Project
Automated certificate lifecycle
Issuing, renewing and distributing TLS certificates automatically, with validation before anything ships.
What it is
Automation around TLS certificates: requesting and renewing them, validating them, and getting the renewed material to the systems that terminate TLS — without someone remembering to do it.
Why it exists
Manual certificate handling is the kind of toil that is fine until it isn’t. Renewals get missed, or worse, a broken certificate gets deployed because nobody checked it. Automating the whole loop removes both failure modes.
How it works
- Certificates are requested via ACME (Let’s Encrypt).
- DNS challenges are answered by automation rather than by hand.
- Renewed certificates and keys are validated before distribution.
- Valid material is published where consumers can pick it up; distribution to Kubernetes is treated as a separate concern.
- The workflow runs on a schedule, and completion is defined as successful publication — not merely a successful issuance.
Notes
- The design detail worth remembering: “certificate issued” and “certificate in use” are different events, and only the second one matters operationally.
Status
Active. See the draft write-up for the intended deep dive.