OPS-008: Certificate Management #159

New issue

Closed

opened 2026-04-11 05:50:31 +00:00 by Mark · 2 comments

Mark commented

2026-04-11 05:50:31 +00:00

Owner

Required

Let's Encrypt integration
Auto-renewal
Zero-downtime rotation
Wildcard certs

Acceptance Criteria

Auto-renewal works
No downtime on rotation
Certificate expiry alerts
ACME challenge handling

## Required - Let's Encrypt integration - Auto-renewal - Zero-downtime rotation - Wildcard certs ## Acceptance Criteria - [ ] Auto-renewal works - [ ] No downtime on rotation - [ ] Certificate expiry alerts - [ ] ACME challenge handling

Mark added the

feature-request

label

2026-05-12 23:26:54 +00:00

Mark added

blocked:needs-decision

and removed

feature-request

labels

2026-05-18 00:38:04 +00:00

Mark commented

2026-05-18 00:38:04 +00:00

Author

Owner

Feature Triage Assessment

Scope: medium
Risk: medium
Spec Alignment: misaligned
Summary: Adds Let's Encrypt certificate management, auto-renewal, zero-downtime rotation, and wildcard cert support to the mesh-seed deployment.
Recommendation: Delegate to deployment-layer tools (cert-manager on K8s, Traefik/Caddy reverse proxy with ACME). The mesh-seed API Gateway (Flask) should terminate TLS at the ingress/reverse-proxy layer, not in application code. Do not build cert management into mesh-seed itself.
Rationale: Medium scope because it requires a new subsystem (no existing TLS/cert infrastructure), roughly 5-15 files depending on approach, but doesn't touch core architecture paths. Medium risk because cert management is security-sensitive (private keys) and zero-downtime rotation is non-trivial, but it's additive work that doesn't break existing paths. Misaligned because all current milestones per AGENTS.md focus on completing the core mesh infrastructure-agent pipeline (INFRA-001, INFRA-005, INFRA-013, #123 semantic bidding, ARCH-003); certificate management is an operations concern orthogonal to the mesh architecture. The project already runs on K8s (helm chart exists, k8s/deployment.yaml), making cert-manager the natural solution at the ingress layer — mesh-seed application code should not own cert lifecycle.

Labeled blocked:needs-decision — unblock on Forgejo to dispatch to the fixer pipeline.

## Feature Triage Assessment **Scope:** medium **Risk:** medium **Spec Alignment:** misaligned **Summary:** Adds Let's Encrypt certificate management, auto-renewal, zero-downtime rotation, and wildcard cert support to the mesh-seed deployment. **Recommendation:** Delegate to deployment-layer tools (cert-manager on K8s, Traefik/Caddy reverse proxy with ACME). The mesh-seed API Gateway (Flask) should terminate TLS at the ingress/reverse-proxy layer, not in application code. Do not build cert management into mesh-seed itself. **Rationale:** Medium scope because it requires a new subsystem (no existing TLS/cert infrastructure), roughly 5-15 files depending on approach, but doesn't touch core architecture paths. Medium risk because cert management is security-sensitive (private keys) and zero-downtime rotation is non-trivial, but it's additive work that doesn't break existing paths. Misaligned because all current milestones per AGENTS.md focus on completing the core mesh infrastructure-agent pipeline (INFRA-001, INFRA-005, INFRA-013, #123 semantic bidding, ARCH-003); certificate management is an operations concern orthogonal to the mesh architecture. The project already runs on K8s (helm chart exists, k8s/deployment.yaml), making cert-manager the natural solution at the ingress layer — mesh-seed application code should not own cert lifecycle. Labeled `blocked:needs-decision` — unblock on Forgejo to dispatch to the fixer pipeline.

Mark removed the

blocked:needs-decision

label

2026-05-28 07:19:05 +00:00

Mark added the

triage-approved

ops-task

labels

2026-06-07 05:07:17 +00:00

Mark removed the

ops-task

label