[dynamic infra] Manage SSL certificates
We need a way to manage the ssl certificates for the ingress that need it (argo, reaper, thanos services, ...)
@olasd suggested that we could reuse the current letsencrypt mecanism we have in place and add a new hook that commit the generated certificate in a kubernetes secret at the right place
We have a couple of hooks today: https://forge.softwareheritage.org/source/puppet-swh-site/browse/production/site-modules/profile/templates/letsencrypt/
Pending questions:
- How to configure the secret(s) where the certificate must be stored
- Possible solutions:
- use the domain name to name the secret
- grep for a label on the secret containing the domain name
- configure the path on the puppet configuration (like the
- Possible solutions:
- How to bootstrap a certificate secret placeholder ?
- but how to give the configuration to the underlying script ?
- ...
Migrated from T4604 (view on Phabricator)