cert-manager agent issues a new certificate on every restart

[bitcrshr]

I found that infisical cert-manager agent issues certificates on startup every time regardless of the validity/presence of previously issued certs.

This was a bit surprising to me, as it's perfectly reasonable to restart the machine or the agent process before a certificate is ready to renew.

Example config to reproduce:

 version: v2

 infisical:
   address: "https://example.infisical.local"

 auth:
   type: "universal-auth"
   config:
     client-id: "/path/to/client-id"
     client-secret: "/path/to/client-secret"
     remove_client_secret_on_read: false

 certificates:
   - application-name: example
     profile-name: tls-server
     attributes:
       key-algorithm: EC_prime256v1
       signature-algorithm: ECDSA-SHA256
       common-name: foo.example.com
       ttl: 90d
     lifecycle:
       renew-before-expiry: 14d
       status-check-interval: "6h"
     file-output:
       private-key:
         path: "/path/to/server.key"
         permission: "0600"
       certificate:
         path: "/path/to/server.crt"
         permission: "0644"
       chain:
         path: "/path/to/chain.crt"
         permission: "0644"
         omit-root: true

CLI version: v0.43.100

[sinnwise]

Agreed, I would say that the behaviour should mimic that of certbot here:

https://eff-certbot.readthedocs.io/en/stable/using.html#renewing-certificates

The same plugin and options that were used at the time the certificate was originally issued will be used for the renewal attempt, unless you specify other plugins or options. Unlike certonly, renew acts on multiple certificates and always takes into account whether each one is near expiry. Because of this, renew is suitable (and designed) for automated use, to allow your system to automatically renew each certificate when appropriate. Since renew only renews certificates that are near expiry it can be run as frequently as you want - since it will usually take no action.