Updating TLS secret does not trigger POD restart

[lordigon]

Hi all, I created via operator a cluster with two nodes with TLS enabled. I would like to test what happens if, for any reason, I need to update the secrets containing certificates (e.g because they are close to expire). I've updated the secret via kubectl and checked that mounted files are updated but PODs didn't restart. So

• Is it the right approach?
• there is a better way to update it?
• the pods hot reload the files?
• what else?

[brusdev]

ActiveMQ Artemis load the certificates when acceptors start, you need to reload the acceptor with the management API or using the web console, see org.apache.activemq.artemis.api.core.management.AcceptorControl.reload()
https://github.com/apache/activemq-artemis/blob/2.27.0/artemis-core-client/src/main/java/org/apache/activemq/artemis/api/core/management/AcceptorControl.java#L50

   @Operation(desc = "Re-create the acceptor with the existing configuration values. Useful, for example, for reloading key/trust stores on acceptors which support SSL.", impact = MBeanOperationInfo.ACTION)
   void reload();

[gtully]

I think the broker should do this by default see: https://issues.apache.org/jira/browse/ARTEMIS-4164