unkin-agent
646b165e42
Public-facing cheeztv.unkin.net was terminating TLS with an internal Vault PKI leaf (cheeztv-tls, cluster-issuer vault-issuer), which browsers do not trust. Per-host Let's Encrypt DNS-01 for cheeztv.unkin.net fails NOTAUTH because the public zone only delegates _acme-challenge.unkin.net -> acme.unkin.net; a single *.unkin.net wildcard validates against that one CNAME and needs no per-host records. Staging issuance of *.unkin.net was verified end-to-end (~70s: Present by the recursive-nameserver controller -> Order valid -> Certificate Ready). - Add apps/base/cheeztv/certificate.yaml: cert-manager Certificate cheeztv-wildcard-tls (dnsNames *.unkin.net, ClusterIssuer letsencrypt PROD, secret cheeztv-wildcard-tls) in the cheeztv namespace. - Point the public cheeztv gateway's https listener certificateRefs at cheeztv-wildcard-tls and drop its cert-manager.io vault-issuer annotations. - Keep the cheeztv-internal gateway (cheeztv.k8s.syd1.au.unkin.net) on vault-issuer / cheeztv-internal-tls, unchanged. - Register certificate.yaml in the cheeztv kustomization.
80 lines
2.3 KiB
YAML
80 lines
2.3 KiB
YAML
---
|
|
# Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
|
|
# internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
|
|
# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
|
|
# terminated with the real Let's Encrypt *.unkin.net wildcard from
|
|
# certificate.yaml (secret cheeztv-wildcard-tls), not the Vault PKI issuer.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: internal
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
|
name: cheeztv
|
|
namespace: cheeztv
|
|
spec:
|
|
gatewayClassName: traefik-internal
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: cheeztv-wildcard-tls
|
|
mode: Terminate
|
|
---
|
|
# Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net
|
|
# gateway 1:1 (internal Traefik, external-dns at 198.18.200.4). Own cert secret
|
|
# so each hostname gets its own leaf.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: internal
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: vault-issuer
|
|
cert-manager.io/common-name: cheeztv.k8s.syd1.au.unkin.net
|
|
cert-manager.io/private-key-size: "4096"
|
|
external-dns.alpha.kubernetes.io/hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
|
name: cheeztv-internal
|
|
namespace: cheeztv
|
|
spec:
|
|
gatewayClassName: traefik-internal
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: cheeztv-internal-tls
|
|
mode: Terminate
|