Strimzi
Replies: 3 comments 13 replies
-
|
I'm not sure this is unexpected. To make sure that the rolling update happens even when the in-memory state of the operator is lost, the certificate versions are tracked through annotations and when they change, that creates the |
Beta Was this translation helpful? Give feedback.
-
|
I have all those annotation, but when the client ca cert renewal happens still the annotation "strimzi.io/clients-ca-cert-generation: 0" and won't change. Pods are getting restarted but in the events i am getting "PodHasOldRevision" message not "CaCertRenewed". |
Beta Was this translation helpful? Give feedback.
-
|
Again, you would need to explain the exact scenarios, configs, and logs. You are asking for a very detailed explanations to a very generic questions. |
Beta Was this translation helpful? Give feedback.
-
This is the config and i am going to delete "eric-bss-msg-kafka-external-kafka-client-ca" secret and re-create it again, that will cause the pods to restart but when i check the events i am expecting "CaCertRenewed" but it is still "PodHasOldRevision" |
Beta Was this translation helpful? Give feedback.
-
Wait, why would you do that?
If you want to use your own CA or trigger a renewal, you should follow the docs. Just by going in and deleting some secret you are just doing some random disaster recovery testing. |
Beta Was this translation helpful? Give feedback.
-
|
This is the new logs: 0s Normal Killing pod/eric-data-message-bus-kf-test-kafka-1 Stopping container kafka 0s Normal Created pod/eric-data-message-bus-kf-test-kafka-1 Created container kafka-init 0s Normal Created pod/eric-data-message-bus-kf-test-kafka-1 Created container kafka 0s Normal Created pod/eric-data-message-bus-kf-test-kafka-2 Created container kafka-init 0s Normal Created pod/eric-data-message-bus-kf-test-kafka-2 Created container kafka 0s Normal Killing pod/eric-data-message-bus-kf-test-kafka-0 Stopping container kafka Here you can see the certificate rebewal happend, and the kafka pods are going to restart, but the message is "PodHasOldRevision" not "CaCertRenewed". |
Beta Was this translation helpful? Give feedback.
-
|
Hi Kafka version: 3.5.1 Issuer config:`apiVersion: v1
Certificate config:`apiVersion: v1
================= And certificate is autorenewed. This is the "kubectl get events log" 0s Normal Issuing certificate/ca-certificate Renewing certificate as renewal was scheduled at 2024-11-08 12:07:51 +0000 UTC Thanks |
Beta Was this translation helpful? Give feedback.
-
|
Without proper formatting, what you shared is not readable. But in general, not all events are really present:
So I think we should remove it completely because it is hard to track and it is meaningless. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @scholzj , Strimzi version: 0.36.1 I have configured a self-signed certificate setup using cert-manager, with both the Issuer and Certificate definitions included below for your reference. My expectation is that upon reaching the certificate renewal time, the event CaCertRenewed would be triggered. However, what I'm observing instead is the PodHasOldRevision event. I suspect this may not fully capture the event context we need, especially as the certificate itself is renewed correctly. Configuration Details: IssuerCertificateKafka Config:ObservationsWhen renewal is due, the Certificate resource triggers a sequence of events that includes Issuing, CertificateRequest, and CertificateIssued, which are expected behaviors. Question: Has anyone in the community encountered similar behavior with Strimzi and cert-manager integration? Would there be a recommended approach or configuration adjustment that might ensure CaCertRenewed appears instead of PodHasOldRevision upon renewal? Kubernetes Event LogsHere’s a snippet from the relevant events observed on the Kafka pod: Would appreciate any insights or suggestions for ensuring the correct event (CaCertRenewed) is logged instead of PodHasOldRevision. Thanks in advance for your support! Thanks |
Beta Was this translation helpful? Give feedback.
-
|
@saeedya If you want the correct event to appear you must follow the correct procedure as described in the Strimzi documentation for bring your own CA certificates: https://strimzi.io/docs/operators/latest/deploying#installing-your-own-ca-certificates-str I see no evidence that you have disabled Strimzi from generating the certificate authority: and no evidence that you are triggering the renewal using the |
Beta Was this translation helpful? Give feedback.
-
|
@saeedya First of all, you should try to go through your config and see what is actually valid configuration and what you made up. The Second, I suspect you are not talking about the Strimzi CA or about a custom CA. You are only using a custom listener server certifciate. That has nothing to do with the cluster or clients CAs and does not in any way relate to the events. The custom listener server certificate is tracked through annotation on the pods and that is why its change triggers the revision change. This is the only way how to reliably track the reload of such certificate. And as it is server certifciate only on a listener where only your clients connect, Strimzi does nto care in any way whether you changed the certificate, renewed the CA used to sign it or what happened. |
Beta Was this translation helpful? Give feedback.
-
|
@scholzj |
Beta Was this translation helpful? Give feedback.
-
|
I'm not sure I follow the questions, sorry. The listener server certificate will currently always give you the |
Beta Was this translation helpful? Give feedback.
-
Hi
When the new cert renewal is happening , we are expecting the events as below:
CaCertRenewed CaCertRenewed CA certificates have been renewed, and the pod is restarted to run with the updated certificates.Restart reasons
But we are getting "Pod has old revision".
@scholzj
Thanks
Saeed
Beta Was this translation helpful? Give feedback.
All reactions