) [Serial: 3182...1140]
  Subject:     hello-mtls-1h.default.svc.cluster.local
  Issuer:      Autocert Intermediate CA
  Provisioner: autocert [ID: A1lX...ty1Q]
  Valid from:  2020-04-30T01:58:17Z
          to:  2020-04-30T02:58:17Z
```

--------------------------------

### Cleaning Up Deployments and Services (Kubernetes)

Source: https://github.com/smallstep/autocert/blob/master/README.md

These commands are used to clean up the resources created during the tutorial. They delete the 'hello-mtls' and 'hello-mtls-client' deployments, along with their associated services, 'hello-mtls' and 'hello-mtls-lb', from the Kubernetes cluster.

```shell
kubectl delete deployment hello-mtls
kubectl delete deployment hello-mtls-client
kubectl delete service hello-mtls
kubectl delete service hello-mtls-lb
```

--------------------------------

### Deploying mTLS Server with Custom Autocert Duration, Owner, and Mode (YAML)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This YAML defines a Kubernetes Deployment that leverages `autocert` annotations for advanced certificate control. It sets a specific `duration` for the certificate (1 hour), defines the `owner` (UID:GID 999:999), and specifies file `mode` (0600) for the generated certificate, key, and root files.

```yaml
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata: {name: hello-mtls-1h, labels: {app: hello-mtls-1h}}
spec:
  replicas: 1
  selector: {matchLabels: {app: hello-mtls-1h}}
  template:
    metadata:
      annotations:
        autocert.step.sm/name: hello-mtls-1h.default.svc.cluster.local
        autocert.step.sm/duration: 1h
        autocert.step.sm/owner: "999:999"
        autocert.step.sm/mode: "0600"
      labels: {app: hello-mtls-1h}
    spec:
      containers:
      - name: hello-mtls
        image: smallstep/hello-mtls-server-go:latest
EOF
```

--------------------------------

### Connecting to mTLS Service with curl (Bash)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This sequence of commands first retrieves the LoadBalancer's IP address and then uses 'curl' to connect to the mTLS service. It provides the necessary root CA certificate, client certificate, and private key for mutual authentication, using '--resolve' to override DNS for local testing.

```bash
export HELLO_MTLS_IP=$(kubectl get svc hello-mtls-lb -ojsonpath={$.status.loadBalancer.ingress[0].ip})
curl --resolve hello-mtls.default.svc.cluster.local:443:$HELLO_MTLS_IP \
       --cacert root.crt \
       --cert mike.crt \
       --key mike.key \
       https://hello-mtls.default.svc.cluster.local
```

--------------------------------

### Deploying Basic mTLS Server with Autocert Name Annotation (YAML)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This YAML snippet defines a Kubernetes Deployment for a simple mTLS server. It uses the `autocert.step.sm/name` annotation to specify the X.509 common name and SAN for the certificate, which `autocert` will automatically provision and renew for the workload.

```yaml
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata: {name: hello-mtls, labels: {app: hello-mtls}}
spec:
  replicas: 1
  selector: {matchLabels: {app: hello-mtls}}
  template:
    metadata:
      annotations:
        # AUTOCERT ANNOTATION HERE -v ###############################
        autocert.step.sm/name: hello-mtls.default.svc.cluster.local #
        # AUTOCERT ANNOTATION HERE -^ ###############################
      labels: {app: hello-mtls}
    spec:
      containers:
      - name: hello-mtls
        image: smallstep/hello-mtls-server-go:latest
EOF
```

--------------------------------

### Forcing Autocert Bootstrapper Execution Order in Kubernetes

Source: https://github.com/smallstep/autocert/blob/master/README.md

This Kubernetes annotation forces the `autocert` bootstrapper init container to run before any other init containers in a pod. This is useful for deployments with long initialization times, ensuring the certificate is obtained early, providing a 24-hour valid certificate for subsequent initialization steps. It requires the `autocert` admission webhook to be active in the cluster.

```YAML
autocert.step.sm/init-first: "true"
```

--------------------------------

### Recomputing Root Certificate Fingerprint

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

These commands recompute the fingerprint of the root certificate. The first snippet identifies the CA pod and then executes the `step certificate fingerprint` command inside it. The second snippet demonstrates how to capture and trim the fingerprint into an environment variable.

```bash
export CA_POD=$(kubectl -n step get pods -l app=ca -o jsonpath={$.items[0].metadata.name})
kubectl -n step exec -it $CA_POD step certificate fingerprint /home/step/certs/root_ca.crt
```

```bash
export FINGERPRINT="$(kubectl -n step exec -it $CA_POD step certificate fingerprint /home/step/certs/root_ca.crt | tr -d '[:space:]')"
```

--------------------------------

### Exposing mTLS Service with LoadBalancer (Kubernetes)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command exposes the 'hello-mtls' deployment as a Kubernetes LoadBalancer service on port 443. This makes the mTLS-secured service accessible from outside the cluster, leveraging mTLS for secure access control.

```shell
kubectl expose deployment hello-mtls --name=hello-mtls-lb --port=443 --type=LoadBalancer
```

--------------------------------

### Executing Curl Inside Client Pod with mTLS (Kubectl)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command executes a `curl` request directly within the `hello-mtls-client` pod. It explicitly uses the mTLS certificates (`root.crt`, `site.crt`, `site.key`) provisioned by Autocert, verifying that the client can successfully establish a secure connection to the server using these certificates.

```bash
kubectl exec $HELLO_MTLS_CLIENT -c hello-mtls-client -- curl -sS \
       --cacert /var/run/autocert.step.sm/root.crt \
       --cert /var/run/autocert.step.sm/site.crt \
       --key /var/run/autocert.step.sm/site.key \
       https://hello-mtls.default.svc.cluster.local
```

--------------------------------

### Port-forwarding CA Service (Kubernetes)

Source: https://github.com/smallstep/autocert/blob/master/README.md

This command establishes a port-forward from the local machine's port 4443 to the 'step' CA pod's port 4443 within the 'step' namespace. This allows the local 'step' CLI to communicate with the CA for certificate operations.

```shell
kubectl -n step port-forward $(kubectl -n step get pods -l app=ca -o jsonpath={$.items[0].metadata.name}) 4443:4443
```

--------------------------------

### Inspecting a Certificate in Autocert

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This command allows inspection of a certificate located at `/var/run/autocert.step.sm/site.crt` within a specified pod's `autocert-renewer` container. It uses `step certificate inspect` to display certificate details.

```bash
kubectl exec -it <pod> -c autocert-renewer -- step certificate inspect /var/run/autocert.step.sm/site.crt
```

--------------------------------

### Uninstalling Smallstep Autocert from Kubernetes

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

These commands provide a comprehensive uninstallation procedure for `autocert`. The first block deletes core Kubernetes resources like the webhook configuration, namespace, and RBAC roles. The second block iterates through enabled namespaces to remove `autocert` labels and clean up remaining one-time token secrets.

```bash
kubectl delete mutatingwebhookconfiguration autocert-webhook-config
kubectl delete namespace step
kubectl delete clusterrolebinding autocert-controller
kubectl delete clusterrole autocert-controller
```

```bash
for ns in $(kubectl get namespace --selector autocert.step.sm=enabled -o jsonpath='{$.items[*].metadata.name}'); do
  kubectl label namespace "$ns" autocert.step.sm-
  kubectl -n "$ns" delete secrets --selector="autocert.step.sm/token=true"
done
```

--------------------------------

### Recovering Admin and CA Password in Kubernetes

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This command retrieves the `admin` and CA password from the `ca-password` Kubernetes secret within the `step` namespace. It uses `jsonpath` to extract the password data and then decodes it from base64.

```bash
kubectl -n step get secret ca-password -o jsonpath='{$.data.password}' | base64 -D
```

--------------------------------

### Recovering Autocert Password in Kubernetes

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This command retrieves the `autocert` password from the `autocert-password` Kubernetes secret within the `step` namespace. It uses `jsonpath` to extract the password data and then decodes it from base64.

```bash
kubectl -n step get secret autocert-password -o jsonpath='{$.data.password}' | base64 -D
```

--------------------------------

### Disabling Autocert for a Kubernetes Namespace

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This command removes the `autocert.step.sm` label from a specified Kubernetes namespace, effectively disabling `autocert`'s certificate management for that namespace.

```bash
kubectl label namespace <namespace> autocert.step.sm-
```

--------------------------------

### Cleaning Up Autocert One-Time Token Secrets

Source: https://github.com/smallstep/autocert/blob/master/RUNBOOK.md

This script iterates through all namespaces where `autocert` is enabled and deletes one-time token secrets. These secrets are identified by the selector `autocert.step.sm/token=true`.

```bash
for ns in $(kubectl get namespace --selector autocert.step.sm=enabled -o jsonpath='{$.items[*].metadata.name}'); do
  kubectl -n "$ns" delete secrets --selector="autocert.step.sm/token=true"
done
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.