29 lines
1.3 KiB
Plaintext
29 lines
1.3 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Rotate TLS Certificates for Consul on Kubernetes
|
|
description: >-
|
|
As of Consul Helm version 0.29.0, new server agent TLS certificates are issued every time the Helm version is upgraded. Learn how to trigger certificate rotation manually when it doesn't happen automatically.
|
|
---
|
|
|
|
# Rotate TLS Certificates for Consul on Kubernetes
|
|
|
|
As of Consul Helm version `0.29.0`, if TLS is enabled, new TLS certificates for the Consul Server
|
|
are issued every time the Helm chart is upgraded. These certificates are signed by the same CA and will
|
|
continue to work as expected in the existing cluster.
|
|
|
|
Consul servers read the certificates from Kubernetes secrets during start-up and keep them in memory. In order to ensure the
|
|
servers use the newer certificate, the server pods need to be [restarted explicitly](/docs/k8s/upgrade#upgrading-consul-servers) in
|
|
a situation where `helm upgrade` does not restart the server pods.
|
|
|
|
To explicitly perform server certificate rotation, follow these steps:
|
|
|
|
1. Perform a `helm upgrade`:
|
|
|
|
```shell-session
|
|
$ helm upgrade consul hashicorp/consul --values /path/to/my/values.yaml
|
|
```
|
|
|
|
This should run the `tls-init` job that will generate new Server certificates.
|
|
|
|
1. Restart the Server pods following the steps [here](/docs/k8s/upgrade#upgrading-consul-servers).
|