feat: backup route certificates to OpenShift secrets

[Copilot]

Routes with custom TLS certificates lose those certificates when deleted. This adds scheduled backup of route certificates to secrets.

Implementation

Backup script (cert-setup/backup_certs.sh)

• Extracts TLS certificates from routes and stores as secrets with source annotations
• Supports filtering by route name or label selector, dry-run mode
• Secure temp file handling, no eval of user data

GitHub Actions workflow (.github/workflows/backup-certs.yml)

• Reusable workflow for scheduled backups via GitHub Actions
• Configurable route filtering and secret prefix

OpenShift CronJob template (cert-setup/cronjob-template.yaml)

• In-cluster automated backups with ServiceAccount, Role, RoleBinding
• Configurable schedule (default: daily at 2 AM)

Usage

Manual backup:

# Backup all routes
./backup_certs.sh

# Backup specific route
./backup_certs.sh --route myapp-vanity

# Preview only
./backup_certs.sh --dry-run

Scheduled via GitHub Actions:

jobs:
  backup:
    uses: bcgov/quickstart-openshift-helpers/.github/workflows/[email protected]
    secrets:
      oc_token: ${{ secrets.OC_TOKEN }}
      oc_namespace: ${{ secrets.OC_NAMESPACE }}

Scheduled via OpenShift CronJob:

oc process -f cert-setup/cronjob-template.yaml | oc apply -f -

Restore from backup:

oc get secret backup-myapp-vanity-tls -o jsonpath='{.data.tls\.crt}' | base64 -d > myapp-vanity.pem
oc get secret backup-myapp-vanity-tls -o jsonpath='{.data.tls\.key}' | base64 -d > myapp-vanity.key

Backup secrets are labeled with backup.openshift.io/type=route-tls and annotated with source route, timestamp, and TLS termination type.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>feat: backup CSR and more to namespace secrets</issue_title>
<issue_description>We have existing routes with that use a variety of certs. If the route is deleted, then we can lose those certs. We should run scheduled jobs that back up those certs into OpenShift secrets.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes feat: backup CSR and more to namespace secrets #111

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.