Integrate with OpenShift's Certificate Management

arthurdm commented 4 years ago

The high level goal of this workitem is to integrate with OpenShift's Certificate Management.

There are a lot of considerations to be taken:

differences in dev vs prod
how to convert when the runtime doesn't accept the native cert format (the current case of Open Liberty, although that will be lifted soon. There could be other runtimes that need conversion)
options between where the cert applies (i.e. Route vs microservice itself)
considerations when binding app <-> app? i.e. if one microservice is using certs but the other is not
how to renew the certificates
which day 2 operations can be done here as separate CRDs
knative vs regular k8s

There are probably other considerations that will be flushed out as this item is further broken down and implemented.

arthurdm commented 4 years ago

CC @jtmulvey / @utle

arturdzm commented 4 years ago

I worked with this before:

This is service specific, can be used to enable trusted internal service to service communication

Also this certificate is trusted by router (enabling) reencrypt functionality

utle commented 4 years ago

We also needs to support self-sign and third party cert.

appsody / appsody-operator