<p>I am currently struggeling with the following tasks. I don't want to include my TLS certificates in my templates because</p>

<ol>
<li><p>I don't want to check in credentials in code management while still checking in the templates</p></li>
<li><p>I am using multiple Applications with the same Certificate and I don't want to update repos just because I might distribute another certificate</p></li>
</ol>

<p>Now my approach is this. I am using Jenkins for my build pipelines. I have a Repo that is used just for certificate management. It will run when updated and distribute the certificate and private key to Openshift Secrets on various clusters.</p>

<p>When running the Template of an application I am retrieving the Information from the secret and setting the values in the route. And here's where things get tricky. I can only use single line values because</p>

<ol>
<li>Openshift templates will not accept multiline parameters with oc process</li>
<li>Secrets will not store multiline values</li>
</ol>

<p>So the solution seemed to be easy. Just store the Certificate with \n and set it in the Route like this. However Openshift will not accept single line certificates resulting in the error</p>

<blockquote>
  <p>spec.tls.key: Invalid value: "redacted key data": tls: found a certificate rather than a key in the PEM for the private key</p>
</blockquote>

<p>Now the solution could be to insert the Certificate as multiple lines directly in the template file before processing and applying it to the cluster but that seems a little bit hacky to me. So my Question is</p>

<p>How can you centrally manage TLS Certificates for your applications and set them correclty in the Templates you're applying?</p>

relief.melone
<p>Secrets can be multiple lines. You can create a secret using a certificate file, and mount that secret as a file into your containers. See here for how to create secrets from files:</p>

<p><a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/configuration/secret/</a></p>

<p>Use the openshift command line tool instead of kubectl.</p>

<p>For certificates, there is something called cert-manager:</p>

<p><a href="https://docs.cert-manager.io/en/latest/" rel="nofollow noreferrer">https://docs.cert-manager.io/en/latest/</a></p>

<p>This will generate certs as needed. You might want to take a look.</p>
