Story Crater Bot
dd608d3231
- ArgoCD migrated to argocd namespace - Cert-manager issuers/certs created - 20 namespaces imported with pod-security labels - S3 backend temporarily offline (MinIO), using local backup - Pending: Remove metadata drift from helm releases, re-apply
81 lines
1.7 KiB
YAML
81 lines
1.7 KiB
YAML
---
|
|
# ClusterIssuer: selfsigned-bootstrap (initial issuer for homelab-ca cert)
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: selfsigned-bootstrap
|
|
spec:
|
|
selfSigned: {}
|
|
|
|
---
|
|
# ClusterIssuer: homelab-ca (uses generated homelab-ca cert)
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: homelab-ca
|
|
spec:
|
|
ca:
|
|
secretName: homelab-ca-secret
|
|
|
|
---
|
|
# Self-signed CA certificate (10 year lifetime)
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: homelab-ca
|
|
namespace: cert-manager
|
|
spec:
|
|
commonName: homelab-ca
|
|
duration: 87600h
|
|
isCA: true
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: selfsigned-bootstrap
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
renewBefore: 720h
|
|
secretName: homelab-ca-secret
|
|
|
|
---
|
|
# Wildcard TLS certificate for *.riotpiao.homelab.com
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: homelab-tls
|
|
namespace: ingress-nginx
|
|
spec:
|
|
commonName: "*.riotpiao.homelab.com"
|
|
dnsNames:
|
|
- "*.riotpiao.homelab.com"
|
|
duration: 2160h
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: homelab-ca
|
|
renewBefore: 720h
|
|
secretName: homelab-tls
|
|
|
|
---
|
|
# ArgoCD namespace
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: argocd
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: baseline
|
|
pod-security.kubernetes.io/enforce-version: latest
|
|
|
|
---
|
|
# dev-tools namespace
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: dev-tools
|
|
labels:
|
|
pod-security.kubernetes.io/audit: restricted
|
|
pod-security.kubernetes.io/audit-version: latest
|
|
pod-security.kubernetes.io/enforce: baseline
|
|
pod-security.kubernetes.io/enforce-version: latest
|
|
pod-security.kubernetes.io/warn: restricted
|
|
pod-security.kubernetes.io/warn-version: latest
|