Story Crater Bot
9257525b38
homelab-ca was referenced by 6 manifests (authentik, forgejo-runner, blackbox-exporter, management-service) as a CA trust ConfigMap but never existed anywhere - not in git, not live in cluster. Generated a new 10-year self-signed root CA, wired it as a ClusterIssuer (cert-manager namespace) and distributed the public cert as a ConfigMap to every consuming namespace (iam, cicd, monitoring, sqs). Private key lives only in the encrypted Secret. Widened cert-manager-issuers' directory include glob rather than creating a new Application - destination.namespace is just a fallback default on a plain directory source, not a transformer, so it doesn't fight with each ConfigMap's own explicit namespace. Also adds grafana-oidc secret (GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET), same pre-existing gap as grafana-admin - was meant to come from a deleted manual script, value already available in .env.
14 lines
560 B
YAML
14 lines
560 B
YAML
# k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml
|
|
# Self-signed internal CA, for services that only need to trust each other
|
|
# on the homelab LAN (not exposed to the internet, no public ACME needed).
|
|
# Root cert+key live in homelab-ca-secrets.enc.yaml (cert-manager namespace).
|
|
# The public cert is separately distributed via homelab-ca-configmap.yaml so
|
|
# non-cert-manager pods (Authentik, forgejo-runner, etc.) can trust it too.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: homelab-ca
|
|
spec:
|
|
ca:
|
|
secretName: homelab-ca-keypair
|