spike: trial own/self-signed and ACME certs on quickstart.nrs.gov.bc.ca

Aperta
  • Qualcosa non va?
#2,928 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@DerekRoberts ci sta già lavorando.

Dal 30/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Context

DNS for https://quickstart.nrs.gov.bc.ca/ is in place (#2924 / SD-189103). Installing TLS via Entrust + route-tls is already the known path. What we have not recorded or demonstrated is whether we can (or cannot) use our own certificates on that vanity host — including free ACME — instead of paid/manual Entrust ordering.

North star (not today)

A reusable pattern for OpenShift projects to update their own TLS — likely an action in bcgov/actions-openshift, possibly wired with bcgov/nr-cert-monitor. Today's work is the canary that informs that design.

Goal (this issue)

Ship a quickstart-openshift PR that tries one or more non-Entrust options against the live vanity route and leaves a clear result: worked, blocked by platform/policy, or blocked by tooling. Prefer empirical evidence over waiting on an unknown OCIO/ministry contact.

Options to try (prototype, not product)

  1. Let's Encrypt (ACME) — HTTP-01 and/or DNS-01 if available on this host/cluster.
  2. bcgov/cert-manager-proxy (Conor's ACME + DNS-check proxy) — if the namespace can use it.
  3. Self-signed / personal test CA — prove OpenShift route + browser path with a cert we mint ourselves (short-lived).
  4. Any other free/public ACME CA we can reach from the cluster without a new paid Entrust order.

Out of scope for this issue: making vanity SSL self-serve for every team, or changing Entrust process. This is a canary/demo on quickstart only.

Acceptance

  • Options and constraints written here (or linked) so the idea is not only in chat.
  • At least one PR on bcgov/quickstart-openshift that applies a non-Entrust cert (or documents the exact failure) to the quickstart.nrs.gov.bc.ca route via route-tls or equivalent.
  • Short write-up in the PR: what worked, what failed, and whether ACME is viable for gov.bc.ca vanity here.
  • Notes that feed a future actions-openshift (and optionally nr-cert-monitor) reusable pattern — no need to ship that action in this issue.

Refs

  • Vanity request: #2924
  • route-tls + CSR directions: bcgov/actions-openshift
  • Related experiment: bcgov/cert-manager-proxy
  • Cert expiry monitor: bcgov/nr-cert-monitor
Lingua principale
TypeScript
Stelle
32
Fork
10
Merge medio
4h 13m
PR unite (30g)
45

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di bcgov/quickstart-openshift

Tutte le issue di bcgov/quickstart-openshift

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.