Nobody has ever seen a certificate renew on the Envoy gatewayHTTPRoute path. Every gateway cert in both clusters is a first issuance.
Sandbox's certs expire 2026-08-16, so cert-manager starts renewing them around 2026-07-17 — three days out. That makes sandbox a free canary for live, whose renewals don't land until October.
This matters because live just had nine certs expire silently (cfp-live-cluster#144) — the failure mode is quiet by default, and if the renewal path has a flaw we want to find it here, in sandbox, in July, not in live in October.
Check on ~2026-07-17
export KUBECONFIG=~/.kube/cfp-sandbox-cluster-kubeconfig.yaml
kubectl get certificate -A # notAfter should move to ~Nov
kubectl get challenges -A # should be empty; anything pending >1h is a problem
If a Challenge sits pending, or a Certificate sticks on Issuing, treat it as urgent — it's the same class of silent failure that took out live.
Nobody has ever seen a certificate renew on the Envoy
gatewayHTTPRoutepath. Every gateway cert in both clusters is a first issuance.Sandbox's certs expire 2026-08-16, so cert-manager starts renewing them around 2026-07-17 — three days out. That makes sandbox a free canary for live, whose renewals don't land until October.
This matters because live just had nine certs expire silently (cfp-live-cluster#144) — the failure mode is quiet by default, and if the renewal path has a flaw we want to find it here, in sandbox, in July, not in live in October.
Check on ~2026-07-17
If a Challenge sits
pending, or a Certificate sticks onIssuing, treat it as urgent — it's the same class of silent failure that took out live.