Consul-helm: Consul TLS buildin certificate

[yevgeniyo]

Hi, as I see if not providing my own TLS, some job generates all relevant certificates for me.
I'm seeing that certificate which was created automatically has expiration in 730 days.
https://github.com/hashicorp/consul-helm/blob/a793e703e4d58fa8624c693dd52928a1d5bc9d8f/templates/tls-init-job.yaml#L84
Is it possible increase it for 10 years? Or how I can renew it with help of chart?

[thisisnotashwin]

@yevgeniyo At this point of time, the expiration is not configurable. The job will get re-run if there is an update to the consul image. But not otherwise as the job spec would remain unchanged. But we could investigate a way to potentially run the job at periodic intervals or have them run during all helm upgrades potentially. We would have to investigate how we could do cert rotation here safely though.

[thisisnotashwin]

This PR should ensure the server certificates get recreated after a helm upgrade https://github.com/hashicorp/consul-k8s/pull/410

The only caveat would be a server restart would be required to ensure the updated certificates get picked up by the servers.

[ishustava]

Hey @yevgeniyo, we've released the automatic rotation of server certificates feature @thisisnotashwin had mentioned. Do you think this issue can not be closed?