[QUESTION] How do you handle cert renewals

[joeypiccola]

Nice chart, I've been picking a few pieces from it and have come to a point where I might just use your chart rather than trying to reverse the work 😆 .

Quick question, is my understanding correct in that once the cert has been setup/configured with openssl then there's no future configuration of it?

Thanks!

[jbreed]

Nice chart, I've been picking a few pieces from it and have come to a point where I might just use your chart rather than trying to reverse the work 😆 .

Quick question, is my understanding correct in that once the cert has been setup/configured with openssl then there's no future configuration of it?

Thanks!

Hey! I honestly didn't think anyone was using this other than myself. I haven't had to touch this in some time to be honest.

For managing the tls certificate, I use 'cert-manager' helm chart to keep the cert renewed and then the 'reflector' helm chart to copy into the namespace this gets deployed to.

For the controller image itself, every so often I will login to download the latest version and rebuild the controller image, push to my public Dockerhub repo, then cycle the controller pod.

I will have to refresh my memory and run through the code, but if I recall I had to create a java keystore or something for Unifi to use it and at the time (not sure if this has changed since) I could not store everything in a secret or have cert-manager output to the format it needed. I have been running this for a while without any issues. Every so often I will download a new deb and push a new image (public Dockerhub) for the controller. If I had to recall though, if the cert changed I believe the current logic would require cycling the pod to use it. I haven't had to do that specifically for the cert to be valid, so I am not 100% sure. I can run through the entrypoint or other scripts in this repo if needed.

[jbreed]

Just read the values.yaml and read my old comment:
# Note: Cert-manger is expected to support jks keystores with an alias in v1.15 (release June2024)

At the time I worked this, cert manager did not support jks keystores so had to do some hacks to do this. I believe I tool the cert and converted to what unifi wanted; however, if cert-manager supports jks keystore that would be the way to go.