We want to enhance the "check-certs" task so that it automatically deletes expired bbl certificates, according to the manual procedure we currently apply: https://github.com/cloudfoundry/relint-envs/tree/main#certificate-renewal.
The Concourse task could get a new parameter FILES_TO_AUTOMATICALLY_RENEW with a list of director and jumpbox vars store files, e.g.:
- environments/test/hermione/bbl-state/vars/director-vars-store.yml
- environments/test/hermione/bbl-state/vars/jumpbox-vars-store.yml
- environments/test/trelawney/bbl-state/vars/director-vars-store.yml
- environments/test/trelawney/bbl-state/vars/jumpbox-vars-store.yml
(...)
The cleaned up vars-store files would then be committed to the "relint-envs" repo. The next "update-infrastructure" job will recreate the missing certificates.