When a cert-manager Keystore Runs Behind a Password Change
cert-manager v1.21.2's API reference: "The keystore file will be updated immediately." After a password change, the keystores opened only with the old password throughout our 30-minute window. When It Runs — Run Report #RR08 · Testing what infrastructure actually does. Provider · Component: cert-manager · the keystore outputs of a Certificate ( spec.keystores.jks / spec.keystores.pkcs12 with…
When using cert-manager v1.21.2, if the keystore password is changed, the keystore entries in the target Secret remain encrypted with the old password for a 30-minute window. This was observed in a single-node kind cluster environment and occurred regardless of whether the password change was made through a referenced Secret or an inline password field.
The Certificate itself remained in a Ready=True state, but the keystore entries stayed encrypted until the certificate was re-issued. The API reference states that the keystore file should be updated immediately after the password change, which contradicts the observed behavior.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
