mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
ea86611deb
Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Only the controller, which talks ACME to Let's Encrypt.
37 lines
950 B
YAML
37 lines
950 B
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: helm-cert-manager
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
namespace: cert-manager
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
source:
|
|
repoURL: https://charts.jetstack.io
|
|
targetRevision: v1.15.5
|
|
chart: cert-manager
|
|
helm:
|
|
parameters:
|
|
- name: crds.enabled
|
|
value: 'true'
|
|
# The controller talks ACME to Let's Encrypt. Give it a trust store
|
|
# without the compromised eMudhra intermediates, see ca-bundle/.
|
|
values: |
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
selfHeal: true
|