keda: cert-manager: rotate CA every 9 months

[wozniakjan]

The CA is self-signed for 1 year with a rotation set 1 month before its own expiration.
The cert signed by the CA is also signed for 1 year with a rotation 10 8 months before expiration (so rotating every 2 4 months).

That theoretically means the CA, a month before its expiration, can sign a cert for 1 year (scheduled to rotate in 2 4 months). But the cert will be rejected during TLS handshake in a month + 1 day because when evaluating the chain, the signing CA has expired at that point.

This PR adds extra rotation buffer, rotating CA every 9 7 months (3 5 months before expiration) so when it signs certs scheduled to rotate in 2 4 months, it doesn't expire meanwhile.

Checklist

• I have verified that my change is according to the deprecations & breaking changes policy
• Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #710

[tete17]

Hi @wozniakjan ,

I think it is not quite right. The defaults at the moment rotate the leaf certificate 8 months before it expires which means they are changed every 4 months not 2.

Furthermore the dates by which the leaf are renewed are user configurable. To me the best solution would be as follows:

• Stop allowing the configuration of the renewBefore field in all certs and use the 2/3 duration default.
• Increase the root ca validity to 5 years
• Add a helm check that would fail rendering if a user specified a leaf certificate duration longer than half the time of the root CA (i.e 2.5 years)

That would always ensure there is a renewal of a leaf certificate in the overlap of a root ca renewal. A slightly more complicated math applies if we also allow the configuration of the renewBefore field of the leaf certificate but I don't see why we should allow such configuration.

[wozniakjan]

I think it is not quite right. The defaults at the moment rotate the leaf certificate 8 months before it expires which means they are changed every 4 months not 2.

silly me, you are of course correct, 5840h is 8 months, not 10 :)

I like your proposal, given you went through the hard part of figuring out the details, would you like to send a PR as well? I'm happy to review it and close mine. Alternatively, I should be able to craft this PR better sometime next week.

[tete17]

Thanks @wozniakjan

Sure thing :)

Let me try to sneak in the MR today and at worst monday morning.

[tete17]

@wozniakjan I wasn't technicall enough with helm to do the check automatically unfortunatlly
#712

[wozniakjan]

no worries @tete17, I'm going to take a look at your PR later this week. I now realize we may want to consider keeping some sane default for renewBefore and allow it to be configurable in the chart as some people might be using this in their setup.

[wozniakjan]

superseded by #712