...

ONAP has a lot of components which enrolls certificates. :

• Legacy AAF CertMan which uses SCEP protocol or own internal Certificate Authority

...

• New CertService which uses CMPv2 to enroll certificates

...

• K8s native cert-manager which is OOM way forward to enroll certificates for ONAP components

Way forward

CertService was implemented some time back. It provides basic certificate enrollment functionality using CMPv2 over HTTP. Cause in ONAP we have a lot of components which issue certificates, it is wise to harmonize them and use forward just one of them. As a way forward, CertService should be a backend proxy service for K8s Cert-Manager. The same functionality which is currently implemented in CertService client should be implemented in Cert-Manager's external provider, except parts which are already implemented in Cert-Manager and are generic for all  providers (e.g. input parameters validation, conversion to different format, etc). Following diagram presents new setup.

...