Configuring certificate rotation

Configure certificate rotation parameters to replace existing certificates.

Configuring certificate rotation
Troubleshooting certificate rotation parameters

You can do this during OKD Virtualization installation in the web console or after installation in the HyperConverged custom resource (CR).

Procedure

Open the HyperConverged CR by running the following command:
```
$ oc edit hco -n openshift-cnv kubevirt-hyperconverged
```

Edit the spec.certConfig fields as shown in the following example. To avoid overloading the system, ensure that all values are greater than or equal to 10 minutes. Express all values as strings that comply with the golang ParseDuration format.

apiVersion: hco.kubevirt.io/v1beta1
kind: HyperConverged
metadata:
 name: kubevirt-hyperconverged
 namespace: openshift-cnv
spec:
  certConfig:
    ca:
      duration: 48h0m0s
      renewBefore: 24h0m0s (1)
    server:
      duration: 24h0m0s  (2)
      renewBefore: 12h0m0s  (3)

1	The value of `ca.renewBefore` must be less than or equal to the value of `ca.duration`.
2	The value of `server.duration` must be less than or equal to the value of `ca.duration`.
3	The value of `server.renewBefore` must be less than or equal to the value of `server.duration`.

Apply the YAML file to your cluster.

Troubleshooting certificate rotation parameters

Deleting one or more certConfig values causes them to revert to the default values, unless the default values conflict with one of the following conditions:

The value of ca.renewBefore must be less than or equal to the value of ca.duration.
The value of server.duration must be less than or equal to the value of ca.duration.
The value of server.renewBefore must be less than or equal to the value of server.duration.

If the default values conflict with these conditions, you will receive an error.

If you remove the server.duration value in the following example, the default value of 24h0m0s is greater than the value of ca.duration, conflicting with the specified conditions.

Example

certConfig:
   ca:
     duration: 4h0m0s
     renewBefore: 1h0m0s
   server:
     duration: 4h0m0s
     renewBefore: 4h0m0s

This results in the following error message:

error: hyperconvergeds.hco.kubevirt.io "kubevirt-hyperconverged" could not be patched: admission webhook "validate-hco.kubevirt.io" denied the request: spec.certConfig: ca.duration is smaller than server.duration

The error message only mentions the first conflict. Review all certConfig values before you proceed.