Dustin C. Hatch
b366532c88
Having name overrides for in-cluster services breaks ACME challenges, because the server tries to connect to the Service instead of the Ingress. To fix this, we need to configure both _cert-manager_ and _step-ca_ to *only* resolve names using the network-wide DNS server.
46 lines
887 B
YAML
46 lines
887 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.yaml
|
|
- cluster-issuer.yaml
|
|
- certificates.yaml
|
|
- cert-exporter.yaml
|
|
- dch-ca-issuer.yaml
|
|
|
|
secretGenerator:
|
|
- name: zerossl-eab
|
|
namespace: cert-manager
|
|
envs:
|
|
- zerossl.secret
|
|
options:
|
|
disableNameSuffixHash: true
|
|
|
|
- name: cert-exporter-sshkey
|
|
namespace: cert-manager
|
|
files:
|
|
- cert-exporter.pem
|
|
- ssh_known_hosts
|
|
|
|
- name: cloudflare
|
|
namespace: cert-manager
|
|
files:
|
|
- cloudflare.api-token
|
|
options:
|
|
disableNameSuffixHash: true
|
|
|
|
patches:
|
|
- patch: |
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cert-manager
|
|
namespace: cert-manager
|
|
spec:
|
|
template:
|
|
spec:
|
|
dnsConfig:
|
|
nameservers:
|
|
- 172.30.0.1
|
|
dnsPolicy: None
|