Problem Renewing the Certificate Authority

[maverickdb]

Install Method: cvp-rpm-installer-2020.3.0
Current Version: cvpi version 2020.3.0-1-11-g44d81d8 go1.13.6

Our CVP instance was stop working properly after 1 year of first setup.

We notice that some certificats have expired.

• NGINX certificates/CloudVision Portal Certificate
• Some certficiates under /cvpi/tls/certs/

We are able to renew NGINX certificates/CloudVision Portal Certificate without problem.

Then we try to renew CA Authority following https://www.arista.com/en/cg-cv/cv-https-certificates-setup.

• SSH into the primary. ( we only have one CVP instance )

• Reset the Certificate Authority (CA)and stop apiserver and ingest with the following commands.

yes | cvpi reset ca-init-v1

Runs ok

cvpi stop ingest cvpi
Runs ok

stop apiserver

How?

# kubectl get deployment ccapi -o wide
NAME    READY   UP-TO-DATE   AVAILABLE   AGE    CONTAINERS    IMAGES                 SELECTOR
ccapi   1/1     1            1           370d   aeris-ccapi   aeris-service:latest   app=ccapi,app-group=service,service=ccapi.ChangeControl

We can scale down the replica to 0?

• Renew CA and aeris admin certificates with the following commands.

cvpi init ca-init-v1

Runs well

`/cvpi/apps/aeris/bin/create-admin-cert.sh

That script does not exist

• Restart all stopped components.

cvpi start all

Cloudvision start working again after that point.

So, the issue is basically to understand if we need to renew the aeris and ambassador certificates.

Under /cvpi/apps/aeris/bin/ we see there are this two scripts.

• ambassador-cert-rotate.sh
• client-cert-rotate.sh

But not the create-admin-cert.sh following of documentation.

Thanks a lot