Rotate Certificate#

Workflows → RCRotate Certificates

To connect securely to the nodes, EDA installs a TLS certificate on each node during onboarding. Depending on the operating system, that certificate is installed through gNOI (gRPC Network Operations Interface) or gNSI (gRPC Network Security Interface). The certificate must be rotated periodically, for example when the signing CA used by EDA is rotated.

Periodic rotation of the TLS certificate is done automatically, without operator intervention. To rotate earlier, run the RotateCertificate workflow.

Certificate validation#

After rotation, the new certificate is validated against EDA's node trust bundle. This check can be disabled with skipCertificateValidation.

Dependencies#

TopoNode#

Nodes can be selected explicitly by name, or through a label selector.

Referenced resources#

The RotateCertificate does not reference any other EDA resources.

Examples#

apiVersion: bootstrap.eda.nokia.com/v1
kind: RotateCertificate
metadata:
  name: rotatecertificate-8e72bf0d-eac8-45ca-94c8-8c4066ce37f0
  namespace: eda
spec:
  nodeSelectors:
    - eda.nokia.com/role = leaf
    - eda.nokia.com/role = spine
  skipCertificateValidation: false

cat << 'EOF' | kubectl apply -f -
apiVersion: bootstrap.eda.nokia.com/v1
kind: RotateCertificate
metadata:
  name: rotatecertificate-8e72bf0d-eac8-45ca-94c8-8c4066ce37f0
  namespace: eda
spec:
  nodeSelectors:
    - eda.nokia.com/role = leaf
    - eda.nokia.com/role = spine
  skipCertificateValidation: false
EOF

Custom Resource Definition#

To browse the Custom Resource Definition go to crd.eda.dev.