unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard #417

Merged
benvin merged 2 commits from benvin/cheeztv-le-wildcard into main 2026-08-25 20:58:03 +10:00
Conversation 2 Commits 2 Files Changed 3
+34 -6
unkin-agent commented 2026-08-25 20:43:41 +10:00
Member
Copy Link
Copy Source

why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits.

  • add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations
  • reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists)
  • point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer)
why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits. - add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations - reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists) - point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer)
unkin-agent added 1 commit 2026-08-25 20:43:42 +10:00
cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
646b165e42 
Public-facing cheeztv.unkin.net was terminating TLS with an internal Vault PKI
leaf (cheeztv-tls, cluster-issuer vault-issuer), which browsers do not trust.
Per-host Let's Encrypt DNS-01 for cheeztv.unkin.net fails NOTAUTH because the
public zone only delegates _acme-challenge.unkin.net -> acme.unkin.net; a single
*.unkin.net wildcard validates against that one CNAME and needs no per-host
records. Staging issuance of *.unkin.net was verified end-to-end (~70s: Present
by the recursive-nameserver controller -> Order valid -> Certificate Ready).

- Add apps/base/cheeztv/certificate.yaml: cert-manager Certificate
  cheeztv-wildcard-tls (dnsNames *.unkin.net, ClusterIssuer letsencrypt PROD,
  secret cheeztv-wildcard-tls) in the cheeztv namespace.
- Point the public cheeztv gateway's https listener certificateRefs at
  cheeztv-wildcard-tls and drop its cert-manager.io vault-issuer annotations.
- Keep the cheeztv-internal gateway (cheeztv.k8s.syd1.au.unkin.net) on
  vault-issuer / cheeztv-internal-tls, unchanged.
- Register certificate.yaml in the cheeztv kustomization.
unkin-agent added 1 commit 2026-08-25 20:54:27 +10:00
cheeztv: manage the LE *.unkin.net wildcard centrally, reflect into cheeztv
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
00ea8af1e1 
Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted
per-namespace. A single Certificate (wildcard-unkin-net) now lives in the
cert-manager namespace and carries emberstack reflector source annotations via
spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is
auto-reflected into consumer namespaces. Future consumers are added by
appending to the comma-separated reflection-*-namespaces lists.

Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point
the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls
secret. cheeztv-internal keeps its Vault PKI leaf.
unkin-agent commented 2026-08-25 20:54:34 +10:00
Author
Member
Copy Link
Copy Source

Reworked per review: the .unkin.net LE wildcard is now a single centrally-managed Certificate (wildcard-unkin-net) in the cert-manager namespace, carrying emberstack reflector source annotations via spec.secretTemplate.annotations so its secret is auto-reflected into cheeztv (append future consumers to the comma-separated reflection--namespaces lists). Dropped the per-namespace cheeztv Certificate and pointed the public cheeztv gateway listener at the reflected wildcard-unkin-net-tls.

Reworked per review: the *.unkin.net LE wildcard is now a single centrally-managed Certificate (wildcard-unkin-net) in the cert-manager namespace, carrying emberstack reflector source annotations via spec.secretTemplate.annotations so its secret is auto-reflected into cheeztv (append future consumers to the comma-separated reflection-*-namespaces lists). Dropped the per-namespace cheeztv Certificate and pointed the public cheeztv gateway listener at the reflected wildcard-unkin-net-tls.
unkin-agent commented 2026-08-25 20:57:16 +10:00
Author
Member
Copy Link
Copy Source

Re-review of 00ea8af: the rework matches the requested centrally-managed design.

Verified against the diff/repo tree at head:

  • apps/base/cert-manager/certificate_wildcard-unkin-net.yaml — Certificate wildcard-unkin-net in ns cert-manager, dnsNames: ["*.unkin.net"], issuerRef ClusterIssuer letsencrypt (confirmed PROD: acme-v02.api.letsencrypt.org, not staging), secretName: wildcard-unkin-net-tls.
  • secretTemplate.annotations reflector keys are spelled correctly per the emberstack convention: reflection-allowed, reflection-allowed-namespaces, reflection-auto-enabled, reflection-auto-namespaces, all scoped to cheeztv.
  • Registered in apps/base/cert-manager/kustomization.yaml.
  • apps/base/cheeztv/certificate.yaml and its kustomization entry are gone (net no-op vs main, confirmed via contents API at head — 404 on the file, kustomization has no reference).
  • Public cheeztv gateway listener now points certificateRefs at wildcard-unkin-net-tls; the cheeztv-internal gateway is untouched, still on vault-issuer/cheeztv-internal-tls.
  • Repo-wide grep confirms exactly one *.unkin.net dnsName and exactly one Certificate on ClusterIssuer letsencrypt (prod) — no stray per-namespace prod wildcard order remains.
  • CI green on 00ea8af: kubeconform, pre-commit, vector-test all success.

One non-blocking nit: the PR body (Why/How) still describes the old, abandoned design — a per-namespace cheeztv-wildcard-tls Certificate living in apps/base/cheeztv/certificate.yaml, which no longer exists. Only the comment thread documents the actual rework. Since this repo's default merge style is squash, the PR title+body becomes the permanent commit message — worth updating the body to match the shipped centrally-managed design before merge so git history doesn't record the wrong approach.

Re-review of 00ea8af: the rework matches the requested centrally-managed design. Verified against the diff/repo tree at head: - `apps/base/cert-manager/certificate_wildcard-unkin-net.yaml` — Certificate `wildcard-unkin-net` in ns `cert-manager`, `dnsNames: ["*.unkin.net"]`, `issuerRef` ClusterIssuer `letsencrypt` (confirmed PROD: `acme-v02.api.letsencrypt.org`, not staging), `secretName: wildcard-unkin-net-tls`. - `secretTemplate.annotations` reflector keys are spelled correctly per the emberstack convention: `reflection-allowed`, `reflection-allowed-namespaces`, `reflection-auto-enabled`, `reflection-auto-namespaces`, all scoped to `cheeztv`. - Registered in `apps/base/cert-manager/kustomization.yaml`. - `apps/base/cheeztv/certificate.yaml` and its kustomization entry are gone (net no-op vs `main`, confirmed via `contents` API at head — 404 on the file, kustomization has no reference). - Public `cheeztv` gateway listener now points `certificateRefs` at `wildcard-unkin-net-tls`; the `cheeztv-internal` gateway is untouched, still on `vault-issuer`/`cheeztv-internal-tls`. - Repo-wide grep confirms exactly one `*.unkin.net` dnsName and exactly one Certificate on ClusterIssuer `letsencrypt` (prod) — no stray per-namespace prod wildcard order remains. - CI green on 00ea8af: kubeconform, pre-commit, vector-test all success. One non-blocking nit: the PR **body** (Why/How) still describes the old, abandoned design — a per-namespace `cheeztv-wildcard-tls` Certificate living in `apps/base/cheeztv/certificate.yaml`, which no longer exists. Only the comment thread documents the actual rework. Since this repo's default merge style is squash, the PR title+body becomes the permanent commit message — worth updating the body to match the shipped centrally-managed design before merge so git history doesn't record the wrong approach.
benvin merged commit d42d013541 into main 2026-08-25 20:58:03 +10:00
benvin deleted branch benvin/cheeztv-le-wildcard 2026-08-25 20:58:03 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#417
Delete Branch "benvin/cheeztv-le-wildcard"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?