[FEATURE] make cert-manager Certificate duration configurable #65

Activity

1. cbarbian-sap

   added the

   Feature

   issue type on Aug 19, 2026
2. cbarbian-sap commented on Aug 19, 2026

   

   cbarbian-sap

   on Aug 19, 2026

   Last edited by cbarbian-sap

   ContributorAuthor

   More actions

   In addition: if the rotation happens, does valkey pick up the new certificate? If not, some automatic pod restart would maybe be necessary.
3. martin-briatka

   self-assigned this

   on Nov 12, 2026
4. martin-briatka

   added a commit that references this issue on Nov 12, 2026

   Allow configuring the certificate duration

   ...

   This issue will close once commit a835176 is merged into the 'main' branch.

   a835176
5. martin-briatka commented on Nov 12, 2026

   

   martin-briatka

   on Nov 12, 2026

   Last edited by martin-briatka

   Contributor

   More actions

   Both points raised in this issue are addressed in #92:

   • Configurable duration: a new spec.tls.duration field is passed through to the generated cert-manager Certificate. When unset, the previous default of 876000h (~100 years) is preserved, so existing Valkey resources are unaffected.
   • Certificate pickup after rotation: a new spec.annotations field is merged onto the generated StatefulSet metadata. Attaching a pod-reloader annotation that points at the TLS secret triggers an automatic rolling restart, so the pods pick up the rotated certificate.