<p>We have several services running in OpenShift Cluster. Each service is exposed with a route.</p>
<p>For each route we are creating a SSL Certificate. Problem is around managing Certificate expiry for these many routes</p>
<p>One way to solve this problem is to update the Cluster level cert with WildCard domain entries. We do not want to do this as this could be a security risk. Will end up using this approach if no other solution is found.</p>
<p>What are other ways to Manage these many certificates for all the services</p>
<p>How can we auto renew several certificates, any best practice around this will be helpful.</p>

user804401
<p>We use <a href="https://cert-manager.io" rel="nofollow noreferrer">cert-manager</a> to manage certificate generation and renewal. To get cert-manager to inter-operate with OpenShift routes, you need to create <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> resources that reference the generated certificates; OpenShift will transform these into appropriate Route resources.</p>
<p>I recently put together a demonstration of this that you can find <a href="https://github.com/larsks/cert-manager-routes-demo/blob/main/README.md" rel="nofollow noreferrer">here</a>. See the link for complete details, but essentially we create an Ingress resource like this:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo-server
  annotations:
    cert-manager.io/issuer: demo-issuer
spec:
  tls:
  - hosts:
      - demo-server.example.com
    secretName: demo-server-certificate
  rules:
  - host: demo-server.example.com
    http:
      paths:
      - backend:
          service:
            name: demo-server
            port:
              name: http
        path: /
        pathType: Prefix
</code></pre>
<p>Cert-manager see the <code>cert-manager.io/issuer</code> annotation, generates a certificate in the Secret named by <code>spec.tls.0.secretName</code>, and then OpenShift generates a Route in which the certificate is embedded.</p>
<p>Note that while we're using cert-manager with LetsEncrypt, that's not a requirement; cert-manager supports a number of issuers.</p>
<p>Cert-manager will take care of renewing these certificates automatically.</p>
