knative / knative/serving

Discussion: can we drop `certificate-class` when http01 is archived

Open
#14,720 1 comment 1 reaction 0 assignees View on GitHub
triage/accepted
Dominant language
Go
Stars
6.1k
Forks
1.2k
Avg merge
2d 7h
Merged PRs (30d)
2

Description

When net-http01 is [removed](https://github.com/knative/serving/issues/14640), there is only one implementation left for `KnativeCertificate`. We currently have `certificate-class` with a default value of `cert-manager`. As there will not be a second implementation, its a bit cumbersome to handle the cert-class in various places without having a second one.

e.g:
```golang
func getCertificateClass(cm *corev1.ConfigMap) string {
// if not specified, we fall back to our default, which is cert-manager
if class, ok := cm.Data[netcfg.DefaultCertificateClassKey]; ok {
return class
}

return netcfg.CertManagerCertificateClassName
}
...
class := getCertificateClass(cm)
switch class {
case netcfg.CertManagerCertificateClassName:
return getCertManagerCA(clients)
default:
return nil, fmt.Errorf("invalid %s: %s", netcfg.DefaultCertificateClassKey, class)
}
```

Let's discuss if we want to drop it.

Contributor guide

Open the contributing guide

Research direction

Start with issue #14640 about removing net-http01, then trace references to certificate-class, getCertificateClass, and netcfg.DefaultCertificateClassKey in the Go code. Determine whether the setting can be removed consistently after archival; done requires an agreed scope and updated handling for the remaining cert-manager implementation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.