unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

CA-rotation runbook for internal PKI rotation #326

New Issue
Closed
opened 2026-08-02 16:24:31 +10:00 by unkinben · 0 comments
unkinben commented 2026-08-02 16:24:31 +10:00
Owner
Copy Link
Copy Source

Problem
The re-keyed unkin.net intermediate this session broke CNPG->RGW backups (subPath mounts + operator-cached CA) and needed manual pod restarts; there is no documented rotation procedure. Reloader is deployed but ignores Secrets, so it cannot auto-restart on the vault-ca-cert Secret.

Proposal

  • add docs/ca-rotation.md: the workloads needing restart on CA change (subPath consumers: puppetserver, cephrgw-operator, vector-archiver; startup-cached: argocd-repo-server, artifactapi; CNPG needs kubectl cnpg restart), the verification (in-pod ca.crt sha256), and the fact that vault-ca-cert must carry the full current chain (RGW serves a bare leaf)
  • optional: decide whether to flip Reloader ignoreSecrets and annotate the plain-Deployment consumers

Acceptance

  • a documented, tested rotation runbook so the next intermediate re-key is a checklist, not an incident.
**Problem** The re-keyed unkin.net intermediate this session broke CNPG->RGW backups (subPath mounts + operator-cached CA) and needed manual pod restarts; there is no documented rotation procedure. Reloader is deployed but ignores Secrets, so it cannot auto-restart on the vault-ca-cert Secret. **Proposal** - add docs/ca-rotation.md: the workloads needing restart on CA change (subPath consumers: puppetserver, cephrgw-operator, vector-archiver; startup-cached: argocd-repo-server, artifactapi; CNPG needs `kubectl cnpg restart`), the verification (in-pod ca.crt sha256), and the fact that vault-ca-cert must carry the full current chain (RGW serves a bare leaf) - optional: decide whether to flip Reloader ignoreSecrets and annotate the plain-Deployment consumers **Acceptance** - a documented, tested rotation runbook so the next intermediate re-key is a checklist, not an incident.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#326
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?