Keep pipeline client certificates inside the managed CA rotation window

Source facts

Azure Monitor pipeline’s managed client certificates must renew within two days; otherwise a CA rotation can invalidate them. Microsoft supplies duration and renewBefore combinations designed to meet that constraint. Certificates from the managed client issuer are for clients inside the same Kubernetes cluster, not external clients, which should use a gateway. Microsoft Learn.

Client namespaces must be labeled to receive the server CA trust-bundle ConfigMap. The operator updates that bundle during certificate rotation. Server leaf certificates have a 48-hour lifetime and renew 24 hours before expiry. Microsoft Learn.

Applicability

Review intra-cluster clients using automated certificate management for Azure Monitor pipeline on Arc-enabled Kubernetes. Confirm the pipeline’s prerequisites and client placement before using its managed issuer; this is not a general external-device certificate design.

DSE recommendation

DSE recommends reviewing the client’s renewal schedule and trust delivery as one configuration. Compare duration and renewBefore with the documented two-day renewal constraint, rather than checking only the printed expiry date. Confirm that the intended client namespace receives the managed trust bundle. Keep external clients on the separately approved gateway path instead of exporting an intra-cluster identity for convenience.

Verification

In a controlled test, observe issuance, renewal and trust-bundle updates while checking successful client connections. Verify that the client uses the replacement certificate and current trust material. Preserve certificate identifiers and timing without private keys. Treat a certificate that still appears unexpired but no longer validates after CA rotation as a rotation-path investigation, not a reason to disable peer validation.

Official references

Microsoft Learn: Pipeline automated certificate management.