5.8. Configuring certificate rotation

Procedure

1. Open the HyperConverged CR by running the following command:

   $ oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv

2. Edit the spec.certConfig fields as shown in the following example. To avoid overloading the system, ensure that all values are greater than or equal to 10 minutes. Express all values as strings that comply with the golang ParseDuration format.

   apiVersion: hco.kubevirt.io/v1beta1
   kind: HyperConverged
   metadata:
     name: kubevirt-hyperconverged
     namespace: openshift-cnv
   spec:
     certConfig:
       ca:
         duration: 48h0m0s
         renewBefore: 24h0m0s
       server:
         duration: 24h0m0s
         renewBefore: 12h0m0s

   • The value of ca.renewBefore must be less than or equal to the value of ca.duration.
   • The value of server.duration must be less than or equal to the value of ca.duration.
   • The value of server.renewBefore must be less than or equal to the value of server.duration.

3. Apply updates to the HyperConverged CR by running the following command:

   $ oc apply -f <filename>.yaml

   For example:

   $ oc apply -f kubevirt-hyperconverged.yaml