Consume actions-openshift v0.8.0: cert-keeper, route-tls retries and cert-expiry

Đang mở
  • Có gì không ổn?
#2,939 0 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@DerekRoberts đang làm issue này rồi.

Từ ngày 9/11/2026.

Đánh giá

Issue này chưa được đánh giá.

Mô tả

This template's TLS setup still follows the manual Entrust flow and actions-openshift v0.6.0, while v0.8.0 adds automatic certificate handling that repos created from it could inherit.

What v0.8.0 adds

  • cert-keeper: a daily workflow step that looks at the certificate a host actually serves and, if the host has none or a third of the lifetime or less is left, gets a free Let's Encrypt certificate and installs it on the OpenShift Route. See its README.
  • route-tls: now retries network errors when installing a certificate (up to 12 times, 10 seconds apart), so a short OpenShift API drop no longer loses a freshly issued certificate.
  • cert-expiry: warns when a third of a certificate's own lifetime is left, and flags a host serving a certificate for another name. The days input is removed.

Where this template stands today

  • Four actions-openshift uses are pinned to v0.6.0: cert-expiry.yml, route-tls.yml, and sysdig-monitor in merge.yml and release.yml. #2938 moves cert-expiry to v0.8.0 and drops its removed days input. No Renovate bump was open on 2026-11-09.
  • TLS for a vanity host is manual: route-tls.yml applies certificate files stored in the TLS_CERTIFICATE, TLS_PRIVATE_KEY and TLS_CA_CERTIFICATE secrets, and the README explains how to map an Entrust package onto them.
  • AGENTS.md says vanity Route TLS is managed only through the standalone, on-demand route-tls.yml, never embedded in merge.yml, release.yml or continuous deployment.
  • cert-expiry.yml checks vars.ROUTE_HOST weekly.
  • quickstart.nrs.gov.bc.ca is currently served by Route quickstart-openshift-2929-vanity in namespace 32d13a-dev, created by the test rig in #2929, with a Let's Encrypt certificate that expires 2027-02-06. Nothing renews it. Closing #2929 deletes that Route and the certificate with it.

About route-tls

It stays in actions-openshift: cert-keeper calls it as its install step, and seven other bcgov repos each have a workflow that uses it (nr-silva, sdg, nr-hbs, aqadvisories-eservice, nr-tenures-api, address-change, bcgsdi-pubcat, code search on 2026-11-09). For a host that uses cert-keeper, this template's own manual route-tls.yml and the TLS_* secrets are no longer needed. They remain the path for a certificate obtained another way, such as Entrust through the Service Desk.

Ways the template could consume this

  • Add a standalone daily cert-keeper.yml, following the example in the cert-keeper README (an environment, four variables and the OC_TOKEN secret).
  • Update the README TLS section and the AGENTS.md rule to describe cert-keeper, and remove route-tls.yml together with the manual certificate-file and Entrust instructions, so the template no longer recommends route-tls. A host that cannot use Let's Encrypt would then have no documented path in the template (#159 is open).
  • Move the actions-openshift pins to v0.8.0 (Renovate normally does this).
  • Settle where quickstart.nrs.gov.bc.ca lives permanently, since the template's route-tls.yml targets the PROD frontend Route and the host is currently on the dev rig Route.

Order

This template adopts cert-keeper after v1.0.0 is tagged, pinned to the v1.0.0 release, rather than taking a pre-v1.0.0 version. The pre-v1.0.0 pins it already has (cert-expiry, route-tls and sysdig-monitor, all at v0.6.0) stay as they are until then. Other repos that use the actions being absorbed are tracked in bcgov/actions-openshift#163.

Why this matters for actions-openshift

route-tls will be folded into cert-keeper after v1.0.0, provided this template no longer recommends route-tls (bcgov/actions-openshift#162). As of 2026-11-09 cert-keeper appears nowhere in this repo, and route-tls.yml, README.md and AGENTS.md all still describe route-tls and the manual certificate-file flow.

Related: bcgov/actions-openshift#158 (design) and #159 (policy question), #2882 (move to consolidated actions), #2929 (test rig), #2938 (cert-expiry fix).

Ngôn ngữ chính
TypeScript
Star
32
Fork
10
Merge trung bình
3 giờ 54 phút
Pull request đã merge (30 ngày)
43

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của bcgov/quickstart-openshift

Tất cả issue của bcgov/quickstart-openshift

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.