46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
# k8s/bootstrap/cert-manager/letsencrypt-issuer.yaml
|
|
# Let's Encrypt ClusterIssuers for *.riotpiao.com, DNS-01 via Cloudflare
|
|
# (wildcard certs require DNS-01 — HTTP-01 can't prove ownership of a wildcard name).
|
|
#
|
|
# Prereq (apply manually, not in git — token is a secret):
|
|
# kubectl create secret generic cloudflare-api-token-secret \
|
|
# --namespace cert-manager \
|
|
# --from-literal=api-token=<CLOUDFLARE_API_TOKEN>
|
|
# Token scope: Zone:DNS:Edit for the riotpiao.com zone.
|
|
#
|
|
# Start with letsencrypt-staging to validate the solver, then point
|
|
# Certificate.issuerRef at letsencrypt-prod once staging issues cleanly.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-staging
|
|
spec:
|
|
acme:
|
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
email: [email protected]
|
|
privateKeySecretRef:
|
|
name: letsencrypt-staging-account-key
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
apiTokenSecretRef:
|
|
name: cloudflare-api-token-secret
|
|
key: api-token
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
email: [email protected]
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-account-key
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
apiTokenSecretRef:
|
|
name: cloudflare-api-token-secret
|
|
key: api-token
|