feat: use the staging lets encrypt certificate by default to prevent being rate limited

Signed-off-by: Devin Buhl <devin@buhl.casa>

kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml

@@ -57,7 +57,7 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
+        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
       resources:
         requests:
           cpu: 10m

kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml

@@ -2,4 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./certificates.yaml
+  - ./staging.yaml
+  # NOTE: Once you are able to verify the the staging certificate is valid uncomment out the
+  # certificate resource below and update the ingress-nginx helm chart with new production
+  # certificate name. This is to prevent you from getting rate-limited on configuration that might
+  # not be valid on bootstrap. No need to comment out the staging certificate they can coexist.
+  # - ./production.yaml

kubernetes/apps/networking/ingress-nginx/certificates/production.yaml

@@ -13,18 +13,3 @@ spec:
   dnsNames:
     - "${SECRET_DOMAIN}"
     - "*.${SECRET_DOMAIN}"
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: "${SECRET_DOMAIN/./-}-staging"
-  namespace: networking
-spec:
-  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer
-  commonName: "${SECRET_DOMAIN}"
-  dnsNames:
-    - "${SECRET_DOMAIN}"
-    - "*.${SECRET_DOMAIN}"

kubernetes/apps/networking/ingress-nginx/certificates/staging.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-staging"
+  namespace: networking
+spec:
+  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  commonName: "${SECRET_DOMAIN}"
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"