ikke-t/certbot-ocp

Utility for creating and updating SSL certificates for routes in OpenShift project. Uses Let's Encrypt and NGINX

certbot-ocp's Issues

create kubernetes cron-job for this.

Currently, this just runs through and keeps relooping. It needs to be manually scaled up/down.

As a user, I want to have a periodical run of certbot-ocp. I want it to be be run e.g. weekly.

create an operator for certbot-ocp

This was developed in OpenShift online, where one is not cluster-admin. But for such clusters where you are and admin, it sure would be nice to offer the service via an operator.

So create an operator, which set's up a kube cron job for cert renewal, and monitors for route creations and kicks this container to install certs when a new route is created or updated with proper label.

fix ansible playbook to delete routes by label

Add this kind of k8s part into playbook: oc delete all -l app=certbot-ocp

Move svc before pod in ansible playbook

If container image is present on node, certbot is started really fast and now svc is created after pod and it is not present when pod is running.

Service creation needs to be moved before pod creation

And some sleep after certpod route is ready.

Now when working with multiple routes some cert creations fail randomly. Adding 5 sec timeout after route creation cert creation seems to fix this.

Add cert creation date to route

Add annotation to route that describes when cert has been created and/or expire date.

Add helm chart

Create helm chart

create template for certbot-ocp

put all this into ansible playbook

optimize the image size

I took a shortcut, and built the first version using an existing nginx-s2i image, as it was quick to re-use. However, the size is awful. Create smaller version of this image by using ubi-minimal -like image.

Certbot service name is hardcoded to container

Error from server (NotFound): services "certbot-ocp" not found. Should be able to overwrite from ENV var. Might be that single namespace has multiple certbots running...different account emails.