feat: Yall have spoken, wildcard certs are now a thing

Signed-off-by: Devin Buhl <devin@buhl.casa>

README.md

@@ -401,12 +401,6 @@ To access services from the outside world port forwarded `80` and `443` in your
 
 Now if nothing is working, that is expected. This is DNS after all!
 
-### 🔐 SSL
-
-By default in this template Kubernetes ingresses are set to use the [Let's Encrypt Staging Environment](https://letsencrypt.org/docs/staging-environment/). This will hopefully reduce issues from ACME on requesting certificates until you are ready to use this in "Production".
-
-Once you have confirmed there are no issues requesting your certificates replace `letsencrypt-staging` with `letsencrypt-production` in your ingress annotations for `cert-manager.io/cluster-issuer`
-
 ### 🤖 Renovatebot
 
 [Renovatebot](https://www.mend.io/free-developer-tools/renovate/) will scan your repository and offer PRs when it finds dependencies out of date. Common dependencies it will discover and update are Flux, Ansible Galaxy Roles, Terraform Providers, Kubernetes Helm Charts, Kubernetes Container Images, Pre-commit hooks updates, and more!

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: jetstack
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     installCRDs: true
     extraArgs:

kubernetes/apps/default/echo-server/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     controller:
       strategy: RollingUpdate
@@ -52,7 +56,6 @@ spec:
         enabled: true
         ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-staging
           external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
           external-dns.home.arpa/enabled: "true"
           hajimari.io/icon: video-input-antenna
@@ -64,7 +67,6 @@ spec:
         tls:
           - hosts:
               - *host
-            secretName: echo-server-tls
     resources:
       requests:
         cpu: 5m

kubernetes/apps/default/hajimari/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: hajimari
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     hajimari:
       title: Apps
@@ -41,7 +45,6 @@ spec:
         enabled: true
         ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-staging
           nginx.ingress.kubernetes.io/whitelist-source-range: |
             10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
           hajimari.io/enable: "false"
@@ -53,7 +56,6 @@ spec:
         tls:
           - hosts:
               - *host
-            secretName: hajimari-tls
     podAnnotations:
       configmap.reloader.stakater.com/reload: hajimari-settings
     persistence:

kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml

@@ -5,7 +5,6 @@ metadata:
   name: flux-webhook
   namespace: flux-system
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-staging
     external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
     external-dns.home.arpa/enabled: "true"
     hajimari.io/enable: "false"
@@ -25,4 +24,3 @@ spec:
   tls:
     - hosts:
         - *host
-      secretName: flux-webhook-tls

kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: weave-gitops
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     adminUser:
       create: true
@@ -29,7 +33,6 @@ spec:
       enabled: true
       className: nginx
       annotations:
-        cert-manager.io/cluster-issuer: letsencrypt-staging
         nginx.ingress.kubernetes.io/whitelist-source-range: |
           10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
         hajimari.io/icon: sawtooth-wave
@@ -41,7 +44,6 @@ spec:
       tls:
         - hosts:
             - *host
-          secretName: weave-gitops-tls
     networkPolicy:
       create: false
     metrics:

kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: metrics-server
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     args:
       - --kubelet-insecure-tls

kubernetes/apps/kube-system/reloader/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: stakater
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     fullnameOverride: reloader
     reloader:

kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: kubernetes-dashboard
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     env:
       TZ: "${TIMEZONE}"

kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     controller:
       type: cronjob

kubernetes/apps/networking/external-dns/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: external-dns
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     interval: 2m
     # logLevel: debug
@@ -43,8 +47,7 @@ spec:
     sources: ["ingress"]
     txtPrefix: k8s.
     txtOwnerId: default
-    domainFilters:
+    domainFilters: ["${SECRET_DOMAIN}"]
-      - "${SECRET_DOMAIN}"
     serviceMonitor:
       enabled: true
     podAnnotations:

kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml

@@ -14,17 +14,17 @@ spec:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      interval: 15m
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
-  dependsOn:
+  uninstall:
-    - name: cert-manager
+    keepHistory: false
-      namespace: cert-manager
   values:
     controller:
       extraEnvs:
@@ -32,8 +32,7 @@ spec:
           value: "${TIMEZONE}"
       service:
         annotations:
-          metallb.universe.tf/loadBalancerIPs: |-
+          metallb.universe.tf/loadBalancerIPs: "${METALLB_INGRESS_ADDR}"
-            ${METALLB_INGRESS_ADDR}
         externalTrafficPolicy: Local
       publishService:
         enabled: true
@@ -43,8 +42,7 @@ spec:
         client-header-timeout: 120
         client-body-buffer-size: "100M"
         client-body-timeout: 120
-        custom-http-errors: |-
+        custom-http-errors: 400,401,403,404,500,502,503,504
-          401,403,404,500,501,502,503
         enable-brotli: "true"
         forwarded-for-header: "CF-Connecting-IP"
         hsts-max-age: "31449600"
@@ -53,10 +51,21 @@ spec:
         proxy-body-size: "100M"
         ssl-protocols: "TLSv1.3 TLSv1.2"
         use-forwarded-headers: "true"
+        log-format-escape-json: "true"
+        log-format-upstream: >-
+          {"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr",
+          "x_forwarded_for": "$proxy_add_x_forwarded_for", "request_id": "$req_id",
+          "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time,
+          "status": $status, "vhost": "$host", "request_proto": "$server_protocol",
+          "path": "$uri", "request_query": "$args", "request_length": $request_length,
+          "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer",
+          "http_user_agent": "$http_user_agent"}
       metrics:
         enabled: false
+      extraArgs:
+        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
       podAnnotations:
-        configmap.reloader.stakater.com/reload: "cloudflare-networks"
+        configmap.reloader.stakater.com/reload: cloudflare-networks
       resources:
         requests:
           cpu: 10m

kubernetes/apps/networking/ingress-nginx/certificates/certificates.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-production"
+  namespace: networking
+spec:
+  secretName: "${SECRET_DOMAIN/./-}-production-tls"
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "${SECRET_DOMAIN}"
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-staging"
+  namespace: networking
+spec:
+  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  commonName: "${SECRET_DOMAIN}"
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"

kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./certificates.yaml

kubernetes/apps/networking/ingress-nginx/ks.yaml

@@ -1,6 +1,26 @@
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
+metadata:
+  name: cluster-apps-ingress-nginx-certificates
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  dependsOn:
+    - name: cluster-apps-cert-manager-issuers
+  path: ./kubernetes/apps/networking/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
 metadata:
   name: cluster-apps-ingress-nginx
   namespace: flux-system
@@ -8,9 +28,7 @@ metadata:
     substitution.flux.home.arpa/enabled: "true"
 spec:
   dependsOn:
-    - name: cluster-apps-cert-manager
+    - name: cluster-apps-ingress-nginx-certificates
-    - name: cluster-apps-cert-manager-issuers
-    - name: cluster-apps-metallb
     - name: cluster-apps-metallb-config
   path: ./kubernetes/apps/networking/ingress-nginx/app
   prune: true

kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml

@@ -14,16 +14,17 @@ spec:
         kind: HelmRepository
         name: k8s-gateway
         namespace: flux-system
-      interval: 15m
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
-      retries: 5
+      retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
-      retries: 5
+      retries: 3
-  dependsOn:
+  uninstall:
-    - name: metallb
+    keepHistory: false
   values:
     fullnameOverride: k8s-gateway
     domain: "${SECRET_DOMAIN}"

kubernetes/apps/networking/metallb/app/helmrelease.yaml

@@ -14,13 +14,17 @@ spec:
         kind: HelmRepository
         name: metallb
         namespace: flux-system
+  maxHistory: 3
   install:
     createNamespace: true
     remediation:
       retries: 3
   upgrade:
+    cleanupOnFail: true
     remediation:
       retries: 3
+  uninstall:
+    keepHistory: false
   values:
     crds:
       enabled: true