Service CA certificates

service-ca is an Operator that creates a self-signed CA when an OKD cluster is deployed.

A custom expiration term is not supported. The self-signed CA is stored in the service-ca/signing-key secret. The certificate is in tls.crt, the private key is in tls.key, and the CA bundle is in ca-bundle.crt.

Other services can request a service serving certificate by annotating a service resource with service.beta.openshift.io/serving-cert-secret-name: <secret name>. In response, the Operator generates a new certificate as tls.crt, and a private key as tls.key, in the named secret. The certificate is valid for two years.

Other services can request that the CA bundle for the service CA be injected into API service or config map resources by annotating with service.beta.openshift.io/inject-cabundle: true to support validating certificates generated from the service CA. In response, the Operator writes the current CA bundle to the CABundle field of an API service or as service-ca.crt to a config map.

As of OKD 4.3.5, automated rotation is supported and is backported to some 4.2.z and 4.3.z releases. For any release supporting automated rotation, the service CA is valid for 26 months and is automatically refreshed when there is less than 13 months validity left. If necessary, you can manually refresh the service CA.

The 26-month service CA validity period is longer than the expected upgrade interval for a supported OKD cluster. Non-control plane consumers of service CA certificates are refreshed after CA rotation and before the expiration of the pre-rotation CA.

These certificates are managed by the system and not the user.

Services that use service CA certificates include:

This is not a comprehensive list.