Lets Encrypt Certs¶
We need a valid cert for both the wildcard *.apps.ocp.ci.centos.org and api.ocp.ci.centos.org. We have a role/task which covers the replacing of TLS certs on ocp.ci/ocp.stg.ci
A separate process is performed to request certs from LetsEncrypt, and stores the cacert/certs/key within the pkistore for ocp.ci/ocp.stg.ci.
To deploy the certs to the cluster, we run the following playbook:
ansible-playbook playbooks/role-ocp-admin-node.yml --tags "tls, certs"
Resources: *  Certman Operator (looks like this requires HIVE so not going to work) https://github.com/openshift/certman-operator *  Changing the cert in OCP4 https://docs.openshift.com/container-platform/4.4/authentication/certificates/replacing-default-ingress-certificate.html *  RHMI SOP for manually replacing certs on 3.11 cluster, many steps similar: https://github.com/RHCloudServices/integreatly-help/blob/master/sops/POC_cert_renewal.asciidoc *  Option Brian suggested: https://github.com/tnozicka/openshift-acme *  HIVE https://github.com/openshift/hive