unkin-agent
00ea8af1e1
Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted per-namespace. A single Certificate (wildcard-unkin-net) now lives in the cert-manager namespace and carries emberstack reflector source annotations via spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is auto-reflected into consumer namespaces. Future consumers are added by appending to the comma-separated reflection-*-namespaces lists. Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls secret. cheeztv-internal keeps its Vault PKI leaf.
15 lines
351 B
YAML
15 lines
351 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- serviceaccount.yaml
|
|
- clusterrole.yaml
|
|
- clusterrolebinding.yaml
|
|
- clusterissuer_vault-issuer.yaml
|
|
- vmservicescrape.yaml
|
|
- clusterissuer_letsencrypt.yaml
|
|
- clusterissuer_letsencrypt-staging.yaml
|
|
- certificate_wildcard-unkin-net.yaml
|