Support and document persisting the Octavia CA

[MoteHue]

No description provided.

[MoteHue]

This would be good to backport too :)

[gemini-code-assist]

Code Review

This pull request introduces valuable documentation and scripts for managing Octavia TLS certificates. The documentation is comprehensive but could be improved with some corrections to numbering and formatting for better clarity. The accompanying shell scripts are functional but contain some issues, such as using non-standard exit codes and suppressing error outputs, which could hinder debugging. I have provided specific suggestions to address these points and enhance the overall quality and robustness of the changes.

[Alex-Welsh]

/gemini review

[Alex-Welsh]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces valuable documentation and tooling for managing Octavia TLS certificates, including backup, restore, and rotation procedures. The changes are well-structured and address an important operational need.

My review focuses on improving the security and robustness of the new shell scripts and enhancing the clarity and maintainability of the documentation. The key recommendations are:

• Refactor the shell scripts to avoid using a helper script for vault passwords, which poses a security risk. Process substitution is suggested as a more secure alternative.
• Improve error handling in the scripts by not suppressing stderr.
• Use standard exit codes in shell scripts.
• Refine the documentation to provide clearer, more secure examples and to remove duplicated content.

These changes will make the new tooling safer and the documentation easier to follow and maintain.

[Alex-Welsh]

Get Gemini'd