Rotating the etcd certificate
You can manually rotate the etcd certificate before its automatic, scheduled rotation by backing up and deleting the current signer certificate.
Procedure
-
Make a backup copy of the current signer certificate by running the following command:
$ oc get secret -n openshift-etcd etcd-signer -oyaml > signer_backup_secret.yaml -
Delete the existing signer certificate by running the following command:
$ oc delete secret -n openshift-etcd etcd-signer
Verification
-
Wait for the static pod roll out by running the following command. The static pod roll out can take a few minutes to complete.
$ oc wait --for=condition=Progressing=False --timeout=15m clusteroperator/etcd