11.7. Ensuring seamless CA rotation

Ensuring seamless CA rotation is essential to avoid service downtime or to handle emergencies.

Prerequisites

You have cluster administrator permissions on OpenShift Container Platform, or you have cluster or dedicated administrator permissions on Red Hat OpenShift Service on AWS or OpenShift Dedicated.
You have installed the OpenShift Serverless Operator.
You have installed the cert-manager Operator for Red Hat OpenShift.
You have installed the OpenShift (oc) CLI.

Procedure

Create a CA certificate.
Add the public key of the new CA certificate to the CA trust bundles.
Ensure that you also keep the public key of the existing CA.
Ensure all clients use the latest CA trust bundles.
Knative Eventing components automatically reload the updated CA trust bundles. For custom workloads that consume trust bundles, reload or restart them as needed.
Update the knative-eventing-ca-issuer ClusterIssuer to reference the secret containing the CA certificate that you created in step 1.
Force cert-manager to renew certificates in the knative-eventing namespace.
For more information about cert-manager, see Reissuance triggered by user actions.
As soon as the CA rotation is fully completed, remove the public key of the old CA from the trust bundle config map.