Feature: Certmgr as an in-process supervisor

[cloudflare]

Feature: Certmgr as an in-process supervisor

[kisom]

This is really interesting --- I'd never really considered the use case where certmgr was a library.

To address the points:

1. Easy enough. The only thing I really worry about it is dependencies disappearing from Github, but the risk is low because only the prometheus library and cobra/viper packages are the external dependencies.
2. This should also be relatively straightforward.
3. This could be done by having a different function to return an initialised manager.

letting them pass in configuration via function parameters.

What does that look like?

[cbroglie]

Could you just migrate to dep for 1?

[kisom]

@cbroglie Indeed.

[kisom]

@andrewplunk One thing that occurs to me, have you tried using the CFSSL transport package? certmgr is essentially a UI on top of this, so it might be useful, too.

[andrewplunk]

@kisom

letting them pass in configuration via function parameters.

What does that look like?
I would like my clients to provide my library with the CA label and auth key required to provision certs from the transport. I would then configure certmgr with my own svcmgr.Manager implementation to handle reloading the tls.GetClientCertificate/tls.GetCertificate's caches as necessary.

@andrewplunk One thing that occurs to me, have you tried using the CFSSL transport package? certmgr is essentially a UI on top of this, so it might be useful, too.

You're totally right I could build this on top of the CFSSL transport package. I will do so if you don't think that certmgr makes sense as a library.