Provide the ability to reset the certificate object in Venafi TPP
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 106
- Forks
- 77
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 1
Description
BUSINESS PROBLEM
If the downstream CA service is down for any reason, Venafi TPP changes the status of certificate object to Error.
The scenario to reproduce this is simple
cert-manager--->Venafi TPP--->MSCA
cert-manager and MSCA could be replaced with any consumer and provider.
- Request a certificate using
cert-manager - Stop the MSCA service
- Trigger a certificate renewal using
cert-manager - As expected the renewal fails because Venafi cannot reach the downstream
MSCAservice - Renewal fails with a proper error that can be seen in the
CertificateRequestresource - Venafi TPP during it's attempt to reach MSCA fails and marks the status of the certificate object as "Error"
- Start the MSCA service
- Trigger a manual renewal again.
- This fails and there is no recovery. Unless the certificate object is
resetany attempts to renew this certificate results in Error
PROPOSED SOLUTION
vCert provides a mechanism to reset the certificate object so consumers can attempt to heal the situation.
CURRENT ALTERNATIVES
Currently, the only way to recover is to manually reset the certificate object in the UI and retry a renewal via API.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the vCert certificate-renewal and API entry points involved in Venafi TPP certificate objects, then compare them with the existing reset mechanism mentioned in the issue. Done means a certificate object left in Error after a downstream MSCA failure can be reset and successfully renewed through the API without manual UI recovery.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100