This is great news. One limitation with Lets Encrypt is their rate limits are a bit low for Review Apps - you can’t issue more than 50 certs a week under a given domain.
So if you’re spinning up tens or hundreds of review apps per day, you can’t get a fresh cert for each, and so you need to do something different than your production environment does. (A wildcard cert is the obvious choice.)
I hope this offering has a high enough quota that you can get enough certs to do review apps properly; the marginal cost to Google per customer is probably negligible, whereas LetsEncrypt doesn’t have other revenue generating offerings they can use to cover their operating costs.
Yes, they do. But if you use a wildcard cert for your review app, then you are not testing the same cert machinery as your production application. (Unless you want to use wildcard certs for your prod app too, which I'd rather not do.)
As part of my pre-merge pipeline I deploy the application to k8s, create a public IP, DNS entry from the branch slug, TLS-to-the-pod with wildcard cert, and then run the full end-to-end test suite. If you get your docker caching right, it can be as little as a couple minutes to deploy the whole stack
This makes it a lot easier for engineers to iterate on their changes with stakeholders, not to mention it lets you test infra and API changes before actually merging them.
We got to tens of engineers using this, so I didn't optimize utilization heavily; this ends up being a bit expensive, but I think worth it.
I take a nightly dump of my dev environment database, and then bake that into a thin docker image based on the MySQL image. I’m not dealing with huge datasets so this isn’t expensive. You can then start up a mysql pod and it comes up with a copy of the dev DB data.
(I also give developers a script to run this fixture DB locally too - it makes the onboarding process a lot easier if you don’t need to run the DB init and migrations, and generally means developers have a more robust set of test data to work with. )
So if you’re spinning up tens or hundreds of review apps per day, you can’t get a fresh cert for each, and so you need to do something different than your production environment does. (A wildcard cert is the obvious choice.)
I hope this offering has a high enough quota that you can get enough certs to do review apps properly; the marginal cost to Google per customer is probably negligible, whereas LetsEncrypt doesn’t have other revenue generating offerings they can use to cover their operating costs.