From c56f1bc481efa597093069483d177993c86d14c3 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Tue, 17 May 2022 18:20:34 -0400 Subject: [PATCH] feat(cluster): use LE staging env for initial setup Signed-off-by: Devin Buhl --- README.md | 8 +++++++- cluster/apps/default/echo-server/helm-release.yaml | 2 +- cluster/apps/default/hajimari/helm-release.yaml | 2 +- cluster/apps/networking/traefik/dashboard/ingress.yaml | 2 +- tmpl/cluster/flux-system/webhooks/github/ingress.yaml | 2 +- 5 files changed, 11 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 7baeed53..7c871b05 100644 --- a/README.md +++ b/README.md @@ -195,7 +195,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y 📍 Nodes are not security hardened by default, you can do this with [dev-sec/ansible-collection-hardening](https://github.com/dev-sec/ansible-collection-hardening) or similar if it supports Ubuntu 22.04. -1. Ensure you are able to SSH into your nodes from your workstation using your private ssh key. This is how Ansible is able to connect to your remote nodes. +1. Ensure you are able to SSH into your nodes from your workstation using a private SSH key **without a passphrase**. This is how Ansible is able to connect to your remote nodes. [How to configure SSH key-based authentication](https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server) @@ -419,6 +419,12 @@ To access services from the outside world port forwarded `80` and `443` in your Now if nothing is working, that is expected. This is DNS after all! +### 🔐 SSL + +By default in this template Kubernetes ingresses are set to use the [Let's Encrypt Staging Environment](https://letsencrypt.org/docs/staging-environment/). This will hopefully reduce issues from ACME on requesting certificates until you are ready to use this in "Production". + +Once you have confirmed there are no issues requesting your certificates replace `letsencrypt-staging` with `letsencrypt-production` in your ingress annotations for `cert-manager.io/cluster-issuer` + ### 🤖 Renovatebot [Renovatebot](https://www.whitesourcesoftware.com/free-developer-tools/renovate/) will scan your repository and offer PRs when it finds dependencies out of date. Common dependencies it will discover and update are Flux, Ansible Galaxy Roles, Terraform Providers, Kubernetes Helm Charts, Kubernetes Container Images, Pre-commit hooks updates, and more! diff --git a/cluster/apps/default/echo-server/helm-release.yaml b/cluster/apps/default/echo-server/helm-release.yaml index 14b9256c..0ea274cf 100644 --- a/cluster/apps/default/echo-server/helm-release.yaml +++ b/cluster/apps/default/echo-server/helm-release.yaml @@ -28,7 +28,7 @@ spec: enabled: true ingressClassName: "traefik" annotations: - cert-manager.io/cluster-issuer: "letsencrypt-production" + cert-manager.io/cluster-issuer: "letsencrypt-staging" external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" external-dns/is-public: "true" hajimari.io/enable: "true" diff --git a/cluster/apps/default/hajimari/helm-release.yaml b/cluster/apps/default/hajimari/helm-release.yaml index 665dddb9..0cb241d0 100644 --- a/cluster/apps/default/hajimari/helm-release.yaml +++ b/cluster/apps/default/hajimari/helm-release.yaml @@ -107,7 +107,7 @@ spec: enabled: true ingressClassName: "traefik" annotations: - cert-manager.io/cluster-issuer: "letsencrypt-production" + cert-manager.io/cluster-issuer: "letsencrypt-staging" hajimari.io/enable: "true" hajimari.io/icon: "weather-sunset" traefik.ingress.kubernetes.io/router.entrypoints: "websecure" diff --git a/cluster/apps/networking/traefik/dashboard/ingress.yaml b/cluster/apps/networking/traefik/dashboard/ingress.yaml index f0850042..9ec9ecae 100644 --- a/cluster/apps/networking/traefik/dashboard/ingress.yaml +++ b/cluster/apps/networking/traefik/dashboard/ingress.yaml @@ -5,7 +5,7 @@ metadata: name: traefik-dashboard namespace: networking annotations: - cert-manager.io/cluster-issuer: "letsencrypt-production" + cert-manager.io/cluster-issuer: "letsencrypt-staging" hajimari.io/appName: "traefik" hajimari.io/enable: "true" hajimari.io/icon: "web" diff --git a/tmpl/cluster/flux-system/webhooks/github/ingress.yaml b/tmpl/cluster/flux-system/webhooks/github/ingress.yaml index 536b7212..3a3b4762 100644 --- a/tmpl/cluster/flux-system/webhooks/github/ingress.yaml +++ b/tmpl/cluster/flux-system/webhooks/github/ingress.yaml @@ -5,7 +5,7 @@ metadata: name: webhook-receiver namespace: flux-system annotations: - cert-manager.io/cluster-issuer: "letsencrypt-production" + cert-manager.io/cluster-issuer: "letsencrypt-staging" external-dns/is-public: "true" external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" traefik.ingress.kubernetes.io/router.middlewares: "networking-cloudflare-only@kubernetescrd"