redpanda-data / redpanda-data/console
Feature Request: Hot reload mTLS client certificate
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 4.3k
- Forks
- 432
- Avg merge
- 3d 6h
- Merged PRs (30d)
- 40
Description
We are deploying RedPanda Console on Kubernetes connecting to a RP cluster with mTLS authentication enabled.
The Console is deployed with the RP helm chart (standalone, not as subchart of main redpanda chart) and the mTLS admin certificate is provided as a Secret mounted as file in the console pod.
We are using cert-manager to handle automatic certificate rotation, after automatic renewal due to certificate expiration the Console is not able to "talk" to RedPanda anymore, even though the TLS cert/keys are correctly updated in the pod by Kubernetes.
This results on a downtime of the console.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the Console loads the mTLS client certificate and key from the Kubernetes-mounted Secret, then check how certificate rotation is represented in the pod. Done means renewed certificate files are recognized without requiring a Console restart or causing downtime; add coverage for the rotation behavior if the existing test structure identifies a suitable entry point.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100