Automatically refresh all allocator TLS certs, not just client CA cert

[adamhosier]

Is your feature request related to a problem? Please describe.
Our infrastructure takes advantage of short lifetime certificates that are automatically renewed & loaded into pods. Currently we need to restart the allocator pods whenever such a renew happens, as the allocator does not automatically refresh all certs.

It appears as if PR #1145 introduced auto-refresh of the client CA, and this feature request asks that this functionality is extended to all client & server certs in use by the allocator.

Describe the solution you'd like
The hot-reload implementation in #1145 is extended to all certs in /home/allocator/tls and /home/allocator/client-ca.

Describe alternatives you've considered

• A liveness probe on the allocator k8s config that will kill any pods with expired certs (I believe this will only work for server certs as last I checked we can't have mTLS liveness probes)
• An external service that will delete pods that are older than X days - forcing the reload.

[pooneh-m]

@adamhosier Thanks for reporting this issue. This is a valid scenario and should be addressed with the next Agones release. I agree with your recommended solution.

Out of curiosity, what technology does your infrastructure use for renewing certs?

[adamhosier]

thanks @pooneh-m, good to hear.

Out of curiosity, what technology does your infrastructure use for renewing certs?

We use Hashicorp Vault as a private CA, with their vault-agent process as a sidecar to agones, handling cert refresh.