Repository navigation
Support for new CSBC automation #39
Description
Activity
@wmuldergov, I have a meeting this afternoon to discuss certificate renewal at the platform level using https://cert-manager.io/, which would be preferable to each team having to host and maintain their own instances of the
bcgov/certbot. That said, I already had backup plans to add support for Ingresses (TLS Secrets) tobcgov/certbot.Reacted by wmuldergov and Conor BradyConstructive meeting yesterday.
Key takeaways:
- ADMS team to get clarification on terms of the ACME licenses.
- Platform team to investigate deploying
cert-manager. - Goal/Timeline - Automated certificate renewal services operational before end of 2026. i.e. Prior to the certificate lifespans reducing to 100 days.
Certificate Lifespan Reduction Timelines
Effective Date Maximum Certificate Lifespan Maximum DCV Reuse Period Approximate renewals per Year Until Mar. 14, 2026 398 days 398 days ~ Once March 15, 2026 200 days 200 days ~ Twice March 15, 2027 100 days 100 days ~ Four times March 15, 2029 47 days 10 days ~ Eight times Working on the updated support here; #38
- linked a pull request that will close this issueAdd support for managed ingresses (tlsSecrets) #38
on Apr 22, 2026 @WadeBarnes can you provide progress on this. Otherwise, lets move to backlog or appropriate status (e.g. blocked)
It appears the platform team may be piloting cert-manager in KLab.
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- Status
Is your feature request related to a problem? Please describe.
CSBC recently announced that they are implementing automation options for SSL/TLS certificates in this bulletin: https://ociomysc.service-now.com/sp?id=kb_article&table=u_kb_template_technical_information_bulletin&sys_id=46d31552336bf6907f71fe282e5c7b9c&view=ess&spa=1
Describe the solution you'd like
For the certbot to become available again
Describe alternatives you've considered
None yet
Additional context
The bulletin notes that they support ACME for renewals but not sure if that is v1 or v2.