Is your feature request related to a problem?
We seed each vCluster with our own internal CA cert and key so its PKI is rooted in our internal CA. This works, but there's no first-class support for it, which causes two problems:
-
vcluster certs rotate-ca silently destroys the supplied CA. excludeCAFiles is only applied when withCA is false (pkg/certs/rotate.go:82-90), so the CA is removed and replaced with a self-signed one. No warning.
-
CA renewal doesn't propagate. The CA is only consumed at bootstrap (pkg/certs/ensure.go:122-128), so a cert-manager reissue never reaches the running vCluster.
We use jobs to manually manage these issues.
Which solution do you suggest?
An explicit caSecretRef config field (placement open to discussion) that vCluster reads directly:
- validated at startup: PEM parses, key matches cert, isCA, not expired
- read at runtime rather than consumed once, so reissue propagates
- rotate-ca refuses without --force when the CA isn't self-signed (detectable
via Issuer != Subject, no new config needed)
Happy to split this up, the rotate-ca guard is small and standalone.
Which alternative solutions exist?
We manually bootstrap the cluster with our internal CA/key. Upon renewal, we use the cert rotate cli command which doesn't clobber our internal ca crt/key. However, this is pretty counter-intuitive.
Additional context
No response
Is your feature request related to a problem?
We seed each vCluster with our own internal CA cert and key so its PKI is rooted in our internal CA. This works, but there's no first-class support for it, which causes two problems:
vcluster certs rotate-casilently destroys the supplied CA.excludeCAFilesis only applied whenwithCAis false (pkg/certs/rotate.go:82-90), so the CA is removed and replaced with a self-signed one. No warning.CA renewal doesn't propagate. The CA is only consumed at bootstrap (pkg/certs/ensure.go:122-128), so a cert-manager reissue never reaches the running vCluster.
We use jobs to manually manage these issues.
Which solution do you suggest?
An explicit
caSecretRefconfig field (placement open to discussion) that vCluster reads directly:via Issuer != Subject, no new config needed)
Happy to split this up, the rotate-ca guard is small and standalone.
Which alternative solutions exist?
We manually bootstrap the cluster with our internal CA/key. Upon renewal, we use the cert rotate cli command which doesn't clobber our internal ca crt/key. However, this is pretty counter-intuitive.
Additional context
No response