autocert: Renew when 80% of the time until expiration is elapsed

[vadmeste]

Currently, the auto generated MinIO certificate is auto renewed before 48 hours of the expiration date. Since the operator does not set an expiry date, some certicates are short lived, therefore the operator will try to renew the certificate all the time.

The solution is to renew only when 80% of the time until the certificate expiration date has elapsed.

[harshavardhana]

Currently, the auto generated MinIO certificate is auto renewed before 48 hours of the expiration date. Since the operator does not set an expiry date, some certicates are short lived, therefore the operator will try to renew the certificate all the time.

The solution is to renew only when 80% of the time until the certificate expiration date has elapsed.

We should set the expiration by default to 365 days @vadmeste

[vadmeste]

We should set the expiration by default to 365 days @vadmeste

It requires k8s 1.22 and I am not sure it will work everywhere

[harshavardhana]

It requires k8s 1.22 and I am not sure it will work everywhere

Can we do that on k8s1.22 and above atleast?

[pjuarezd]

In Kubernetes, the default is already 1 year, unless explicitly set. otherwise.

The PKCS#10 signing request format does not have a standard mechanism to specify a certificate expiration or lifetime. The expiration or lifetime therefore has to be set through the spec.expirationSeconds field of the CSR object. The built-in signers use the ClusterSigningDuration configuration option, which defaults to 1 year, (the --cluster-signing-duration command-line flag of the kube-controller-manager) as the default when no spec.expirationSeconds is specified. When spec.expirationSeconds is specified, the minimum of spec.expirationSeconds and ClusterSigningDuration is used.

If I am understanding all right, per the Signers and Certificate rotation kubernetes documentation, the Expiration time is decided as follows:

I like the Idea of 80%. Whenever the cluster is set to a low certificate expiration time, is better to rotate based on the consumption of the certificate expiration, rather than a fixed 48 hours.

Regardless, if the default set is to somenthing that low, we are going to keep seeing frequent rotations anyways.