mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
17 lines
378 B
YAML
17 lines
378 B
YAML
# The TLS certificate the Gateway serves for this app (see httproute.yaml).
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
secretName: letsencrypt-prod
|
|
dnsNames:
|
|
- ha.rubenhensen.nl
|
|
issuerRef:
|
|
group: cert-manager.io
|
|
kind: ClusterIssuer
|
|
name: prod-cluster-issuer
|
|
usages:
|
|
- digital signature
|
|
- key encipherment
|