Story Crater Bot
d841bbdb95
Substrate had no owner since Terraform was deleted (Pure GitOps). Adds 5 wave-0/1 Applications: cert-manager v1.21.0 (installCRDs, CP tolerations), ingress-nginx 4.15.1 (LB 192.168.1.160), reloader 2.2.14 at wave 0; LE ClusterIssuers + *.riotpiao.com wildcard cert at wave 1 (DNS-01 via Cloudflare). Adds 3 chart repos to AppProject sourceRepos and SOPS-encrypted cloudflare-api-token secret. Cert starts on letsencrypt-staging; flip to prod after clean issue.
37 lines
1.1 KiB
YAML
37 lines
1.1 KiB
YAML
# k8s/cert-manager/cert-manager-values.yaml
|
|
# cert-manager issues every per-hostname cert off homelab-ca and renews the
|
|
# wildcard cert nginx serves — certmanager_certificate_expiration_timestamp_seconds
|
|
# is the early-warning signal before any service's TLS breaks.
|
|
|
|
# CRDs must be installed by the chart — ArgoCD helm-template does not apply a
|
|
# chart's crds/ folder, and the ClusterIssuer/Certificate resources (wave 1)
|
|
# depend on them existing first.
|
|
installCRDs: true
|
|
|
|
# Tolerate the control-plane taint (talos-cp-1 is the only schedulable node).
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
webhook:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
cainjector:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
startupapicheck:
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
prometheus:
|
|
enabled: true
|
|
servicemonitor:
|
|
enabled: true
|
|
interval: 60s
|