The documentation is missing steps for rotating the Octavia client certificate, which needs to be done yearly.