Disabled private key rotation in CA certs

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

packages/extra/etcd/templates/etcd-cluster.yaml

@@ -104,6 +104,7 @@ spec:
       - {{ .Release.Name }}
   secretName: etcd-peer-ca-tls
   privateKey:
+    rotationPolicy: Never
     algorithm: RSA
     size: 4096
   issuerRef:
@@ -130,6 +131,7 @@ spec:
       - {{ .Release.Name }}
   secretName: etcd-ca-tls
   privateKey:
+    rotationPolicy: Never
     algorithm: RSA
     size: 4096
   issuerRef:

packages/system/cozystack-api/templates/certmanager.yaml

@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: cozystack-api-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer

packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml

@@ -23,6 +23,8 @@ spec:
     name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer
   commonName: "ca.webhook.ingress-nginx"
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   subject:
     organizations:
       - ingress-nginx

packages/system/kubeovn-webhook/templates/certmanager.yaml

@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: {{ include "namespace-annotation-webhook.fullname" . }}-selfsigned-issuer
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer

packages/system/lineage-controller-webhook/templates/certmanager.yaml

@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: lineage-controller-webhook-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer

packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml

@@ -24,6 +24,8 @@ spec:
   issuerRef:
     name: {{ include "linstor-scheduler.fullname" . }}-admission-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer

packages/system/linstor/templates/linstor-api-tls.yaml

@@ -9,6 +9,8 @@ spec:
   secretName: linstor-api-ca
   duration: 87600h # 10 years
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   usages:
     - signing
     - key encipherment

packages/system/linstor/templates/linstor-internal-tls.yaml

@@ -9,6 +9,8 @@ spec:
   secretName: linstor-internal-ca
   duration: 87600h # 10 years
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   usages:
     - signing
     - key encipherment

packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml

@@ -13,6 +13,8 @@ spec:
   secretName: {{ template "seaweedfs.name" . }}-ca-cert
   commonName: "{{ template "seaweedfs.name" . }}-root-ca"
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   {{- if .Values.certificates.ca.duration }}
   duration: {{ .Values.certificates.ca.duration }}
   {{- end }}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml

@@ -78,6 +78,8 @@ spec:
     name: {{ $fullname }}-root
   commonName: {{ $certManager.ca.commonName }}
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer