tazjin/kubernetes-letsencrypt

Re-evaluate naming of secrets

Closed this issue · 3 comments

tazjin commented

I'm not sure whether secrets should be named after the domain that they belong to or the service that requested them.

For example, a service "admin" exists in different environments (admin.test.foo.com and admin.prod.foo.com). The service admin-external requests the certificates.

This currently generates secrets named admin-test-foo-com-tls and admin-prod-foo-com-tls. This means that a webserver Deployment resource configuration is different between the environments.

Is that sensible? Is it possible to retrieve volume names from a ConfigMap? (i.e. having a ConfigMap per environment that maps these, therefore still having sensible secret names and having resource reusability).

tazjin commented

Last thought before sleeping: The annotations on services also differ between environments, so this is only one bit of the problem.

tazjin commented

Ideally this is solved by #2 because the third-party resource could define an additional field to use for the name of the Secret.

tazjin commented

This needs to be sorted for supporting #21.

For now I will probably do the following (pre 2.0) to keep compatibility:

  1. Continue as is.
  2. Pick the first certificate for naming if multiple certificates are specified.
  3. Support an additional acme/secretName annotation to override.