unkin-agent
d42d013541
why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits. - add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations - reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists) - point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer) Reviewed-on: #417 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
15 lines
351 B
YAML
15 lines
351 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- serviceaccount.yaml
|
|
- clusterrole.yaml
|
|
- clusterrolebinding.yaml
|
|
- clusterissuer_vault-issuer.yaml
|
|
- vmservicescrape.yaml
|
|
- clusterissuer_letsencrypt.yaml
|
|
- clusterissuer_letsencrypt-staging.yaml
|
|
- certificate_wildcard-unkin-net.yaml
|