Certificate Renewal

TLS certificates for every ingress host (console.pandur.org, sso.pandur.org, grafana.pandur.org, monitoring.pandur.org, …​) are issued and renewed automatically by cert-manager, using the letsencrypt-prod ClusterIssuer defined in security. This scenario protects [RE01 24/7 Availability] : an expired certificate would make an application unreachable.

cert-manager renewing a certificate via the ACME HTTP-01 challenge, routed through Traefik.
Figure 1. cert-manager renewing a certificate via the ACME HTTP-01 challenge, routed through Traefik.
Motivation

Every ingress-facing Helm release in this repository sets cert-manager.io/duration and cert-manager.io/renew-before annotations explicitly (e.g. Headlamp: 2160h / 336h — 3 months validity, renewed 2 weeks before expiry). Because renewal happens well ahead of expiry and retries automatically on failure, there is no manual certificate rotation step and no accepted maintenance window for it ([CP-001 No Maintenance Window ]).