k8s-config/docs/updating-ca.md

Updating CA

What is it?

My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.

The original one was built using cfssl. I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to renew the cert, I just built a new CA from scratch.

Here is how.

Make the CA

cd ~/Develop/jpace121-certificate-authority
j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca

Tell Nginx

scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem

Then restart nginx.

Tell Keycloak

base64 -w 0 ca/cert.pem

Copy to keycloak-config.yaml.

Deploy.

export KUBECONFIG=~/.kube/infra.yaml
kubectl apply -f keycloak-config.yaml
kubectl apply -f deployment.yaml
kubectl rollout restart deployment keycloak-deployment -n keycloak

Watch the logs:

kubectl logs -n keycloak deployment/keycloak-deployment keycloak