Dustin C. Hatch
b366532c88
Having name overrides for in-cluster services breaks ACME challenges, because the server tries to connect to the Service instead of the Ingress. To fix this, we need to configure both _cert-manager_ and _step-ca_ to *only* resolve names using the network-wide DNS server.
39 lines
601 B
YAML
39 lines
601 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: step-ca
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/instance: step-ca
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- step-ca.yaml
|
|
- secrets.yaml
|
|
|
|
configMapGenerator:
|
|
- name: step-ca-config
|
|
files:
|
|
- ca.json
|
|
|
|
- name: step-ca-certs
|
|
files:
|
|
- root_ca.crt
|
|
- intermediate_ca.crt
|
|
|
|
patches:
|
|
- patch: |
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: step-ca
|
|
namespace: step-ca
|
|
spec:
|
|
template:
|
|
spec:
|
|
dnsConfig:
|
|
nameservers:
|
|
- 172.30.0.1
|
|
dnsPolicy: None
|