[Jay W (JayDoubleu)]

Certificate provisioning repeatedly blocked Airlock preparation when Terraform's static-website request returned a reset connection. The failed Airlock run and certificate diagnostics showed unstable storage DNS answers after private-endpoint creation.

Description:

• Require seven consecutive private DNS and verified TLS checks before Terraform configures the storage static website.
• Probe the expected private IP with hostname verification. Check every five seconds and stop after five minutes if readiness is not established.
• Repeat the check when the endpoint, private IP or probe changes. Preserve the existing private networking and firewall scope.

Validation

CI for this PR's commit 1c68171f passed.

Check	Result	Coverage
Deployment regressions	281 passed	Includes readiness, incorrect DNS answers, TLS failures, bounded waits and replacement triggers.
Certificate bundle	Build passed	The changed bundle builds with the readiness dependency.
First live deployment	Storage step passed	At f957b6bc, readiness and static-website configuration passed. Certificate issuance then hit a separate ACME limit.
Certificate lifecycle retest	1 case passed	At c486c015, certificate deployment and cleanup passed with 23 smoke tests. This run also includes the certificate-reuse fix.

The diagnostics support a DNS readiness problem, but did not capture the failed provider connection. #5246 addresses the separate issuance limit.

Fixes #5240. Related: #5158.

[github-actions]

Unit Test Results

0 tests  ±0   0 ✅ ±0   0s ⏱️ ±0s
0 suites ±0   0 💤 ±0 
0 files   ±0   0 ❌ ±0 

Results for commit 1c68171. ± Comparison against base commit b1ba008.

♻️ This comment has been updated with latest results.

[Copilot]

🔵 Needs a closer look

The infrastructure logic is sound, but live certificate provisioning and Airlock validation remain pending.

0 open findings

What changed in this PR

Adds bounded private DNS and TLS readiness checks before certificate storage static-website configuration.

Changes:

• Requires seven consecutive private-endpoint checks within five minutes.
• Adds comprehensive readiness-script tests and CI routing.
• Bumps the certificate bundle to 0.7.14 and updates release notes.

File	Description
templates/​shared_services/​certs/​terraform/​staticweb.tf	Gates static-website configuration on endpoint readiness.
templates/​shared_services/​certs/​scripts/​wait_for_private_storage.py	Implements DNS and verified TLS checks.
templates/​shared_services/​certs/​porter.yaml	Bumps the bundle version.
devops/​tests/​test_certificate_storage_readiness.py	Tests readiness, timeout, and failure behavior.
CHANGELOG.md	Records the certificate provisioning fix.
.github/​workflows/​build_validation_develop.yml	Runs deployment-script tests for certificate changes.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Current-head checks are pending, and a complete live certificate lifecycle remains unvalidated.

0 open findings

🧠 Review effort: Balanced