feat(gateway): cert provider from MinIO+Mongo (sientia-dataops)

ingestor/connection/certs.py

@@ -0,0 +1,29 @@
+from pathlib import Path
+
+COLLECTION_NAME = 'platform_certificates'
+
+
+class CertProvider:
+    """Downloads the platform's client cert + private key (Mongo metadata,
+    MinIO bytes) into a writable cache dir — pod root FS is read-only (§12),
+    so `cache_dir` must be an emptyDir/tmpfs mount."""
+
+    def __init__(self, mongo, minio, cache_dir: str, bucket: str, metadata: dict | None = None):
+        self.mongo = mongo
+        self.minio = minio
+        self.cache_dir = cache_dir
+        self.bucket = bucket
+        self.metadata = metadata or {}
+
+    async def fetch(self) -> tuple[str, str]:
+        doc = await self.mongo.find_one(COLLECTION_NAME, {}, self.metadata)
+        Path(self.cache_dir).mkdir(parents=True, exist_ok=True)
+        cert_path = await self._download(doc['client_cert']['minio_object_name'])
+        key_path = await self._download(doc['private_key']['minio_object_name'])
+        return cert_path, key_path
+
+    async def _download(self, object_name: str) -> str:
+        data = await self.minio.download_file(object_name, self.bucket, self.metadata)
+        local_path = str(Path(self.cache_dir) / Path(object_name).name)
+        Path(local_path).write_bytes(data)
+        return local_path