feat: Yall have spoken, wildcard certs are now a thing

Signed-off-by: Devin Buhl <devin@buhl.casa>

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: jetstack
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     installCRDs: true
     extraArgs:

kubernetes/apps/default/echo-server/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     controller:
       strategy: RollingUpdate
@@ -52,7 +56,6 @@ spec:
         enabled: true
         ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-staging
           external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
           external-dns.home.arpa/enabled: "true"
           hajimari.io/icon: video-input-antenna
@@ -64,7 +67,6 @@ spec:
         tls:
           - hosts:
               - *host
-            secretName: echo-server-tls
     resources:
       requests:
         cpu: 5m

kubernetes/apps/default/hajimari/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: hajimari
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     hajimari:
       title: Apps
@@ -41,7 +45,6 @@ spec:
         enabled: true
         ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-staging
           nginx.ingress.kubernetes.io/whitelist-source-range: |
             10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
           hajimari.io/enable: "false"
@@ -53,7 +56,6 @@ spec:
         tls:
           - hosts:
               - *host
-            secretName: hajimari-tls
     podAnnotations:
       configmap.reloader.stakater.com/reload: hajimari-settings
     persistence:

kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml

@@ -5,7 +5,6 @@ metadata:
   name: flux-webhook
   namespace: flux-system
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-staging
     external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
     external-dns.home.arpa/enabled: "true"
     hajimari.io/enable: "false"
@@ -25,4 +24,3 @@ spec:
   tls:
     - hosts:
         - *host
-      secretName: flux-webhook-tls

kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: weave-gitops
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     adminUser:
       create: true
@@ -29,7 +33,6 @@ spec:
       enabled: true
       className: nginx
       annotations:
-        cert-manager.io/cluster-issuer: letsencrypt-staging
         nginx.ingress.kubernetes.io/whitelist-source-range: |
           10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
         hajimari.io/icon: sawtooth-wave
@@ -41,7 +44,6 @@ spec:
       tls:
         - hosts:
             - *host
-          secretName: weave-gitops-tls
     networkPolicy:
       create: false
     metrics:

kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: metrics-server
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     args:
       - --kubelet-insecure-tls

kubernetes/apps/kube-system/reloader/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: stakater
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     fullnameOverride: reloader
     reloader:

kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: kubernetes-dashboard
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     env:
       TZ: "${TIMEZONE}"

kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     controller:
       type: cronjob

kubernetes/apps/networking/external-dns/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: external-dns
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     interval: 2m
     # logLevel: debug
@@ -43,8 +47,7 @@ spec:
     sources: ["ingress"]
     txtPrefix: k8s.
     txtOwnerId: default
-    domainFilters:
-      - "${SECRET_DOMAIN}"
+    domainFilters: ["${SECRET_DOMAIN}"]
     serviceMonitor:
       enabled: true
     podAnnotations:

kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml

@@ -14,17 +14,17 @@ spec:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      interval: 15m
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
-  dependsOn:
-    - name: cert-manager
-      namespace: cert-manager
+  uninstall:
+    keepHistory: false
   values:
     controller:
       extraEnvs:
@@ -32,8 +32,7 @@ spec:
           value: "${TIMEZONE}"
       service:
         annotations:
-          metallb.universe.tf/loadBalancerIPs: |-
-            ${METALLB_INGRESS_ADDR}
+          metallb.universe.tf/loadBalancerIPs: "${METALLB_INGRESS_ADDR}"
         externalTrafficPolicy: Local
       publishService:
         enabled: true
@@ -43,8 +42,7 @@ spec:
         client-header-timeout: 120
         client-body-buffer-size: "100M"
         client-body-timeout: 120
-        custom-http-errors: |-
-          401,403,404,500,501,502,503
+        custom-http-errors: 400,401,403,404,500,502,503,504
         enable-brotli: "true"
         forwarded-for-header: "CF-Connecting-IP"
         hsts-max-age: "31449600"
@@ -53,10 +51,21 @@ spec:
         proxy-body-size: "100M"
         ssl-protocols: "TLSv1.3 TLSv1.2"
         use-forwarded-headers: "true"
+        log-format-escape-json: "true"
+        log-format-upstream: >-
+          {"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr",
+          "x_forwarded_for": "$proxy_add_x_forwarded_for", "request_id": "$req_id",
+          "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time,
+          "status": $status, "vhost": "$host", "request_proto": "$server_protocol",
+          "path": "$uri", "request_query": "$args", "request_length": $request_length,
+          "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer",
+          "http_user_agent": "$http_user_agent"}
       metrics:
         enabled: false
+      extraArgs:
+        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
       podAnnotations:
-        configmap.reloader.stakater.com/reload: "cloudflare-networks"
+        configmap.reloader.stakater.com/reload: cloudflare-networks
       resources:
         requests:
           cpu: 10m

kubernetes/apps/networking/ingress-nginx/certificates/certificates.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-production"
+  namespace: networking
+spec:
+  secretName: "${SECRET_DOMAIN/./-}-production-tls"
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "${SECRET_DOMAIN}"
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-staging"
+  namespace: networking
+spec:
+  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  commonName: "${SECRET_DOMAIN}"
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"

kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./certificates.yaml

kubernetes/apps/networking/ingress-nginx/ks.yaml

@@ -1,6 +1,26 @@
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
+metadata:
+  name: cluster-apps-ingress-nginx-certificates
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  dependsOn:
+    - name: cluster-apps-cert-manager-issuers
+  path: ./kubernetes/apps/networking/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
 metadata:
   name: cluster-apps-ingress-nginx
   namespace: flux-system
@@ -8,9 +28,7 @@ metadata:
     substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
-    - name: cluster-apps-cert-manager
-    - name: cluster-apps-cert-manager-issuers
-    - name: cluster-apps-metallb
+    - name: cluster-apps-ingress-nginx-certificates
     - name: cluster-apps-metallb-config
   path: ./kubernetes/apps/networking/ingress-nginx/app
   prune: true

kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml

@@ -14,16 +14,17 @@ spec:
         kind: HelmRepository
         name: k8s-gateway
         namespace: flux-system
-      interval: 15m
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
-      retries: 5
+      retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
-      retries: 5
-  dependsOn:
-    - name: metallb
+      retries: 3
+  uninstall:
+    keepHistory: false
   values:
     fullnameOverride: k8s-gateway
     domain: "${SECRET_DOMAIN}"

kubernetes/apps/networking/metallb/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: metallb
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     crds:
       enabled: true