unkin-agent
00ea8af1e1
Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted per-namespace. A single Certificate (wildcard-unkin-net) now lives in the cert-manager namespace and carries emberstack reflector source annotations via spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is auto-reflected into consumer namespaces. Future consumers are added by appending to the comma-separated reflection-*-namespaces lists. Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls secret. cheeztv-internal keeps its Vault PKI leaf.
82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
---
|
|
# Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
|
|
# internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
|
|
# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
|
|
# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
|
|
# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
|
|
# reflected into this namespace by the emberstack reflector as the secret
|
|
# wildcard-unkin-net-tls, not the Vault PKI issuer.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: internal
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
|
name: cheeztv
|
|
namespace: cheeztv
|
|
spec:
|
|
gatewayClassName: traefik-internal
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: wildcard-unkin-net-tls
|
|
mode: Terminate
|
|
---
|
|
# Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net
|
|
# gateway 1:1 (internal Traefik, external-dns at 198.18.200.4). Own cert secret
|
|
# so each hostname gets its own leaf.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: internal
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: vault-issuer
|
|
cert-manager.io/common-name: cheeztv.k8s.syd1.au.unkin.net
|
|
cert-manager.io/private-key-size: "4096"
|
|
external-dns.alpha.kubernetes.io/hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
|
name: cheeztv-internal
|
|
namespace: cheeztv
|
|
spec:
|
|
gatewayClassName: traefik-internal
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: cheeztv-internal-tls
|
|
mode: Terminate
|