cluster

commit f14d6aa8ba2f803169f95e037da63ac9be6168bf
parent 9bcb8529b7097f9109cfac26d5c4169c78338f4c
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed,  1 May 2024 21:23:02 +0200

dns based certs

Diffstat:
M
apps/2024_cluster/postgres-operator-values.yaml
 | 
2
+-
M
apps/base/vaultwarden/release.yaml
 | 
2
+-
M
apps/base/victoria-metrics-k8s-stack/release.yaml
 | 
2
+-
M
clusters/2024_cluster/infrastructure.yaml
 | 
2
+-
M
infrastructure/configs/cluster-issuers.yaml
 | 
18
++++++++++++++++++

5 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/apps/2024_cluster/postgres-operator-values.yaml b/apps/2024_cluster/postgres-operator-values.yaml
@@ -34,7 +34,7 @@ spec:
       enabled: true
       annotations:
         traefik.ingress.kubernetes.io/router.middlewares: traefik-ingress-sso@kubernetescrd
-        cert-manager.io/cluster-issuer: letsencrypt-http
+        cert-manager.io/cluster-issuer: letsencrypt-dns
       hosts:
         - host: postgres-ui.midnightthoughts.space
           paths: ["/"]
diff --git a/apps/base/vaultwarden/release.yaml b/apps/base/vaultwarden/release.yaml
@@ -26,7 +26,7 @@ spec:
     ingress:
       enabled: true
       labels:
-        cert-manager.io/cluster-issuer: letsencrypt-http
+        cert-manager.io/cluster-issuer: letsencrypt-dns
       tlsSecret: vault.midnightthoughts.space-crt
       hostname: vault.midnightthoughts.space
       nginxIngressAnnotations: false
diff --git a/apps/base/victoria-metrics-k8s-stack/release.yaml b/apps/base/victoria-metrics-k8s-stack/release.yaml
@@ -717,7 +717,7 @@ spec:
             ingress:
                 enabled: true
                 annotations:
-                    cert-manager.io/cluster-issuer: letsencrypt-http
+                    cert-manager.io/cluster-issuer: letsencrypt-dns
                 hosts:
                     - grafana.midnightthoughts.space
                 tls:
diff --git a/clusters/2024_cluster/infrastructure.yaml b/clusters/2024_cluster/infrastructure.yaml
@@ -77,7 +77,7 @@ spec:
           value: https://acme-v02.api.letsencrypt.org/directory
       target:
         kind: ClusterIssuer
-        name: letsencrypt-http-gwapi
+        name: letsencrypt-dns
   decryption:
     provider: sops
     secretRef:
diff --git a/infrastructure/configs/cluster-issuers.yaml b/infrastructure/configs/cluster-issuers.yaml
@@ -16,4 +16,22 @@ spec:
             ingressClassName: traefik
             serviceType: ClusterIP
 ---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-dns
+spec:
+  acme:
+    email: info@nordgedanken.dev
+    # The server is replaced in /clusters/production/infrastructure.yaml
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-dns-account-key
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: api-token
+---
 # Fix for flux