INFRA-839 Add playbooks, config & docs for enabling Pulp tls with vault

[technowhizz]

No description provided.

[seunghun1ee]

Don't we also need to add the cert to the docker config directory? /etc/docker/certs/ I think.
If we can restart docker, this is not needed though.

Approval by mistake

[technowhizz]

Don't we also need to add the cert to the docker config directory? /etc/docker/certs/ I think. If we can restart docker, this is not needed though.

Yeah, so I think docker will use the system CA trust but you might be right about needing to restart docker for that. Also if we did need to add the CA cert to docker I realised @seunghun1ee that we have a variable in kayobe for that

stackhpc-kayobe-config/etc/kayobe/docker.yml

Line 33 in 1b04d74

#docker_registry_ca:

[Alex-Welsh]

@technowhizz what is the expiry on the certs? Do we need a note on cert rotation in the docs?

[technowhizz]

@Alex-Welsh once checks pass this should be good to go too. Unless also you want this in 2025.1

re cert rotation and length - its 1 year I believe like all the other certs. Nothing out of the ordinary, hence nothing worth mentioning. As far as rotation is concerned I think we need a note for all types not just pulp. Perhaps can be done as a follow up to this

[Alex-Welsh]

re cert rotation and length - its 1 year I believe like all the other certs

This has recently changed actually, https://github.com/stackhpc/stackhpc-kayobe-config/pull/1775/files
It's been increased to 2 years so we can switch them as part of annual upgrades

Unless also you want this in 2025.1

Yeah, if you could just rebase & change the target to 2025.1 that'd be great.