Rotate internal TLS certificates

Update internal TLS certificates when they approach expiration or when your security policy requires rotation. The operator automatically detects Secret changes and triggers a rolling restart of the affected pods.

Before you begin

You have provided your own internal TLS certificates. The default operator-generated certificates do not require manual rotation.

About this task

You can rotate certificates by updating the existing Secrets in place. Alternatively, create new Secrets and update the spec.tls references in the custom resource.

Procedure

Update the Secret content for each service certificate that needs rotation.
Use oc create secret tls with --dry-run=client to generate a new Secret manifest and pipe it to oc apply:
```
$ oc create secret tls my-backend-tls \
    --cert=new-backend.crt \
    --key=new-backend.key \
    -n automation-orchestrator \
    --dry-run=client -o yaml | oc apply -f -
```
Repeat for each service certificate that needs rotation.

Wait for the rolling restart to complete:

$ oc rollout status deploy/my-orchestrator-backend -n automation-orchestrator
$ oc rollout status deploy/my-orchestrator-worker -n automation-orchestrator
$ oc rollout status deploy/my-orchestrator-background-worker -n automation-orchestrator
$ oc rollout status deploy/my-orchestrator-temporal -n automation-orchestrator
$ oc rollout status deploy/my-orchestrator-ui -n automation-orchestrator