unkin-agent
646b165e42
Public-facing cheeztv.unkin.net was terminating TLS with an internal Vault PKI leaf (cheeztv-tls, cluster-issuer vault-issuer), which browsers do not trust. Per-host Let's Encrypt DNS-01 for cheeztv.unkin.net fails NOTAUTH because the public zone only delegates _acme-challenge.unkin.net -> acme.unkin.net; a single *.unkin.net wildcard validates against that one CNAME and needs no per-host records. Staging issuance of *.unkin.net was verified end-to-end (~70s: Present by the recursive-nameserver controller -> Order valid -> Certificate Ready). - Add apps/base/cheeztv/certificate.yaml: cert-manager Certificate cheeztv-wildcard-tls (dnsNames *.unkin.net, ClusterIssuer letsencrypt PROD, secret cheeztv-wildcard-tls) in the cheeztv namespace. - Point the public cheeztv gateway's https listener certificateRefs at cheeztv-wildcard-tls and drop its cert-manager.io vault-issuer annotations. - Keep the cheeztv-internal gateway (cheeztv.k8s.syd1.au.unkin.net) on vault-issuer / cheeztv-internal-tls, unchanged. - Register certificate.yaml in the cheeztv kustomization.
28 lines
540 B
YAML
28 lines
540 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_pooler.yaml
|
|
- cnpg_backup.yaml
|
|
- cephrgw-config-backup.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|
|
- schedule.yaml
|
|
- pvc-config.yaml
|
|
- pvc-transcode.yaml
|
|
- pv-media-tv.yaml
|
|
- pv-media-movies.yaml
|
|
- pvc-media-tv.yaml
|
|
- pvc-media-movies.yaml
|
|
- statefulset.yaml
|
|
- pdb.yaml
|
|
- service.yaml
|
|
- valkey.yaml
|
|
- vmpodscrape.yaml
|
|
- certificate.yaml
|
|
- gateway.yaml
|
|
- httproute.yaml
|