snowjs / cli

CLI tool for dead-simple serverless Docker deployments on managed Kubernetes services. A self-hosted PaaS. ⚡️
https://github.com/snowjs/cli/tree/secrets
MIT License
409 stars 10 forks source link

[Helm] certificate lifecycle management #12

Open petermikitsh opened 5 years ago

petermikitsh commented 5 years ago

Currently, the helm <-> tiller connection is secured via TLS/SSL. We generate a Certificate Authority that's good for 20 years, a Helm certificate that's valid for 1 year, and a Tiller certificate that's also valid for 1 year.

Inevitably, the CA and Certificates are going to expire, and will need to be re-created, and their lifecycle managed accordingly. Practically speaking, since helm is only used during cluster creation, their expiration won't break deployments -- so this won't impact end users.