5.8.2. Troubleshooting certificate rotation parameters

Deleting one or more certConfig values in the HyperConverged custom resource (CR) causes the certConfig values to revert to the default values.

If the default values conflict with one of the following conditions, you receive an error message instead:

For example, if you remove the server.duration value, the default value of 24h0m0s is greater than the value of ca.duration, which conflicts with the specified conditions:

apiVersion: hco.kubevirt.io/v1beta1
kind: HyperConverged
metadata:
  name: kubevirt-hyperconverged
  namespace: openshift-cnv
spec:
  # ...
  certConfig:
    ca:
      duration: 4h0m0s
      renewBefore: 1h0m0s
    server:
      duration: 4h0m0s
      renewBefore: 4h0m0s
# ...

This results in the following error message:

error: hyperconvergeds.hco.kubevirt.io "kubevirt-hyperconverged" could not be patched: admission webhook "validate-hco.kubevirt.io" denied the request: spec.certConfig: ca.duration is smaller than server.duration

The error message only mentions the first conflict. Review all certConfig values before you proceed.