Replace the Ingresses with Certificate resources

ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces.

immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver.

Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.

actual-budget/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: actual-budget-tls
+spec:
+  secretName: actual-budget-tls
+  dnsNames:
+  - ynab.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

actual-budget/helm-actual-budget.yaml

@@ -56,23 +56,6 @@ spec:
           type: ClusterIP
           port: 5006
 
-        # Ingress configuration
-        ingress:
-          enabled: true
-          className: nginx
-          annotations:
-            cert-manager.io/cluster-issuer: prod-cluster-issuer
-            nginx.ingress.kubernetes.io/proxy-body-size: 50m
-          hosts:
-            - host: ynab.rubenhensen.nl
-              paths:
-                - path: /
-                  pathType: Prefix
-          tls:
-            - secretName: actual-budget-tls
-              hosts:
-                - ynab.rubenhensen.nl
-
         # Persistence configuration
         persistence:
           enabled: true

apps/templates/authentik-helm.yaml

@@ -155,17 +155,6 @@ spec:
               - name: patched-ca-bundle
                 mountPath: /etc/ssl/certs
                 readOnly: true
-            ingress:
-              enabled: true
-              ingressClassName: nginx
-              annotations:
-                cert-manager.io/cluster-issuer: prod-cluster-issuer
-              hosts:
-                - authentik.rubenhensen.nl
-              tls:
-                - secretName: authentik-tls
-                  hosts:
-                    - authentik.rubenhensen.nl
           worker:
             volumes:
               - name: patched-ca-bundle

apps/templates/cert-manager-helm.yaml

@@ -22,7 +22,7 @@ spec:
       # without the compromised eMudhra intermediates, see ca-bundle/.
       values: |
         # Lets cert-manager solve HTTP-01 challenges with an HTTPRoute on
-        # the Gateway once ingress-nginx is gone.
+        # the Gateway, see cert-manager/prod-cluster-issuer.yaml.
         config:
           gatewayAPI:
             enabled: true

apps/templates/mbgwp-official-helm.yaml

@@ -68,29 +68,6 @@ spec:
           type: ClusterIP
           port: 80
 
-        # Ingress configuration
-        ingress:
-          enabled: true
-          className: nginx
-          maxBodySize: 1024m
-          annotations:
-            cert-manager.io/cluster-issuer: prod-cluster-issuer
-            nginx.ingress.kubernetes.io/proxy-body-size: 1G
-          hosts:
-            - host: scoutingmbg.nl
-              paths:
-                - path: /
-                  pathType: Prefix
-            - host: www.scoutingmbg.nl
-              paths:
-                - path: /
-                  pathType: Prefix
-          tls:
-            - secretName: scoutingmbg-nl-tls
-              hosts:
-                - scoutingmbg.nl
-                - www.scoutingmbg.nl
-
         # Resource limits (matching Bitnami "small" preset)
         resources:
           requests:

argocd/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - argocd.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

argocd/ingress.yaml

@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: argocd-server-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    # argocd-server runs with server.insecure, see overlays/
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-  namespace: argocd
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: argocd.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: argocd-server
-            port:
-              name: http
-  tls:
-    - secretName:  letsencrypt-prod
-      hosts:
-        - argocd.rubenhensen.nl

argocd/kustomization.yaml

@@ -4,10 +4,10 @@ kind: Kustomization
 namespace: argocd
 
 
-# additional resources like ingress rules, cluster and repository secrets.
+# additional resources like the route, certificate and secrets.
 resources:
 - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.4.12/manifests/install.yaml
-- ingress.yaml
+- certificate.yaml
 - httproute.yaml
 - oidc-secret.yaml
 

argocd/overlays/argocd-cmd-params-cm.patch.yaml

@@ -6,6 +6,6 @@ metadata:
     app.kubernetes.io/name: argocd-cmd-params-cm
     app.kubernetes.io/part-of: argocd
 data:
-  # TLS ends at the ingress, so argocd-server serves plain HTTP. Needed for
-  # the Gateway API, which has no simple way to trust its self-signed cert.
+  # TLS ends at the Gateway, so argocd-server serves plain HTTP. The Gateway
+  # API has no simple way to trust argocd-server's self-signed cert.
   server.insecure: "true"

authentik/blueprint-longhorn-oidc.yaml

@@ -26,9 +26,6 @@ data:
           redirect_uris:
             - matching_mode: strict
               url: https://longhorn.rubenhensen.nl/oauth2/callback
-            # Envoy's test port until the switch from ingress-nginx
-            - matching_mode: strict
-              url: https://longhorn.rubenhensen.nl:10443/oauth2/callback
           signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
           property_mappings:
             - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]

authentik/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: authentik-tls
+spec:
+  secretName: authentik-tls
+  dnsNames:
+  - authentik.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

bolletjestrui/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - vic.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

bolletjestrui/ingress.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: bolletjestrui-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    # matches the app's BODY_SIZE_LIMIT: a bulk route import posts every GPX at once
-    nginx.ingress.kubernetes.io/proxy-body-size: "25m"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: vic.rubenhensen.nl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: bolletjestrui
-                port:
-                  number: 3000
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - vic.rubenhensen.nl

freshrss/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - rss.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

freshrss/ingress.yaml

@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rss-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: rss.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: freshrss
-            port:
-              number: 8080
-  tls:
-    - secretName:  letsencrypt-prod
-      hosts:
-        - rss.rubenhensen.nl
-

gatus/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - s2.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

gatus/ingress.yaml

@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gatus-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: s2.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: gatus
-            port:
-              number: 8080
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - s2.rubenhensen.nl

gatus/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
   - data-persistentvolumeclaim.yaml
   - gatus-deployment.yaml
   - gatus-service.yaml
-  - ingress.yaml
+  - certificate.yaml
   - httproute.yaml
 
 configMapGenerator:

gitea/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - git.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

gitea/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/proxy-body-size: "1g"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: git.rubenhensen.nl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gitea
-                port:
-                  number: 3000
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - git.rubenhensen.nl

home-assistant/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - ha.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

home-assistant/ingress.yaml

@@ -1,41 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: home-assistant-ingress
-  annotations:
-    # nginx.ingress.kubernetes.io/rewrite-target: /
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    # nginx.ingress.kubernetes.io/enable-cors: "true"
-    # type of authentication
-    # nginx.ingress.kubernetes.io/auth-type: basic
-    # name of the secret that contains the user/password definitions
-    # nginx.ingress.kubernetes.io/auth-secret: longhorn-basic-auth
-    # message to display with an appropriate context why the authentication is required
-    # nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required '
-    
-    # nginx.ingress.kubernetes.io/cors-allow-origin: "http://localhost:3000/"
-    # nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS, DELETE"
-    # If you encounter a redirect loop or are getting a 307 response code
-    # then you need to force the nginx ingress to connect to the backend using HTTPS.
-    #
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-  # namespace: ente-photos
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: ha.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: home-assistant-external
-            port:
-              number: 8123
-  tls:
-    - secretName:  letsencrypt-prod
-      hosts:
-        - ha.rubenhensen.nl
-

home-assistant/service.yaml

@@ -1,6 +1,6 @@
-# Home Assistant runs outside the cluster on 192.168.1.202. ingress-nginx
-# 1.13 resolves an ExternalName as a DNS name and fails on a bare IP, so
-# point a selector-less Service at it with a hand-written EndpointSlice.
+# Home Assistant runs outside the cluster on 192.168.1.202. An ExternalName
+# Service needs a DNS name, not a bare IP, so point a selector-less Service
+# at it with a hand-written EndpointSlice.
 apiVersion: v1
 kind: Service
 metadata:

immich/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - foto.scoutingmbg.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

immich/helm-immich.yaml

@@ -105,36 +105,6 @@ spec:
                 globalMounts:
                   - path: /etc/ssl/certs
                     readOnly: true
-            ingress:
-              main:
-                enabled: true
-                ingressClassName: nginx
-                annotations:
-                  # proxy-body-size is set to 0 to remove the body limit on file uploads
-                  nginx.ingress.kubernetes.io/proxy-body-size: "0"
-                  cert-manager.io/cluster-issuer: prod-cluster-issuer
-                  nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-                hosts:
-                  # - host: immich.rubenhensen.nl
-                  #   paths:
-                  #     - path: "/"
-                  # - host: mbg.hensen.io
-                  #   paths:
-                  #     - path: "/"
-                  #       service:
-                  #         identifier: main
-                  - host: foto.scoutingmbg.nl
-                    paths:
-                      - path: "/"
-                        service:
-                          name: sol-auth-svc
-                          port: 8002
-                tls:
-                  - secretName:  letsencrypt-prod
-                    hosts:
-                      # - immich.rubenhensen.nl
-                      - mbg.hensen.io
-                      - foto.scoutingmbg.nl
 
           machine-learning:
             enabled: true

longhorn/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - longhorn.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

longhorn/ingress.yaml

@@ -1,40 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: longhorn-ingress
-  annotations:
-    # nginx.ingress.kubernetes.io/rewrite-target: /
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    # type of authentication
-    nginx.ingress.kubernetes.io/auth-type: basic
-    # name of the secret that contains the user/password definitions
-    nginx.ingress.kubernetes.io/auth-secret: longhorn-basic-auth
-    # message to display with an appropriate context why the authentication is required
-    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required '
-    
-    # nginx.ingress.kubernetes.io/cors-allow-origin: "http://localhost:3000/"
-    # nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS, DELETE"
-    # If you encounter a redirect loop or are getting a 307 response code
-    # then you need to force the nginx ingress to connect to the backend using HTTPS.
-    #
-    # nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-  # namespace: ente-photos
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: longhorn.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: longhorn-frontend
-            port:
-              number: 80
-  tls:
-    - secretName:  letsencrypt-prod
-      hosts:
-        - longhorn.rubenhensen.nl

longhorn/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 namespace: longhorn-system
 
 resources:
-- ingress.yaml
+- certificate.yaml
 - httproute.yaml
 - volume-snapshot.yaml
 - https://github.com/kubernetes-csi/external-snapshotter/client/config/crd

mbgwp/certificate.yaml

@@ -0,0 +1,17 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: scoutingmbg-nl-tls
+spec:
+  secretName: scoutingmbg-nl-tls
+  dnsNames:
+  - scoutingmbg.nl
+  - www.scoutingmbg.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

nix-infra-machine/nodes/node001.nix

@@ -7,7 +7,7 @@ let
   # Hosts tunneled to the home k8s cluster. Each entry gets:
   #   * an SNI map entry for TCP passthrough on :443
   #   * an HTTP vhost on :80 that reverse-proxies to the cluster
-  # The cluster's nginx-ingress terminates TLS with cert-manager.
+  # The cluster's Envoy Gateway terminates TLS with cert-manager certificates.
   tunneledHosts = [
     "rss.rubenhensen.nl"
     "authentik.rubenhensen.nl"
@@ -182,7 +182,7 @@ ${sniMapEntries}
     '';
 
     # Port 80: tunneled hosts reverse-proxy to the home cluster so its
-    # nginx-ingress handles HTTP→HTTPS redirects and cert-manager
+    # Envoy Gateway handles HTTP→HTTPS redirects and cert-manager
     # HTTP-01 ACME challenges. Mail-related hosts serve ACME challenges
     # locally for stalwart's cert and redirect everything else to HTTPS.
     virtualHosts = tunneledVhosts // {

ntfy/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - ntfy2.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

ntfy/ingress.yaml

@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ntfy-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    # Keep subscriptions open, as in the ntfy proxy docs
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "180"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "180"
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: ntfy2.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: ntfy
-            port:
-              number: 80
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - ntfy2.rubenhensen.nl

ntfy/kustomization.yaml

@@ -8,5 +8,5 @@ resources:
   - data-persistentvolumeclaim.yaml
   - ntfy-deployment.yaml
   - ntfy-service.yaml
-  - ingress.yaml
+  - certificate.yaml
   - httproute.yaml

serpbear/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - serpbear.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

serpbear/ingress.yaml

@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: serpbear-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: serpbear.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: serpbear
-            port:
-              number: 3000
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - serpbear.rubenhensen.nl

vault/certificate.yaml

@@ -0,0 +1,16 @@
+# The TLS certificate the Gateway serves for this app (see httproute.yaml).
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: letsencrypt-prod
+spec:
+  secretName: letsencrypt-prod
+  dnsNames:
+  - vault.rubenhensen.nl
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: prod-cluster-issuer
+  usages:
+  - digital signature
+  - key encipherment

vault/overrides.yaml

@@ -41,14 +41,3 @@ server:
             }
             disable_mlock = true
             service_registration "kubernetes" {}
-   ingress:
-      enabled: true
-      annotations:
-        cert-manager.io/cluster-issuer: prod-cluster-issuer
-      ingressClassName: nginx
-      tls:
-          - secretName: letsencrypt-prod
-            hosts:
-              - vault.rubenhensen.nl
-      hosts:
-        - host: "vault.rubenhensen.nl"

vault/secret-store.yaml

@@ -6,7 +6,7 @@ spec:
   provider:
     vault:
       # In-cluster, so syncing secrets doesn't depend on Hetzner or the home
-      # internet connection. Plain HTTP, like the ingress → Vault hop.
+      # internet connection. Plain HTTP, like the Gateway → Vault hop.
       server: "http://vault-active.vault.svc:8200"
       path: "kv"
       # Version is the Vault KV secret engine version.