Skip to content

Commit 11d7775

Browse files
devantlerdevantler
authored
fix: Add certificate configuration for Traefik (#955)
* fix(traefik): add certificate configuration and update kustomization files Signed-off-by: Nikolai Emil Damm <[email protected]> * feat(certificates): add root CA certificate file Signed-off-by: Nikolai Emil Damm <[email protected]> * feat(issuers): add ACME Cloudflare ClusterIssuer and related resources fix(variables): update ConfigMaps and Secrets with email and ACME server details chore(kustomization): refactor kustomization files for issuer resources Signed-off-by: Nikolai Emil Damm <[email protected]> * fix(kustomization): update resource reference to selfsigned-cluster-issuer.yaml Signed-off-by: Nikolai Emil Damm <[email protected]> * fix(hosts): correct traefik domain in hosts file fix(variables): update domain format in variables-cluster-config-map.yaml Signed-off-by: Nikolai Emil Damm <[email protected]> * fix(variables): update issuer to acme-cloudflare in cluster config maps Signed-off-by: Nikolai Emil Damm <[email protected]> * feat(helm-release): add CRD installation and upgrade configuration Signed-off-by: Nikolai Emil Damm <[email protected]> * feat(certificates): add traefik certificate and update kustomization references Signed-off-by: Nikolai Emil Damm <[email protected]> * fix(cluster-issuer): add namespace to cloudflare-api-token secret Signed-off-by: Nikolai Emil Damm <[email protected]> --------- Signed-off-by: Nikolai Emil Damm <[email protected]>
1 parent 7b09349 commit 11d7775

File tree

19 files changed

+102
-17
lines changed

19 files changed

+102
-17
lines changed

‎hosts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
127.0.0.1 traefik.local.platform.devantler.tech

‎k8s/distributions/kind/infrastructure/traefik/kustomization.yaml‎ renamed to ‎k8s/bases/infrastructure/certificates/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: kustomize.config.k8s.io/v1beta1
23
kind: Kustomization
34
resources:

‎k8s/distributions/kind/infrastructure/traefik/traefik-certificate.yaml‎ renamed to ‎k8s/bases/infrastructure/certificates/traefik-certificate.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
apiVersion: cert-manager.io/v1
22
kind: Certificate
33
metadata:
4-
name: traefik-certificate
4+
name: certificate
55
namespace: traefik
66
spec:
7-
secretName: traefik-certificate-tls
7+
secretName: certificate-tls
88
dnsNames:
99
- "${domain}"
1010
- "*.${domain}"
1111
issuerRef:
12-
name: selfsigned-cluster-issuer
12+
name: ${issuer}
1313
kind: ClusterIssuer

‎k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ spec:
1212
sourceRef:
1313
kind: HelmRepository
1414
name: cert-manager
15+
install:
16+
crds: CreateReplace
17+
upgrade:
18+
crds: CreateReplace
1519
# https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
1620
values:
1721
podDisruptionBudget:

‎k8s/bases/infrastructure/controllers/traefik/helm-release.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,6 @@ spec:
2323
# websecure:
2424
# middlewares:
2525
# - traefik-auth-headers@kubernetescrd
26-
# tlsStore:
27-
# default:
28-
# defaultCertificate:
29-
# secretName: cluster-issuer-certificate-tls
3026
service:
3127
type: ${traefik_service_type:=LoadBalancer}
3228
ingressRoute:
@@ -35,6 +31,10 @@ spec:
3531
matchRule: Host(`traefik.${domain}`)
3632
entryPoints:
3733
- websecure
34+
tlsStore:
35+
default:
36+
defaultCertificate:
37+
secretName: certificate-tls
3838
# middlewares:
3939
# - name: traefik-forward-auth
4040
# annotations:

‎k8s/bases/infrastructure/controllers/traefik/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
4-
- namespace.yaml
54
- helm-release.yaml
65
- helm-repository.yaml
6+
- namespace.yaml

‎k8s/bases/infrastructure/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@
22
apiVersion: kustomize.config.k8s.io/v1beta1
33
kind: Kustomization
44
resources:
5+
- certificates/
56
- metrics-server/

‎k8s/bases/infrastructure/middlewares/forward-auth/forward-auth.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ spec:
1212
- Authorization
1313
tls:
1414
insecureSkipVerify: true
15-
certSecret: cluster-issuer-certificate-tls
15+
certSecret: certificate-tls
1616
headers:
1717
sslRedirect: true
1818
stsSeconds: 315360000

‎k8s/clusters/dev/variables/variables-cluster-config-map.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,8 @@ metadata:
66
namespace: flux-system
77
data:
88
domain: dev.platform.devantler.tech
9+
email: [email protected]
10+
acme_server: https://acme-v02.api.letsencrypt.org/directory
911
github_app_client_id: Iv23liZ8GHRgpx32Em2y
12+
issuer: acme-cloudflare
1013
traefik_service_type: ClusterIP

‎k8s/clusters/dev/variables/variables-cluster-secret.enc.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ metadata:
44
name: variables-cluster
55
namespace: flux-system
66
stringData:
7+
cloudflare_api_token: ENC[AES256_GCM,data:zZgHu/1HJ09YQPGRUTNukJCNGux7+APqiHBEECE2KWA2QXaf5Bvd7A==,iv:xkmZo1lSXF/Hx3vMNl54O8TuT/nAGH4pig5Pp9kKaUc=,tag:Cj3jPc5Nj7AcJIaxWkBQNA==,type:str]
78
cloudflared_tunnel_token: ENC[AES256_GCM,data:uTQEeJ45EG5TyUu9I5WSUZVqPHkR3XLZrssdCYm5skgVqXqCIcAirILlYyXWDCCSywxwDcPEnSlnj3Bk4ctvXdSskS9eptNv3VsO4KgYJW5Kwv8RCksgR8h3NmRSXSuMfNS5IOdmVGCp+8IjXD30+bFn98TsByPDX4sUanxQpwV1LJCoduZIckv5cGD1Hvj3T4LSqEv0Trk0KG6yYPlsG1KN8tNsDYwCF8D+Qwy7AAbeBzGT/2hGcQ==,iv:/JW5ftilZFMayltE2RkP1mvYd58mhBNz1lgRi8jM5zQ=,tag:s/IKkb1EH4wnK9SiHO8smA==,type:str]
89
dex_client_secret: ENC[AES256_GCM,data:wDXfLk083EYkp3NgngWmclcOegU=,iv:0/JKWrVKcdOya6AyNWXfNh/WF7lFX12eqZMHJb7NXHc=,tag:zoLVCeBafJHRtnP2EHWLoQ==,type:str]
910
github_app_client_secret: ENC[AES256_GCM,data:vvY+8+BujzBjj3UE82TOWS6ZKWRoN5a6rTHlE44MIzERqHPtcAJryA==,iv:YkPH3EOX2bSez5rJ5MieuPltRSNMKoXhWXzqClyOjQY=,tag:UNBKTekSzznLsfQmvlH7zQ==,type:str]
@@ -19,7 +20,7 @@ sops:
1920
eStldU55TjcwdGE4SjF0N3Q4TG9TRGcK1OworkGus/sekn6++t+YQP3QagKuAjeo
2021
AHzPZPAh7pZNFJ9cnvPwpUx6tlgRVpDUDhTZuNikFVYtCWw/PqRObw==
2122
-----END AGE ENCRYPTED FILE-----
22-
lastmodified: "2025-05-23T14:28:47Z"
23-
mac: ENC[AES256_GCM,data:+O9zBD+jiI41hZA6y558r2wof6wPgRNq/IO5f6sBeayqBqn4VgQ5GYYrA9JADL3jQhM16zQsmLKzaHkMSyCZ7fQ/UayLoVBVZ7X8sjuVvMAH0j7CZy3xpAYh1viFvgx4dR9NpVAttkRadzv40QTLcUiFEZMrEW5QK3UQFB4ox1c=,iv:aZbp7yEeBYDz28Vkr09+SYOUDm2wQeHf6LCY+AQF2Yk=,tag:AMsJfUF2HbSe7dV7H7a+Vw==,type:str]
23+
lastmodified: "2025-05-23T19:14:11Z"
24+
mac: ENC[AES256_GCM,data:RN9MSm2p0EE7K7y1W+1B/kFLRcA6Nig8QnXI2eS1g5A9o0uhsbmK1uBNjWb25HH6EdaX66YQMd9KGJeR/d7zBQqFYkL3Gxt0aAZkMTdYk2Ans8seSRr91VUGmx9hCZTh6eBZY7TV2TAadBMVsmve5aXo2/8OwRausWIdsI5d504=,iv:0dER3TDBW+jpUU1MyWP3oU4VQuRa6qt8d/BZg1pXlk0=,tag:5XsMF9WC5iLI0sXNEL9zUA==,type:str]
2425
encrypted_regex: ^(data|stringData)$
2526
version: 3.10.2

0 commit comments

Comments
 (0)