When internal serving certificates expire (and are renewed), the new certificates are not picked up automatically by control plane components, resulting in an unstable control plane.

  All  

  Always

    1. Create a HostedCluster with annotations for a short certificate expiration time:
    
hypershift.openshift.io/certificate-validity: "1h"    
hypershift.openshift.io/certificate-renewal: "0.3"
    2. Wait for initial certificates to expire
    

    Cluster becomes degraded, apiservices in hosted cluster API become unavailable. To test this, obtain a kubeconfig for the hosted cluster and list apiservices:
$ oc get apiservices

API services that are external to the kube-apiserver appear as unavailable.

    Cluster continues to function as expected