mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
21 lines
709 B
YAML
21 lines
709 B
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vault-backend
|
|
spec:
|
|
provider:
|
|
vault:
|
|
# In-cluster, so syncing secrets doesn't depend on Hetzner or the home
|
|
# internet connection. Plain HTTP, like the Gateway → Vault hop.
|
|
server: "http://vault-active.vault.svc:8200"
|
|
path: "kv"
|
|
# Version is the Vault KV secret engine version.
|
|
# This can be either "v1" or "v2", defaults to "v2"
|
|
version: "v2"
|
|
auth:
|
|
# points to a secret that contains a vault token
|
|
# https://www.vaultproject.io/docs/auth/token
|
|
tokenSecretRef:
|
|
name: "vault-token"
|
|
namespace: external-secrets
|
|
key: "token" |