unkin-agent
fffc14f880
why: after #417 stood up the central Let's Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net, secret wildcard-unkin-net-tls, emberstack- reflected), the remaining single-label public hosts should terminate on the real publicly-trusted leaf instead of the internal Vault-PKI CA. A *.unkin.net wildcard only matches single-label subdomains, so cluster hostnames under *.k8s.syd1.au.unkin.net stay on vault-issuer. - certificate_wildcard-unkin-net: reflect the secret into arrstack, authentik and gitea (append to both reflector namespace lists) - arrstack: point the public arrproxy gateway (arrstack.unkin.net) at wildcard-unkin-net-tls and drop its vault-issuer annotations - authentik: point the identity.unkin.net listener at wildcard-unkin-net-tls; the identity.k8s.syd1.au.unkin.net listeners keep authentik-tls, so the gateway common-name is retargeted to the cluster host - gitea: secret reflected only; git.unkin.net cutover deferred (no manifest change), same deferred pattern as fafflix
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
---
|
|
# External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
|
|
# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
|
|
# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
|
|
# external-dns, so no external-dns annotation here. Public TLS is terminated with
|
|
# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
|
|
# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
|
|
# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: external
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
name: arrproxy
|
|
namespace: arrstack
|
|
spec:
|
|
gatewayClassName: traefik-external
|
|
listeners:
|
|
- name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
hostname: arrstack.unkin.net
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
- name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
hostname: arrstack.unkin.net
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: wildcard-unkin-net-tls
|