Helm Changes
- Add new certgen CronJob if validation webhook is enabled (#5944)
- Add an option to enable
force-rotationflag for certgen job (#5944)
Fixes
- Make cert rotation more resilient against downtime when mTLS is enabled, by updating the certs in stages and waiting for changes to propagate. A new helm value
gateway.certGenJob.rotationDuration(default 65s) can be used the configure the duration to wait for each stage of cert rotation to complete. This value must be tuned according to the performance of the specific environment in which the jobs are run. (https://github.com/solo-io/solo-projects/issues/5252) - Certgen job will now renew existing certificate if it is expiring soon (90d by default). (#5944)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (#8809)