81 lines
1.7 KiB
YAML
81 lines
1.7 KiB
YAML
|
---
|
||
|
|
# ClusterIssuer: selfsigned-bootstrap (initial issuer for homelab-ca cert)
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: ClusterIssuer
|
||
|
|
metadata:
|
||
|
|
name: selfsigned-bootstrap
|
||
|
|
spec:
|
||
|
|
selfSigned: {}
|
||
|
|
|
||
|
|
---
|
||
|
|
# ClusterIssuer: homelab-ca (uses generated homelab-ca cert)
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: ClusterIssuer
|
||
|
|
metadata:
|
||
|
|
name: homelab-ca
|
||
|
|
spec:
|
||
|
|
ca:
|
||
|
|
secretName: homelab-ca-secret
|
||
|
|
|
||
|
|
---
|
||
|
|
# Self-signed CA certificate (10 year lifetime)
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: homelab-ca
|
||
|
|
namespace: cert-manager
|
||
|
|
spec:
|
||
|
|
commonName: homelab-ca
|
||
|
|
duration: 87600h
|
||
|
|
isCA: true
|
||
|
|
issuerRef:
|
||
|
|
kind: ClusterIssuer
|
||
|
|
name: selfsigned-bootstrap
|
||
|
|
privateKey:
|
||
|
|
algorithm: ECDSA
|
||
|
|
size: 256
|
||
|
|
renewBefore: 720h
|
||
|
|
secretName: homelab-ca-secret
|
||
|
|
|
||
|
|
---
|
||
|
|
# Wildcard TLS certificate for *.riotpiao.homelab.com
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: homelab-tls
|
||
|
|
namespace: ingress-nginx
|
||
|
|
spec:
|
||
|
|
commonName: "*.riotpiao.homelab.com"
|
||
|
|
dnsNames:
|
||
|
|
- "*.riotpiao.homelab.com"
|
||
|
|
duration: 2160h
|
||
|
|
issuerRef:
|
||
|
|
kind: ClusterIssuer
|
||
|
|
name: homelab-ca
|
||
|
|
renewBefore: 720h
|
||
|
|
secretName: homelab-tls
|
||
|
|
|
||
|
|
---
|
||
|
|
# ArgoCD namespace
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Namespace
|
||
|
|
metadata:
|
||
|
|
name: argocd
|
||
|
|
labels:
|
||
|
|
pod-security.kubernetes.io/enforce: baseline
|
||
|
|
pod-security.kubernetes.io/enforce-version: latest
|
||
|
|
|
||
|
|
---
|
||
|
|
# dev-tools namespace
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Namespace
|
||
|
|
metadata:
|
||
|
|
name: dev-tools
|
||
|
|
labels:
|
||
|
|
pod-security.kubernetes.io/audit: restricted
|
||
|
|
pod-security.kubernetes.io/audit-version: latest
|
||
|
|
pod-security.kubernetes.io/enforce: baseline
|
||
|
|
pod-security.kubernetes.io/enforce-version: latest
|
||
|
|
pod-security.kubernetes.io/warn: restricted
|
||
|
|
pod-security.kubernetes.io/warn-version: latest
|