From 1f04831a9735c61b4c0566c3ef9e1f9f7c263098 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Fri, 23 Oct 2026 21:20:25 +0200 Subject: [PATCH] Replace the Ingresses with Certificate resources ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx. --- actual-budget/certificate.yaml | 16 ++++++++ actual-budget/helm-actual-budget.yaml | 17 -------- apps/templates/authentik-helm.yaml | 11 ----- apps/templates/cert-manager-helm.yaml | 2 +- apps/templates/mbgwp-official-helm.yaml | 23 ----------- argocd/certificate.yaml | 16 ++++++++ argocd/ingress.yaml | 26 ------------ argocd/kustomization.yaml | 4 +- .../overlays/argocd-cmd-params-cm.patch.yaml | 4 +- authentik/blueprint-longhorn-oidc.yaml | 3 -- authentik/certificate.yaml | 16 ++++++++ bolletjestrui/certificate.yaml | 16 ++++++++ bolletjestrui/ingress.yaml | 27 ------------ freshrss/certificate.yaml | 16 ++++++++ freshrss/ingress.yaml | 26 ------------ gatus/certificate.yaml | 16 ++++++++ gatus/ingress.yaml | 25 ----------- gatus/kustomization.yaml | 2 +- gitea/certificate.yaml | 16 ++++++++ gitea/ingress.yaml | 24 ----------- home-assistant/certificate.yaml | 16 ++++++++ home-assistant/ingress.yaml | 41 ------------------- home-assistant/service.yaml | 6 +-- immich/certificate.yaml | 16 ++++++++ immich/helm-immich.yaml | 30 -------------- longhorn/certificate.yaml | 16 ++++++++ longhorn/ingress.yaml | 40 ------------------ longhorn/kustomization.yaml | 2 +- mbgwp/certificate.yaml | 17 ++++++++ nix-infra-machine/nodes/node001.nix | 4 +- ntfy/certificate.yaml | 16 ++++++++ ntfy/ingress.yaml | 28 ------------- ntfy/kustomization.yaml | 2 +- serpbear/certificate.yaml | 16 ++++++++ serpbear/ingress.yaml | 25 ----------- vault/certificate.yaml | 16 ++++++++ vault/overrides.yaml | 11 ----- vault/secret-store.yaml | 2 +- 38 files changed, 239 insertions(+), 371 deletions(-) create mode 100644 actual-budget/certificate.yaml create mode 100644 argocd/certificate.yaml delete mode 100644 argocd/ingress.yaml create mode 100644 authentik/certificate.yaml create mode 100644 bolletjestrui/certificate.yaml delete mode 100644 bolletjestrui/ingress.yaml create mode 100644 freshrss/certificate.yaml delete mode 100644 freshrss/ingress.yaml create mode 100644 gatus/certificate.yaml delete mode 100644 gatus/ingress.yaml create mode 100644 gitea/certificate.yaml delete mode 100644 gitea/ingress.yaml create mode 100644 home-assistant/certificate.yaml delete mode 100644 home-assistant/ingress.yaml create mode 100644 immich/certificate.yaml create mode 100644 longhorn/certificate.yaml delete mode 100644 longhorn/ingress.yaml create mode 100644 mbgwp/certificate.yaml create mode 100644 ntfy/certificate.yaml delete mode 100644 ntfy/ingress.yaml create mode 100644 serpbear/certificate.yaml delete mode 100644 serpbear/ingress.yaml create mode 100644 vault/certificate.yaml diff --git a/actual-budget/certificate.yaml b/actual-budget/certificate.yaml new file mode 100644 index 0000000..c77721a --- /dev/null +++ b/actual-budget/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: actual-budget-tls +spec: + secretName: actual-budget-tls + dnsNames: + - ynab.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/actual-budget/helm-actual-budget.yaml b/actual-budget/helm-actual-budget.yaml index 00b281d..846bc80 100644 --- a/actual-budget/helm-actual-budget.yaml +++ b/actual-budget/helm-actual-budget.yaml @@ -56,23 +56,6 @@ spec: type: ClusterIP port: 5006 - # Ingress configuration - ingress: - enabled: true - className: nginx - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/proxy-body-size: 50m - hosts: - - host: ynab.rubenhensen.nl - paths: - - path: / - pathType: Prefix - tls: - - secretName: actual-budget-tls - hosts: - - ynab.rubenhensen.nl - # Persistence configuration persistence: enabled: true diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml index d252efa..11006fd 100644 --- a/apps/templates/authentik-helm.yaml +++ b/apps/templates/authentik-helm.yaml @@ -155,17 +155,6 @@ spec: - name: patched-ca-bundle mountPath: /etc/ssl/certs readOnly: true - ingress: - enabled: true - ingressClassName: nginx - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - hosts: - - authentik.rubenhensen.nl - tls: - - secretName: authentik-tls - hosts: - - authentik.rubenhensen.nl worker: volumes: - name: patched-ca-bundle diff --git a/apps/templates/cert-manager-helm.yaml b/apps/templates/cert-manager-helm.yaml index 1324493..a1535f5 100644 --- a/apps/templates/cert-manager-helm.yaml +++ b/apps/templates/cert-manager-helm.yaml @@ -22,7 +22,7 @@ spec: # without the compromised eMudhra intermediates, see ca-bundle/. values: | # Lets cert-manager solve HTTP-01 challenges with an HTTPRoute on - # the Gateway once ingress-nginx is gone. + # the Gateway, see cert-manager/prod-cluster-issuer.yaml. config: gatewayAPI: enabled: true diff --git a/apps/templates/mbgwp-official-helm.yaml b/apps/templates/mbgwp-official-helm.yaml index 87a771b..ce08aac 100644 --- a/apps/templates/mbgwp-official-helm.yaml +++ b/apps/templates/mbgwp-official-helm.yaml @@ -68,29 +68,6 @@ spec: type: ClusterIP port: 80 - # Ingress configuration - ingress: - enabled: true - className: nginx - maxBodySize: 1024m - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/proxy-body-size: 1G - hosts: - - host: scoutingmbg.nl - paths: - - path: / - pathType: Prefix - - host: www.scoutingmbg.nl - paths: - - path: / - pathType: Prefix - tls: - - secretName: scoutingmbg-nl-tls - hosts: - - scoutingmbg.nl - - www.scoutingmbg.nl - # Resource limits (matching Bitnami "small" preset) resources: requests: diff --git a/argocd/certificate.yaml b/argocd/certificate.yaml new file mode 100644 index 0000000..8cf13cc --- /dev/null +++ b/argocd/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - argocd.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/argocd/ingress.yaml b/argocd/ingress.yaml deleted file mode 100644 index f8d5921..0000000 --- a/argocd/ingress.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - # argocd-server runs with server.insecure, see overlays/ - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - namespace: argocd -spec: - ingressClassName: nginx - rules: - - host: argocd.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: http - tls: - - secretName: letsencrypt-prod - hosts: - - argocd.rubenhensen.nl diff --git a/argocd/kustomization.yaml b/argocd/kustomization.yaml index 1a9df9c..8373ff4 100644 --- a/argocd/kustomization.yaml +++ b/argocd/kustomization.yaml @@ -4,10 +4,10 @@ kind: Kustomization namespace: argocd -# additional resources like ingress rules, cluster and repository secrets. +# additional resources like the route, certificate and secrets. resources: - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.4.12/manifests/install.yaml -- ingress.yaml +- certificate.yaml - httproute.yaml - oidc-secret.yaml diff --git a/argocd/overlays/argocd-cmd-params-cm.patch.yaml b/argocd/overlays/argocd-cmd-params-cm.patch.yaml index 01ce99e..96c226f 100644 --- a/argocd/overlays/argocd-cmd-params-cm.patch.yaml +++ b/argocd/overlays/argocd-cmd-params-cm.patch.yaml @@ -6,6 +6,6 @@ metadata: app.kubernetes.io/name: argocd-cmd-params-cm app.kubernetes.io/part-of: argocd data: - # TLS ends at the ingress, so argocd-server serves plain HTTP. Needed for - # the Gateway API, which has no simple way to trust its self-signed cert. + # TLS ends at the Gateway, so argocd-server serves plain HTTP. The Gateway + # API has no simple way to trust argocd-server's self-signed cert. server.insecure: "true" diff --git a/authentik/blueprint-longhorn-oidc.yaml b/authentik/blueprint-longhorn-oidc.yaml index ffe15b8..bd56e4c 100644 --- a/authentik/blueprint-longhorn-oidc.yaml +++ b/authentik/blueprint-longhorn-oidc.yaml @@ -26,9 +26,6 @@ data: redirect_uris: - matching_mode: strict url: https://longhorn.rubenhensen.nl/oauth2/callback - # Envoy's test port until the switch from ingress-nginx - - matching_mode: strict - url: https://longhorn.rubenhensen.nl:10443/oauth2/callback signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]] property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] diff --git a/authentik/certificate.yaml b/authentik/certificate.yaml new file mode 100644 index 0000000..7646a55 --- /dev/null +++ b/authentik/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + dnsNames: + - authentik.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/bolletjestrui/certificate.yaml b/bolletjestrui/certificate.yaml new file mode 100644 index 0000000..6b96d62 --- /dev/null +++ b/bolletjestrui/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - vic.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/bolletjestrui/ingress.yaml b/bolletjestrui/ingress.yaml deleted file mode 100644 index 46af64f..0000000 --- a/bolletjestrui/ingress.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: bolletjestrui-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/ssl-passthrough: "false" - # matches the app's BODY_SIZE_LIMIT: a bulk route import posts every GPX at once - nginx.ingress.kubernetes.io/proxy-body-size: "25m" -spec: - ingressClassName: nginx - rules: - - host: vic.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: bolletjestrui - port: - number: 3000 - tls: - - secretName: letsencrypt-prod - hosts: - - vic.rubenhensen.nl diff --git a/freshrss/certificate.yaml b/freshrss/certificate.yaml new file mode 100644 index 0000000..dd820ef --- /dev/null +++ b/freshrss/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - rss.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/freshrss/ingress.yaml b/freshrss/ingress.yaml deleted file mode 100644 index 34f14d1..0000000 --- a/freshrss/ingress.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: rss-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/ssl-passthrough: "false" -spec: - ingressClassName: nginx - rules: - - host: rss.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: freshrss - port: - number: 8080 - tls: - - secretName: letsencrypt-prod - hosts: - - rss.rubenhensen.nl - diff --git a/gatus/certificate.yaml b/gatus/certificate.yaml new file mode 100644 index 0000000..49638bc --- /dev/null +++ b/gatus/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - s2.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/gatus/ingress.yaml b/gatus/ingress.yaml deleted file mode 100644 index a15e5d7..0000000 --- a/gatus/ingress.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: gatus-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/ssl-passthrough: "false" -spec: - ingressClassName: nginx - rules: - - host: s2.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: gatus - port: - number: 8080 - tls: - - secretName: letsencrypt-prod - hosts: - - s2.rubenhensen.nl diff --git a/gatus/kustomization.yaml b/gatus/kustomization.yaml index c886127..3971ead 100644 --- a/gatus/kustomization.yaml +++ b/gatus/kustomization.yaml @@ -8,7 +8,7 @@ resources: - data-persistentvolumeclaim.yaml - gatus-deployment.yaml - gatus-service.yaml - - ingress.yaml + - certificate.yaml - httproute.yaml configMapGenerator: diff --git a/gitea/certificate.yaml b/gitea/certificate.yaml new file mode 100644 index 0000000..536a8c3 --- /dev/null +++ b/gitea/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - git.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/gitea/ingress.yaml b/gitea/ingress.yaml deleted file mode 100644 index 27e787a..0000000 --- a/gitea/ingress.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: gitea-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/proxy-body-size: "1g" -spec: - ingressClassName: nginx - rules: - - host: git.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: gitea - port: - number: 3000 - tls: - - secretName: letsencrypt-prod - hosts: - - git.rubenhensen.nl diff --git a/home-assistant/certificate.yaml b/home-assistant/certificate.yaml new file mode 100644 index 0000000..e8a9de3 --- /dev/null +++ b/home-assistant/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - ha.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/home-assistant/ingress.yaml b/home-assistant/ingress.yaml deleted file mode 100644 index cfa2e8d..0000000 --- a/home-assistant/ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: home-assistant-ingress - annotations: - # nginx.ingress.kubernetes.io/rewrite-target: / - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/ssl-passthrough: "false" - # nginx.ingress.kubernetes.io/enable-cors: "true" - # type of authentication - # nginx.ingress.kubernetes.io/auth-type: basic - # name of the secret that contains the user/password definitions - # nginx.ingress.kubernetes.io/auth-secret: longhorn-basic-auth - # message to display with an appropriate context why the authentication is required - # nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required ' - - # nginx.ingress.kubernetes.io/cors-allow-origin: "http://localhost:3000/" - # nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS, DELETE" - # If you encounter a redirect loop or are getting a 307 response code - # then you need to force the nginx ingress to connect to the backend using HTTPS. - # - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - # namespace: ente-photos -spec: - ingressClassName: nginx - rules: - - host: ha.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: home-assistant-external - port: - number: 8123 - tls: - - secretName: letsencrypt-prod - hosts: - - ha.rubenhensen.nl - diff --git a/home-assistant/service.yaml b/home-assistant/service.yaml index 732a887..000417e 100644 --- a/home-assistant/service.yaml +++ b/home-assistant/service.yaml @@ -1,6 +1,6 @@ -# Home Assistant runs outside the cluster on 192.168.1.202. ingress-nginx -# 1.13 resolves an ExternalName as a DNS name and fails on a bare IP, so -# point a selector-less Service at it with a hand-written EndpointSlice. +# Home Assistant runs outside the cluster on 192.168.1.202. An ExternalName +# Service needs a DNS name, not a bare IP, so point a selector-less Service +# at it with a hand-written EndpointSlice. apiVersion: v1 kind: Service metadata: diff --git a/immich/certificate.yaml b/immich/certificate.yaml new file mode 100644 index 0000000..730c7a7 --- /dev/null +++ b/immich/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - foto.scoutingmbg.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/immich/helm-immich.yaml b/immich/helm-immich.yaml index 0c11a02..51d7497 100644 --- a/immich/helm-immich.yaml +++ b/immich/helm-immich.yaml @@ -105,36 +105,6 @@ spec: globalMounts: - path: /etc/ssl/certs readOnly: true - ingress: - main: - enabled: true - ingressClassName: nginx - annotations: - # proxy-body-size is set to 0 to remove the body limit on file uploads - nginx.ingress.kubernetes.io/proxy-body-size: "0" - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - hosts: - # - host: immich.rubenhensen.nl - # paths: - # - path: "/" - # - host: mbg.hensen.io - # paths: - # - path: "/" - # service: - # identifier: main - - host: foto.scoutingmbg.nl - paths: - - path: "/" - service: - name: sol-auth-svc - port: 8002 - tls: - - secretName: letsencrypt-prod - hosts: - # - immich.rubenhensen.nl - - mbg.hensen.io - - foto.scoutingmbg.nl machine-learning: enabled: true diff --git a/longhorn/certificate.yaml b/longhorn/certificate.yaml new file mode 100644 index 0000000..34f5844 --- /dev/null +++ b/longhorn/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - longhorn.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/longhorn/ingress.yaml b/longhorn/ingress.yaml deleted file mode 100644 index 1fa603a..0000000 --- a/longhorn/ingress.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: longhorn-ingress - annotations: - # nginx.ingress.kubernetes.io/rewrite-target: / - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/ssl-passthrough: "false" - nginx.ingress.kubernetes.io/enable-cors: "true" - # type of authentication - nginx.ingress.kubernetes.io/auth-type: basic - # name of the secret that contains the user/password definitions - nginx.ingress.kubernetes.io/auth-secret: longhorn-basic-auth - # message to display with an appropriate context why the authentication is required - nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required ' - - # nginx.ingress.kubernetes.io/cors-allow-origin: "http://localhost:3000/" - # nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS, DELETE" - # If you encounter a redirect loop or are getting a 307 response code - # then you need to force the nginx ingress to connect to the backend using HTTPS. - # - # nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - # namespace: ente-photos -spec: - ingressClassName: nginx - rules: - - host: longhorn.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: longhorn-frontend - port: - number: 80 - tls: - - secretName: letsencrypt-prod - hosts: - - longhorn.rubenhensen.nl diff --git a/longhorn/kustomization.yaml b/longhorn/kustomization.yaml index b86c55b..04420ed 100644 --- a/longhorn/kustomization.yaml +++ b/longhorn/kustomization.yaml @@ -4,7 +4,7 @@ kind: Kustomization namespace: longhorn-system resources: -- ingress.yaml +- certificate.yaml - httproute.yaml - volume-snapshot.yaml - https://github.com/kubernetes-csi/external-snapshotter/client/config/crd diff --git a/mbgwp/certificate.yaml b/mbgwp/certificate.yaml new file mode 100644 index 0000000..0d5bf87 --- /dev/null +++ b/mbgwp/certificate.yaml @@ -0,0 +1,17 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: scoutingmbg-nl-tls +spec: + secretName: scoutingmbg-nl-tls + dnsNames: + - scoutingmbg.nl + - www.scoutingmbg.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix index ce82835..7157f25 100644 --- a/nix-infra-machine/nodes/node001.nix +++ b/nix-infra-machine/nodes/node001.nix @@ -7,7 +7,7 @@ let # Hosts tunneled to the home k8s cluster. Each entry gets: # * an SNI map entry for TCP passthrough on :443 # * an HTTP vhost on :80 that reverse-proxies to the cluster - # The cluster's nginx-ingress terminates TLS with cert-manager. + # The cluster's Envoy Gateway terminates TLS with cert-manager certificates. tunneledHosts = [ "rss.rubenhensen.nl" "authentik.rubenhensen.nl" @@ -182,7 +182,7 @@ ${sniMapEntries} ''; # Port 80: tunneled hosts reverse-proxy to the home cluster so its - # nginx-ingress handles HTTP→HTTPS redirects and cert-manager + # Envoy Gateway handles HTTP→HTTPS redirects and cert-manager # HTTP-01 ACME challenges. Mail-related hosts serve ACME challenges # locally for stalwart's cert and redirect everything else to HTTPS. virtualHosts = tunneledVhosts // { diff --git a/ntfy/certificate.yaml b/ntfy/certificate.yaml new file mode 100644 index 0000000..4103070 --- /dev/null +++ b/ntfy/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - ntfy2.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/ntfy/ingress.yaml b/ntfy/ingress.yaml deleted file mode 100644 index 4ab0769..0000000 --- a/ntfy/ingress.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: ntfy-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/ssl-passthrough: "false" - # Keep subscriptions open, as in the ntfy proxy docs - nginx.ingress.kubernetes.io/proxy-read-timeout: "180" - nginx.ingress.kubernetes.io/proxy-send-timeout: "180" -spec: - ingressClassName: nginx - rules: - - host: ntfy2.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: ntfy - port: - number: 80 - tls: - - secretName: letsencrypt-prod - hosts: - - ntfy2.rubenhensen.nl diff --git a/ntfy/kustomization.yaml b/ntfy/kustomization.yaml index feb1ec8..5e5dbd0 100644 --- a/ntfy/kustomization.yaml +++ b/ntfy/kustomization.yaml @@ -8,5 +8,5 @@ resources: - data-persistentvolumeclaim.yaml - ntfy-deployment.yaml - ntfy-service.yaml - - ingress.yaml + - certificate.yaml - httproute.yaml diff --git a/serpbear/certificate.yaml b/serpbear/certificate.yaml new file mode 100644 index 0000000..6896bf6 --- /dev/null +++ b/serpbear/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - serpbear.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/serpbear/ingress.yaml b/serpbear/ingress.yaml deleted file mode 100644 index f172ed9..0000000 --- a/serpbear/ingress.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: serpbear-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/ssl-passthrough: "false" -spec: - ingressClassName: nginx - rules: - - host: serpbear.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: serpbear - port: - number: 3000 - tls: - - secretName: letsencrypt-prod - hosts: - - serpbear.rubenhensen.nl diff --git a/vault/certificate.yaml b/vault/certificate.yaml new file mode 100644 index 0000000..56e381b --- /dev/null +++ b/vault/certificate.yaml @@ -0,0 +1,16 @@ +# The TLS certificate the Gateway serves for this app (see httproute.yaml). +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: letsencrypt-prod +spec: + secretName: letsencrypt-prod + dnsNames: + - vault.rubenhensen.nl + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: prod-cluster-issuer + usages: + - digital signature + - key encipherment diff --git a/vault/overrides.yaml b/vault/overrides.yaml index ea3ebb8..95c4ef3 100644 --- a/vault/overrides.yaml +++ b/vault/overrides.yaml @@ -41,14 +41,3 @@ server: } disable_mlock = true service_registration "kubernetes" {} - ingress: - enabled: true - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - ingressClassName: nginx - tls: - - secretName: letsencrypt-prod - hosts: - - vault.rubenhensen.nl - hosts: - - host: "vault.rubenhensen.nl" diff --git a/vault/secret-store.yaml b/vault/secret-store.yaml index f2a15cb..be8241c 100644 --- a/vault/secret-store.yaml +++ b/vault/secret-store.yaml @@ -6,7 +6,7 @@ spec: provider: vault: # In-cluster, so syncing secrets doesn't depend on Hetzner or the home - # internet connection. Plain HTTP, like the ingress → Vault hop. + # internet connection. Plain HTTP, like the Gateway → Vault hop. server: "http://vault-active.vault.svc:8200" path: "kv" # Version is the Vault KV secret engine version.