Add *.main and *.ceph wildcard certificates for haproxy #484
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/argocd-apps#484
Reference in New Issue
Block a user
Delete Branch "benvin/haproxy-wildcard-certs"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The haproxy edge terminates TLS for hosts under
main.unkin.netandceph.unkin.net, which the single*.unkin.netwildcard does not cover.letsencryptClusterIssuer.haproxynamespace.Needs these records in the public unkin.net zone first:
_acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net._acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net.apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml:4, certificate_wildcard-ceph-unkin-net.yaml:4 — "CNAME in the public unkin.net zone" underspecifies the prerequisite: the rfc2136 solver resolves the CNAME via 8.8.8.8 and then runs its SOA zone lookup against the rfc2136 nameserver 198.18.199.53, which is
allow-query anybut authoritative only foracme.unkin.net(apps/base/bind-external/zones.yaml:13). A CNAME pointing anywhere other than insideacme.unkin.netfails with "could not determine the zone", CNAME present or not → state the required targets (e.g._acme-challenge.{main,ceph}.acme.unkin.net) in the comment.apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml:15-17, certificate_wildcard-ceph-unkin-net.yaml:15-17, certificate_wildcard-unkin-net.yaml:17,19 — the
haproxynamespace exists neither in this repo (noapps/base/haproxy, no overlay) nor in the cluster (kubectl get ns haproxy→ NotFound), so all three secrets reflect nowhere; and if the edge stays an LXD guest, reflection into a k8s namespace never reaches it at all → land the namespace/consumer in this PR, or drop the annotations until it does.nit: apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml:21 —
dashboard.ceph.unkin.netis currently served a separate LE leaf (CN=dashboard.ceph.unkin.net, notAfter 2026-11-06) from an issuance path outside this repo → retire it at cutover so the host is not renewed twice.