Update Kafka Certificates in Kubernetes secret

7 Update Kafka Certificates in Kubernetes secret

This section describes how to update the Kafka CA certificate, TLS certificate, or private key stored in Kubernetes Secrets during a maintenance window.

Update the Kafka certificate or key using the following commands:

Note:

In APM custom-values file (ocoso_csar_26_1_200_0_0_apm_custom_values.yaml), we assume that apmTLS.autoReloadTLS.enable is true, if this value is false, follow the section below and run rollout restart of APM deployment.
Updates to Kafka certificates happen only during the maintenance window.

Encode the new certificates ca.crt or tls.key or tls.crt with base64:


CACRT=$(base64 -w0 ca.crt)
CRT=$(base64 -w0 tls.crt)
KEY=$(base64 -w0 tls.key)

Update the contents using the Kubectl patch commands:


kubectl patch secret kafka-ca-secret -n <oso-namespace> -p "{\"data\":{\"ca.crt\":\"$CACRT\"}}"
kubectl patch secret my-tls-secret -n <oso-namespace> -p "{\"data\":{\"tls.crt\":\"$CRT\",\"tls.key\":\"$KEY\"}}"

Run the following command to perform a rolling restart of the APM deployment:
```
kubectl rollout restart deployment <apm-deployment-name>
```