Certificate Renewal

[bj9306]

Team,
i am trying to renew cluster and client certificate in my cluster using instructions documented here.

https://strimzi.io/docs/operators/latest/using.html#proc-renewing-ca-certs-manually-str

i see total 5 secrets in cluster, so how do we renew ca.crt in last 3 certs in below list? do we need to manually copy from cluster-ca-cert?

watchtower-clients-ca-cert Opaque 4 199d
watchtower-cluster-ca-cert Opaque 2 217d
watchtower-cluster-operator-certs Opaque 4 216d
watchtower-entity-operator-certs Opaque 4 216d
watchtower-kafka-exporter-certs Opaque 4 216d

[scholzj]

Assuming you use the Strimzi CAs for which this documentation applies you don't, Strimzi should do it for you when processing the annotation.

[bj9306]

so i need to annotate first 2 certficate and rest 3 will be taken care by Strimzii. is that right understanding?

[scholzj]

If you want to renew both CAs, then yes. You annotate the first 2 secrets and leave the rest on Strimzi.

[bj9306]

Sorry have one more question. do i have to annotate secrets containing private keys also?

watchtower-clients-ca
watchtower-cluster-ca

[scholzj]

Not if all you want to renew the public key. Just follow the docs.

[bj9306]

Thanks a lot.