Use a secret manager?

Cert is a secret, add a small agent to your containers that pings your secret manager and gets back the current cert. Then saves / imports it (or whatever is appropriate).

A bit of an elaboration on why water towers are used in combination with pumps. Pumps are great for moving a constant amount of water around at whatever rate the pump is designed for (e.g. a small pump will move something like 1 gallon per minute). a big enough pump (or series of smaller pumps) can cause that pumped water to consistently flow at that rate.

The problem is that people don’t use water at a constant rate. In the morning, several residents probably all run the shower at the same time. if too many people open the water tap at the same time, a pump will give each just a fraction of what they expect.

But a water tank high up supplies water by gravity, you could open a large number of water taps, and as long as the pipes from the tank are big enough they’d all have the same pressure as if just one opened.

The water is gradually pumped up to the tank no matter if people are using it or not, then when many people want water, they all get it at expected pressures and the tank start to empty. Eventually people close the taps, the tank will slowly start to fill again from the pump.

This same basic design is also how water towers supply water to many single story buildings, it’s not a unique engineering feat for skyscrapers, but an adjustment to fit somewhere within the building’s footprint.

I’d suggest Podman over docker if someone is starting fresh. I like Podman running as rootless, but moving an existing docker to Podman was a pain. Since the initial docker setup was also a pain, I’d rather have only done it once :/

For me the use case of K8s only makes sense with large use cases (in terms of volume of traffic and users). Docker / Podman is sufficient to self-host something small.

The average number of legs per person is less than two…