Renew Certificates for a Runtime Instance

Runtime certificates generated by Konnect Cloud expire every ten years. If you bring your own certificates, make sure to monitor the expiration date.

Renew your certificates to prevent any interruption in communication between Konnect Cloud and any configured runtimes, or data planes. If a certificate expires and is not replaced:

The runtime instance stops receiving configuration updates from the control plane.
The runtime instance stops sending vitals and usage data to the control plane.
Each disconnected runtime instance uses cached configuration to continue proxying and routing traffic.

Depending on your setup, renewing certificates might mean bringing up a new data plane, or generating new certificates and updating data planes with the new files.

Quick setup

If you originally created your runtime instance container using the quick setup Docker script, we recommend running the script again to create a new instance with renewed certificates.

Stop the runtime instance container.
Open Runtime Manager, select a runtime group, and click New Runtime Instance.
Run the script again to create a new runtime instance with updated certificates.
Remove the old runtime instance container.

Advanced setup

If your runtime instances are running on Linux or Kubernetes, or if you have a Docker container that was not created using the quick setup script, you must generate new certificates and replace them on the existing nodes.

Generate new certificates

Open Runtime Manager, select a runtime group, and click + New Runtime Instance.
Open the tab that suits your environment: Linux or Kubernetes.

If you’re running a Docker container, you can use either of these tabs to complete the following steps.
Click Generate Certificate.
Save the new certificate and key into separate files:
- certificate: tls.crt
- private key: tls.key
Store the files on the local file system.

Update data plane

Linux

Kubernetes

Docker

Open your instance’s kong.conf file. Replace existing certificates with the new files:

cluster_cert = /{PATH_TO_FILE}/tls.crt
cluster_cert_key = /{PATH_TO_FILE}/tls.key

Restart Kong Gateway for the settings to take effect:

kong restart

Delete any old certificate and key files on your filesystem.

Create new secrets for the certificates and key, making sure to name them something different from the current secret names.

Create a tls secret using the tls.cert and tls.key files you saved earlier:

 kubectl create secret tls kong-cluster-cert2 -n kong \
   --cert=/PATH_TO_FILE/tls.crt \
   --key=/PATH_TO_FILE/tls.key

Open the values.yaml file for your runtime instance and update it to point to the new secrets.

Update the secretVolumes section:

 secretVolumes:
 - kong-cluster-cert2

Update the cert values in the env section:

 env:
   cluster_cert: /etc/secrets/kong-cluster-cert2/tls.crt
   cluster_cert_key: /etc/secrets/kong-cluster-cert2/tls.key

Save the file. Reapply the configuration by running the Helm upgrade command:

 helm upgrade my-kong kong/kong -n kong \
   --values ./values.yaml

Delete the old kong-cluster-cert secret:

 kubectl delete secret kong-cluster-cert

In your Docker container, replace any existing certificates on your runtime instances with the new files and restart the Gateway:

echo "KONG_CLUSTER_CERT=/{PATH_TO_FILE}/tls.crt \
  KONG_CLUSTER_CERT_KEY=/{PATH_TO_FILE}/tls.key \
  kong reload exit" | docker exec -i {KONG_CONTAINER_ID} /bin/sh

Delete any old certificate and key files on your filesystem.