How to Renew Envoy Pod TLS Certificates

One year after a Swimlane SPI installation, the envoy pod self-signed TLS certificate created during the installation will expire. A feature to auto-renew these certs at thirty days prior to expiration is available on Embedded SPI (10.5.0_295+) running ekco 0.16.0+.

To check the version of ekco, run:

kubectl get installers swimlane-platform -o jsonpath="{.spec.ekco.version}" && echo

For older versions, manually create a new envoy pod TLS certificate using the following instructions.

Step 1: Confirm the Envoy Pod TLS Certificate Expiration Date

Run this command to see the current envoy pod certificate expiration date:

for pod in $(kubectl get pods -n projectcontour -l app=envoy -o=name) do echo $pod echo =============== echo ca.crt: kubectl exec $pod -n projectcontour -c envoy -- openssl x509 -enddate -noout -in /certs/ca.crt echo tls.crt: kubectl exec $pod -n projectcontour -c envoy -- openssl x509 -enddate -noout -in /certs/tls.crt done

The output will look similar to:

pod/envoy-9rct8 =============== ca.crt: notAfter=Dec 10 20:58:33 2021 GMT tls.crt: notAfter=Dec 10 20:58:33 2021 GMT

Step 2: Renew the Envoy Pod TLS Certificate

(These instructions need only be performed once, regardless of the number of cluster nodes.)

# Delete the "envoycert" secret kubectl delete secret envoycert -n projectcontour # Delete the job kubectl delete jobs -n projectcontour contour-certgen-v1.7.0 # Download the attached "contour-certgen-v1.7.0.yaml" file and apply it to the cluster. kubectl apply -f contour-certgen-v1.7.0.yaml # Restart envoy kubectl rollout restart -n projectcontour daemonset/envoy kubectl rollout restart -n projectcontour deploy/contour

Step 3: Check Kubernetes certificates expiration dates and renew if necessary Follow the steps outlined in How to renew certificates on Kubernetes

contour-certgen-v1.7.0.yaml