Uacme: ACMEv2 client written in plain C with minimal dependencies

Re:Uacme: ACMEv2 client written in plain C with minimal depe... by deathanatos on Sunday August 21, 2022 @04:06PM (#32543909)

I know you jest, but if you're in k8s, I'd check out cert-manager (https://cert-manager.io/). It works quite well, and as it integrates w/ k8s, it stores the cert in a Secret where an Ingress picks it up automatically, and it solves the whole multiple-replicas-all-need-the-cert problem that I have w/ certbot.

(I agree, while certbot works, it's a bit of a usability nightmare.)

[ Parent | on HN ]

Re:Uacme: ACMEv2 client written in plain C with minimal depe... by yrro on Monday August 22, 2022 @07:45AM (#32550091)

Wish it had a way to kick off a pod after a certificate is issued, that way I could automate applying the issued certificates to the devices where they'll be used.

(Yeah I currently do this with a cron job so it's not _so_ bad)...

[ Parent | on HN ]

Re:Uacme: ACMEv2 client written in plain C with minimal depe... by deathanatos on Monday August 22, 2022 @02:57PM (#32555653)

Yes. I would appreciate such a feature, too. For Ingresses, it doesn't matter (as the controller is smart & picks it up automatically) but we have a database whose cert requires a rolling restart, and yeah, it'd be good to have a way to trigger that.

(We get around this, normally, by having regular reboots of the nodes for system updates. So no pod lives long enough for a replacement cert to not get picked up in time, usually. In the off case reboots don't happen, we have alerting.)

[ Parent | on HN ]