feat: use the staging lets encrypt certificate by default to prevent being rate limited

Signed-off-by: Devin Buhl <devin@buhl.casa>

kubernetes/apps/kube-system/local-path-provisioner/app/helmrelease.yaml

@@ -33,7 +33,7 @@ spec:
     nodePathMap:
       - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
         paths: ["/var/lib/rancher/k3s/storage"]
-    # Note: Do not enable Flux variable substitution on this HelmRelease
+    # NOTE: Do not enable Flux variable substitution on this HelmRelease
     configmap:
       setup: |-
         #!/bin/sh

kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml

@@ -57,7 +57,7 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
+        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
       resources:
         requests:
           cpu: 10m

kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml

@@ -2,4 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./certificates.yaml
+  - ./staging.yaml
+  # NOTE: Once you are able to verify the the staging certificate is valid uncomment out the
+  # certificate resource below and update the ingress-nginx helm chart with new production
+  # certificate name. This is to prevent you from getting rate-limited on configuration that might
+  # not be valid on bootstrap. No need to comment out the staging certificate they can coexist.
+  # - ./production.yaml

kubernetes/apps/networking/ingress-nginx/certificates/production.yaml

@@ -13,18 +13,3 @@ spec:
   dnsNames:
     - "${SECRET_DOMAIN}"
     - "*.${SECRET_DOMAIN}"
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: "${SECRET_DOMAIN/./-}-staging"
-  namespace: networking
-spec:
-  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer
-  commonName: "${SECRET_DOMAIN}"
-  dnsNames:
-    - "${SECRET_DOMAIN}"
-    - "*.${SECRET_DOMAIN}"

kubernetes/apps/networking/ingress-nginx/certificates/staging.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-staging"
+  namespace: networking
+spec:
+  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  commonName: "${SECRET_DOMAIN}"
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"

kubernetes/apps/system-upgrade/kustomization.yaml

@@ -3,4 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
+  # NOTE: Only enable system-upgrade-controller if you also update the version of k3s in the following file
+  # otherwise if you run ansible against an already provisioned cluster you might downgrade it
+  # https://github.com/onedr0p/flux-cluster-template/blob/main/ansible/inventory/group_vars/kubernetes/k3s.yml
   # - ./system-upgrade-controller/ks.yaml