From f9f2a09adf2a2cbc85ca43e85f0c3d6a91d8efef Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 16 Sep 2021 07:42:33 -0400 Subject: [PATCH] feat: remove wildcard cert and default cert for traefik - causing too many problems --- cluster/apps/default/hajimari/helm-release.yaml | 2 +- cluster/apps/networking/kustomization.yaml | 1 - .../networking/traefik/dashboard/ingress.yaml | 4 ++-- .../apps/networking/traefik/kustomization.yaml | 1 - .../networking/traefik/tls-store/default.yaml | 9 --------- .../traefik/tls-store/kustomization.yaml | 4 ---- .../wildcard-certificate/certificate.yaml | 15 --------------- .../wildcard-certificate/kustomization.yaml | 4 ---- cluster/core/cert-manager/helm-release.yaml | 7 +++---- .../core/cert-manager/letsencrypt-production.yaml | 3 +++ .../core/cert-manager/letsencrypt-staging.yaml | 3 +++ 11 files changed, 12 insertions(+), 41 deletions(-) delete mode 100644 cluster/apps/networking/traefik/tls-store/default.yaml delete mode 100644 cluster/apps/networking/traefik/tls-store/kustomization.yaml delete mode 100644 cluster/apps/networking/wildcard-certificate/certificate.yaml delete mode 100644 cluster/apps/networking/wildcard-certificate/kustomization.yaml diff --git a/cluster/apps/default/hajimari/helm-release.yaml b/cluster/apps/default/hajimari/helm-release.yaml index 9e38af94..9d12309a 100644 --- a/cluster/apps/default/hajimari/helm-release.yaml +++ b/cluster/apps/default/hajimari/helm-release.yaml @@ -113,7 +113,7 @@ spec: tls: - hosts: - "hajimari.${SECRET_DOMAIN}" - secretName: hajimari + secretName: "hajimari-${SECRET_DOMAIN/./-}-tls" persistence: data: enabled: true diff --git a/cluster/apps/networking/kustomization.yaml b/cluster/apps/networking/kustomization.yaml index 6974d391..8f492af6 100644 --- a/cluster/apps/networking/kustomization.yaml +++ b/cluster/apps/networking/kustomization.yaml @@ -2,4 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - traefik - - wildcard-certificate diff --git a/cluster/apps/networking/traefik/dashboard/ingress.yaml b/cluster/apps/networking/traefik/dashboard/ingress.yaml index 61483691..f9ff5413 100644 --- a/cluster/apps/networking/traefik/dashboard/ingress.yaml +++ b/cluster/apps/networking/traefik/dashboard/ingress.yaml @@ -14,7 +14,7 @@ spec: tls: - hosts: - "traefik.${SECRET_DOMAIN}" - secretName: "${SECRET_DOMAIN/./-}-tls" + secretName: "traefik-dashboard-${SECRET_DOMAIN/./-}-tls" rules: - host: "traefik.${SECRET_DOMAIN}" http: @@ -25,4 +25,4 @@ spec: service: name: traefik port: - number: 9000 \ No newline at end of file + number: 9000 diff --git a/cluster/apps/networking/traefik/kustomization.yaml b/cluster/apps/networking/traefik/kustomization.yaml index 8e03d43f..8b500613 100644 --- a/cluster/apps/networking/traefik/kustomization.yaml +++ b/cluster/apps/networking/traefik/kustomization.yaml @@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - helm-release.yaml - - tls-store - dashboard diff --git a/cluster/apps/networking/traefik/tls-store/default.yaml b/cluster/apps/networking/traefik/tls-store/default.yaml deleted file mode 100644 index 52a08394..00000000 --- a/cluster/apps/networking/traefik/tls-store/default.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: TLSStore -metadata: - name: default - namespace: networking -spec: - defaultCertificate: - secretName: "${SECRET_DOMAIN/./-}-tls" diff --git a/cluster/apps/networking/traefik/tls-store/kustomization.yaml b/cluster/apps/networking/traefik/tls-store/kustomization.yaml deleted file mode 100644 index 15aa7158..00000000 --- a/cluster/apps/networking/traefik/tls-store/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - default.yaml diff --git a/cluster/apps/networking/wildcard-certificate/certificate.yaml b/cluster/apps/networking/wildcard-certificate/certificate.yaml deleted file mode 100644 index b877fa09..00000000 --- a/cluster/apps/networking/wildcard-certificate/certificate.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: "${SECRET_DOMAIN/./-}" - namespace: networking -spec: - secretName: "${SECRET_DOMAIN/./-}-tls" - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "${SECRET_DOMAIN}" - dnsNames: - - "${SECRET_DOMAIN}" - - "*.${SECRET_DOMAIN}" diff --git a/cluster/apps/networking/wildcard-certificate/kustomization.yaml b/cluster/apps/networking/wildcard-certificate/kustomization.yaml deleted file mode 100644 index 1615af25..00000000 --- a/cluster/apps/networking/wildcard-certificate/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - certificate.yaml diff --git a/cluster/core/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml index 43d01956..283a253e 100644 --- a/cluster/core/cert-manager/helm-release.yaml +++ b/cluster/core/cert-manager/helm-release.yaml @@ -20,12 +20,11 @@ spec: webhook: enabled: true extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53 + - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53 - --dns01-recursive-nameservers-only - cainjector: - replicaCount: 1 + replicaCount: 1 podDnsPolicy: "None" podDnsConfig: nameservers: - "1.1.1.1" - - "8.8.8.8" + - "9.9.9.9" diff --git a/cluster/core/cert-manager/letsencrypt-production.yaml b/cluster/core/cert-manager/letsencrypt-production.yaml index a41666ca..348fc492 100644 --- a/cluster/core/cert-manager/letsencrypt-production.yaml +++ b/cluster/core/cert-manager/letsencrypt-production.yaml @@ -16,3 +16,6 @@ spec: apiTokenSecretRef: name: cloudflare-token-secret key: cloudflare-token + selector: + dnsZones: + - ${SECRET_DOMAIN} diff --git a/cluster/core/cert-manager/letsencrypt-staging.yaml b/cluster/core/cert-manager/letsencrypt-staging.yaml index e7ceb8f2..e9146701 100644 --- a/cluster/core/cert-manager/letsencrypt-staging.yaml +++ b/cluster/core/cert-manager/letsencrypt-staging.yaml @@ -16,3 +16,6 @@ spec: apiTokenSecretRef: name: cloudflare-token-secret key: cloudflare-token + selector: + dnsZones: + - ${SECRET_DOMAIN}