diff --git a/kubernetes/pki/generate.sh b/kubernetes/pki/generate.sh
new file mode 100755
index 0000000..7942c48
--- /dev/null
+++ b/kubernetes/pki/generate.sh
@@ -0,0 +1,272 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+MASTER_IP="${MASTER_IP:-192.168.122.10}"
+SERVICE_CIDR="${SERVICE_CIDR:-10.96.0.0/12}"
+CLUSTER_DOMAIN="${CLUSTER_DOMAIN:-cluster.local}"
+OUT_DIR="${OUT_DIR:-./pki/out}"
+
+SERVICE_IP=$(echo "$SERVICE_CIDR" | cut -d/ -f1 | sed 's/\.[0-9]*$/\.1/')
+DNS_IP=$(echo "$SERVICE_CIDR" | cut -d/ -f1 | sed 's/\.[0-9]*$/\.10/')
+
+mkdir -p "$OUT_DIR"
+
+# --- CA config (signing profiles) ---
+cat > "$OUT_DIR/ca-config.json" <<EOF
+{
+  "signing": {
+    "default": { "expiry": "87600h" },
+    "profiles": {
+      "kubernetes": {
+        "usages": [
+          "signing", "digital signature", "key encipherment",
+          "server auth", "client auth"
+        ],
+        "expiry": "87600h"
+      }
+    }
+  }
+}
+EOF
+
+# --- CA ---
+cat > "$OUT_DIR/ca-csr.json" <<EOF
+{
+  "CN": "kubernetes-ca",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{
+    "O": "Kubernetes",
+    "OU": "kubernetes-ca"
+  }]
+}
+EOF
+
+cfssl genkey -initca "$OUT_DIR/ca-csr.json" | cfssljson -bare "$OUT_DIR/ca"
+echo "CA generated"
+
+# --- Apiserver TLS ---
+cat > "$OUT_DIR/apiserver-csr.json" <<EOF
+{
+  "CN": "kube-apiserver",
+  "hosts": [
+    "kubernetes",
+    "kubernetes.default",
+    "kubernetes.default.svc",
+    "kubernetes.default.svc.${CLUSTER_DOMAIN}",
+    "${MASTER_IP}",
+    "${SERVICE_IP}",
+    "127.0.0.1",
+    "localhost"
+  ],
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "Kubernetes" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/apiserver-csr.json" | cfssljson -bare "$OUT_DIR/kube-apiserver"
+echo "Apiserver cert generated"
+
+# --- Service Account (SA token signing) ---
+cat > "$OUT_DIR/sa-csr.json" <<EOF
+{
+  "CN": "service-accounts",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "Kubernetes" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/sa-csr.json" | cfssljson -bare "$OUT_DIR/service-account"
+echo "Service account cert generated"
+
+# --- Apiserver -> etcd client ---
+cat > "$OUT_DIR/apiserver-etcd-client-csr.json" <<EOF
+{
+  "CN": "kube-apiserver-etcd-client",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:masters" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/apiserver-etcd-client-csr.json" | cfssljson -bare "$OUT_DIR/kube-apiserver-etcd-client"
+echo "Apiserver-etcd-client cert generated"
+
+# --- Apiserver -> kubelet client ---
+cat > "$OUT_DIR/apiserver-kubelet-client-csr.json" <<EOF
+{
+  "CN": "system:kube-apiserver",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:masters" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/apiserver-kubelet-client-csr.json" | cfssljson -bare "$OUT_DIR/kube-apiserver-kubelet-client"
+echo "Apiserver-kubelet-client cert generated"
+
+# --- Apiserver -> proxy client ---
+cat > "$OUT_DIR/apiserver-proxy-client-csr.json" <<EOF
+{
+  "CN": "front-proxy-client",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "Kubernetes" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/apiserver-proxy-client-csr.json" | cfssljson -bare "$OUT_DIR/kube-apiserver-proxy-client"
+echo "Apiserver-proxy-client cert generated"
+
+# --- Kubelet (per-node) ---
+generate_kubelet_certs() {
+  local node_hostname="$1"
+  local node_ip="$2"
+  local prefix="$OUT_DIR/kubelet-${node_hostname}"
+
+  cat > "${prefix}-csr.json" <<EOF
+{
+  "CN": "system:node:${node_hostname}",
+  "hosts": ["${node_ip}", "${node_hostname}"],
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:nodes" }]
+}
+EOF
+
+  cfssl gencert \
+    -ca "$OUT_DIR/ca.pem" \
+    -ca-key "$OUT_DIR/ca-key.pem" \
+    -config "$OUT_DIR/ca-config.json" \
+    -profile kubernetes \
+    "${prefix}-csr.json" | cfssljson -bare "$prefix"
+  echo "Kubelet cert generated for ${node_hostname}"
+}
+
+generate_kubelet_certs "k8s-master-0"  "192.168.122.10"
+generate_kubelet_certs "k8s-worker-0" "192.168.122.11"
+generate_kubelet_certs "k8s-worker-1" "192.168.122.12"
+generate_kubelet_certs "k8s-worker-2" "192.168.122.13"
+
+# --- Kube-proxy client ---
+cat > "$OUT_DIR/kube-proxy-client-csr.json" <<EOF
+{
+  "CN": "system:kube-proxy",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:proxies" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/kube-proxy-client-csr.json" | cfssljson -bare "$OUT_DIR/kube-proxy-client"
+echo "Kube-proxy client cert generated"
+
+# --- Controller manager client ---
+cat > "$OUT_DIR/cm-client-csr.json" <<EOF
+{
+  "CN": "system:kube-controller-manager",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:kube-controller-manager" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/cm-client-csr.json" | cfssljson -bare "$OUT_DIR/kube-controller-manager-client"
+echo "Controller manager client cert generated"
+
+# --- Scheduler client ---
+cat > "$OUT_DIR/scheduler-client-csr.json" <<EOF
+{
+  "CN": "system:kube-scheduler",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:kube-scheduler" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/scheduler-client-csr.json" | cfssljson -bare "$OUT_DIR/kube-scheduler-client"
+echo "Scheduler client cert generated"
+
+# --- Cluster admin ---
+cat > "$OUT_DIR/admin-csr.json" <<EOF
+{
+  "CN": "cluster-admin",
+  "key": { "algo": "rsa", "size": 2048 },
+  "names": [{ "O": "system:masters" }]
+}
+EOF
+
+cfssl gencert \
+  -ca "$OUT_DIR/ca.pem" \
+  -ca-key "$OUT_DIR/ca-key.pem" \
+  -config "$OUT_DIR/ca-config.json" \
+  -profile kubernetes \
+  "$OUT_DIR/admin-csr.json" | cfssljson -bare "$OUT_DIR/admin"
+echo "Cluster admin cert generated"
+
+# --- Print NixOS file mapping ---
+cat <<EOF
+
+=== NixOS file mapping ===
+
+All nodes need these files at /var/lib/kubernetes/secrets/:
+  ca.pem, ca-key.pem
+
+Master-only:
+  kube-apiserver.pem, kube-apiserver-key.pem
+  service-account.pem, service-account-key.pem
+  kube-apiserver-etcd-client.pem, kube-apiserver-etcd-client-key.pem
+  kube-apiserver-kubelet-client.pem, kube-apiserver-kubelet-client-key.pem
+  kube-apiserver-proxy-client.pem, kube-apiserver-proxy-client-key.pem
+  kube-controller-manager-client.pem, kube-controller-manager-client-key.pem
+  kube-scheduler-client.pem, kube-scheduler-client-key.pem
+
+Per-node (copy kubelet-<hostname>.pem -> kubelet.pem on that node):
+  kubelet-k8s-master-0.pem  -> master
+  kubelet-k8s-worker-0.pem  -> worker-0
+  kubelet-k8s-worker-1.pem  -> worker-1
+  kubelet-k8s-worker-2.pem  -> worker-2
+
+Workers also need:
+  kube-proxy-client.pem, kube-proxy-client-key.pem
+
+Cluster admin (on your workstation):
+  admin.pem, admin-key.pem, ca.pem
+
+EOF
+
+# Cleanup CSR/JSON files
+rm -f "$OUT_DIR"/*.csr "$OUT_DIR"/*-csr.json "$OUT_DIR"/ca-config.json
+echo "Done. Certs in: $OUT_DIR/"