spike: trial own/self-signed and ACME certs on quickstart.nrs.gov.bc.ca

Abierto
  • ¿Algo no está bien?
#2,928 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@DerekRoberts ya está trabajando en esto.

Desde el 30/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Context

DNS for https://quickstart.nrs.gov.bc.ca/ is in place (#2924 / SD-189103). Installing TLS via Entrust + route-tls is already the known path. What we have not recorded or demonstrated is whether we can (or cannot) use our own certificates on that vanity host — including free ACME — instead of paid/manual Entrust ordering.

North star (not today)

A reusable pattern for OpenShift projects to update their own TLS — likely an action in bcgov/actions-openshift, possibly wired with bcgov/nr-cert-monitor. Today's work is the canary that informs that design.

Goal (this issue)

Ship a quickstart-openshift PR that tries one or more non-Entrust options against the live vanity route and leaves a clear result: worked, blocked by platform/policy, or blocked by tooling. Prefer empirical evidence over waiting on an unknown OCIO/ministry contact.

Options to try (prototype, not product)

  1. Let's Encrypt (ACME) — HTTP-01 and/or DNS-01 if available on this host/cluster.
  2. bcgov/cert-manager-proxy (Conor's ACME + DNS-check proxy) — if the namespace can use it.
  3. Self-signed / personal test CA — prove OpenShift route + browser path with a cert we mint ourselves (short-lived).
  4. Any other free/public ACME CA we can reach from the cluster without a new paid Entrust order.

Out of scope for this issue: making vanity SSL self-serve for every team, or changing Entrust process. This is a canary/demo on quickstart only.

Acceptance

  • Options and constraints written here (or linked) so the idea is not only in chat.
  • At least one PR on bcgov/quickstart-openshift that applies a non-Entrust cert (or documents the exact failure) to the quickstart.nrs.gov.bc.ca route via route-tls or equivalent.
  • Short write-up in the PR: what worked, what failed, and whether ACME is viable for gov.bc.ca vanity here.
  • Notes that feed a future actions-openshift (and optionally nr-cert-monitor) reusable pattern — no need to ship that action in this issue.

Refs

  • Vanity request: #2924
  • route-tls + CSR directions: bcgov/actions-openshift
  • Related experiment: bcgov/cert-manager-proxy
  • Cert expiry monitor: bcgov/nr-cert-monitor
Lenguaje dominante
TypeScript
Estrellas
32
Forks
10
Merge medio
4 h 13 min
PR fusionados (30 d)
45

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de bcgov/quickstart-openshift

Todos los issues de bcgov/quickstart-openshift

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.