- Ya
- 23 Agosti 2026, 02:40 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 9adb653
A new organization needs a certificate for all eleven of its hosts, and each one is a separate cert-manager Certificate. The loop waited for each host to become Ready before applying the next spec, and rebuilt the TLSStore after every one, so the hosts came up roughly 105 seconds apart -- about twenty minutes end to end. cert-manager was always happy to run the orders concurrently; nothing here needed to serialize them. Specs are now applied in one pass and the batch is waited on together, polled with a single API call, publishing each host to the TLSStore as it lands. Most of that 105 seconds was update_tls_store() itself: it spawned openssl twice per certificate across 200+ tls secrets, on every 60s loop and again after every issuance. Expiry and SANs now come from one openssl call each, cached against the Secret's resourceVersion -- which changes whenever the certificate bytes do -- so unchanged secrets are never re-parsed. Expiry is still evaluated against the clock on every read; only the parse is cached. The ~40 unchanging skip lines each sweep printed are logged once, so the line saying which host is being issued is no longer buried. Also stop announcing a host that has never had a certificate as 'RENEW: certificate expired or expiring' -- is_k8s_cert_expired_fqdn() answers true for a missing secret, which during an outage points the investigation at a renewal problem that does not exist.