FLINK-28272.md

Prerequisites:

• Deploy Flink k8s operator
• Install cmctl

Double check that the appropriate certificate is created

$ kubectl get cert       
NAME                          READY   SECRET                AGE
flink-operator-serving-cert   True    webhook-server-cert   91m

Make sure certificate renew changes the certificate file in the webhook pod

Webhook pod console:

$ ls -la /certs/
total 4
drwxrwxrwt 3 root root  100 Sep  5 14:29 .
drwxr-xr-x 1 root root 4096 Sep  5 09:43 ..
drwxr-xr-x 2 root root   60 Sep  5 14:29 ..2022_09_05_14_29_10.072816766
lrwxrwxrwx 1 root root   31 Sep  5 14:29 ..data -> ..2022_09_05_14_29_10.072816766
lrwxrwxrwx 1 root root   19 Sep  5 09:43 keystore.p12 -> ..data/keystore.p12

$ curl -vvv --insecure https://localhost:9443
...
* Server certificate:
*  subject: CN=FlinkDeployment Validator
*  start date: Sep  5 14:28:44 2022 GMT
*  expire date: Dec  4 14:28:44 2022 GMT
*  issuer: CN=FlinkDeployment Validator
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
...

cmctl console:

$ cmctl renew flink-operator-serving-cert
Manually triggered issuance of Certificate default/flink-operator-serving-cert

Webhook pod console again, check that timestamp changed:

$ ls -la /certs/
total 4
drwxrwxrwt 3 root root  100 Sep  5 14:31 .
drwxr-xr-x 1 root root 4096 Sep  5 09:43 ..
drwxr-xr-x 2 root root   60 Sep  5 14:31 ..2022_09_05_14_31_57.738271173
lrwxrwxrwx 1 root root   31 Sep  5 14:31 ..data -> ..2022_09_05_14_31_57.738271173
lrwxrwxrwx 1 root root   19 Sep  5 09:43 keystore.p12 -> ..data/keystore.p12

$ curl -vvv --insecure https://localhost:9443
...
* Server certificate:
*  subject: CN=FlinkDeployment Validator
*  start date: Sep  5 14:31:11 2022 GMT
*  expire date: Dec  4 14:31:11 2022 GMT
*  issuer: CN=FlinkDeployment Validator
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
...