-
Story
-
Resolution: Done
-
Normal
-
None
-
None
-
None
-
Strategic Product Work
-
2
-
False
-
None
-
False
-
OCPSTRAT-1104 - [etcd] manual rotation of etcd signer certs when the cluster is still online
-
-
-
ETCD Sprint 248, ETCD Sprint 249
Refactoring in ETCD-512 creates a rotation due to incompatible certificate creation processes. We should update the render [1] the same way the controller manages the certificates. Keep in mind that important information are always stored in annotations, which means we also need to update the manifest template itself (just exchanging file bytes isn't enough).
AC:
- CEO should render the same certificates it would otherwise when the refactored CertSignerController runs
- test that a fresh installation avoids re-creating certificates after the bootstrap phase
[1] https://github.com/openshift/cluster-etcd-operator/blob/master/pkg/cmd/render/render.go#L347-L365