From 5ce2bcebb67c917429d7af1ae4da3b480340cfcc Mon Sep 17 00:00:00 2001
From: zoezhao <zoezhao@google.com>
Date: Thu, 23 Jul 2026 11:43:46 -0700
Subject: [PATCH] make sure valkey reload certs before the cached one expires

---
 manifests/ate-install/valkey.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/manifests/ate-install/valkey.yaml b/manifests/ate-install/valkey.yaml
index 2e5fb0088..23325d0fe 100644
--- a/manifests/ate-install/valkey.yaml
+++ b/manifests/ate-install/valkey.yaml
@@ -30,8 +30,11 @@ data:
     tls-key-file /run/servicedns.podcert.ate.dev/credential-bundle.pem
     tls-ca-cert-file /etc/valkey-ca/ca.crt
     tls-auth-clients yes
-    # Reload the cert every 12h.
-    tls-auto-reload-interval 43200
+
+    # Reload every 10 minutes. 
+    # The interval should be less than the 30m headroom (notAfter - beginRefreshAt) 
+    # set by cmd/podcertcontroller/internal/servicednssigner/servicednssigner.go.
+    tls-auto-reload-interval 600
 
     # Enable cluster mode
     cluster-enabled yes