mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: helm-cert-manager
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
namespace: cert-manager
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
source:
|
|
repoURL: https://charts.jetstack.io
|
|
targetRevision: v1.21.2
|
|
chart: cert-manager
|
|
helm:
|
|
parameters:
|
|
- name: crds.enabled
|
|
value: 'true'
|
|
# The controller talks ACME to Let's Encrypt. Give it a trust store
|
|
# without the compromised eMudhra intermediates, see ca-bundle/.
|
|
values: |
|
|
# Lets cert-manager solve HTTP-01 challenges with an HTTPRoute on
|
|
# the Gateway, see cert-manager/prod-cluster-issuer.yaml.
|
|
config:
|
|
gatewayAPI:
|
|
enabled: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
selfHeal: true
|