cURL
curl --request PATCH \
--url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/client-ca-cert \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--json '{"update_mode":"APPEND","x509_pem_cert":"-----BEGIN CERTIFICATE-----..."}'{
"status": "NOT_SET",
"x509_pem_cert": "<string>"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Update Client CA Cert for a cluster
Can be used by the following roles assigned at the organization, folder or cluster scope:
- CLUSTER_ADMIN
- CLUSTER_OPERATOR_WRITER
PATCH
/
api
/
v1
/
clusters
/
{cluster_id}
/
client-ca-cert
cURL
curl --request PATCH \
--url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/client-ca-cert \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--json '{"update_mode":"APPEND","x509_pem_cert":"-----BEGIN CERTIFICATE-----..."}'{
"status": "NOT_SET",
"x509_pem_cert": "<string>"
}{
"code": 123,
"details": [
{
"@type": "<string>"
}
],
"message": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
cluster_id is the ID of the cluster whose client CA cert is being updated.
Body
application/json
- REPLACE: REPLACE overwrites all existing certs with the provided cert. This matches the behavior of the SetClientCACert (POST) endpoint. This is the default when update_mode is omitted.
- APPEND: APPEND adds the provided cert to the existing cert bundle. This mode enables no-downtime certificate rotation: append the new cert, roll it out across clients, then REPLACE with only the new cert to drop the old one.
Available options:
REPLACE, APPEND x509_pem_cert is the PEM-encoded X.509 CA certificate to apply.
Response
A successful response.
- NOT_SET: NOT_SET indicates a client CA cert is not set on the cluster. New clusters won't have a client CA cert set.
- IS_SET: IS_SET indicates a client CA cert is set on the cluster.
- PENDING: PENDING indicates a client CA cert update is in flight on the cluster.
- FAILED: FAILED indicates a client CA cert update was attempted, but failed.
Available options:
NOT_SET, IS_SET, PENDING, FAILED