64 lines
2.5 KiB
YAML
64 lines
2.5 KiB
YAML
# tenants-wildcard Certificate(s) — one per VERIFIED domain in
|
||
# tenant.domains[] (#320.C). The primary entry keeps the canonical
|
||
# `tenants-wildcard` / `tenants-wildcard-tls` names so existing
|
||
# instances (whose IngressRoute references that exact secret) keep
|
||
# serving without re-deploy. Each non-primary domain gets its own
|
||
# Certificate + Secret named after the root with `.` → `-`, so the
|
||
# cluster ends up with N TLS Secrets — one per tenant domain — and
|
||
# instances can pick the right one based on their host.
|
||
#
|
||
# Legacy fallback: when tenant.domains[] is empty (a chart consumer
|
||
# from before #320.A), synthesize a single entry from the scalar
|
||
# tenant.wildcardHost so this template stays one-pass.
|
||
#
|
||
# Verified=false entries are skipped on purpose — that's the safety
|
||
# valve called out in #320.A. A half-configured add-domain (root set,
|
||
# DNS not yet pointed) waits in the data layer; the chart doesn't
|
||
# try to issue and stall the whole sync.
|
||
#
|
||
# DNS-01 takes 30–90 s in normal Cloudflare conditions; cert-manager
|
||
# retries forever on transient failures. The Argo Application that
|
||
# deploys this chart is "Healthy" only when EVERY Certificate's
|
||
# Ready condition flips to True — multi-domain deploys take a
|
||
# proportionally longer first sync.
|
||
{{- $domains := .Values.tenant.domains | default (list) }}
|
||
{{- if and (eq (len $domains) 0) .Values.tenant.wildcardHost }}
|
||
{{- $domains = list (dict
|
||
"root" .Values.tenant.domain
|
||
"wildcardHost" .Values.tenant.wildcardHost
|
||
"primary" true
|
||
"verified" true) }}
|
||
{{- end }}
|
||
{{- range $i, $d := $domains }}
|
||
{{- if and $d.verified $d.wildcardHost }}
|
||
{{- $suffix := "" }}
|
||
{{- if not $d.primary }}
|
||
{{- $suffix = printf "-%s" (replace "." "-" $d.root) }}
|
||
{{- end }}
|
||
---
|
||
apiVersion: cert-manager.io/v1
|
||
kind: Certificate
|
||
metadata:
|
||
name: {{ printf "tenants-wildcard%s" $suffix | quote }}
|
||
namespace: tenants
|
||
labels:
|
||
app.kubernetes.io/managed-by: cluster-platform-v3
|
||
odoosky.io/domain-root: {{ $d.root | quote }}
|
||
{{- if $d.primary }}
|
||
odoosky.io/domain-primary: "true"
|
||
{{- end }}
|
||
spec:
|
||
secretName: {{ printf "tenants-wildcard%s-tls" $suffix | quote }}
|
||
issuerRef:
|
||
name: letsencrypt-prod
|
||
kind: ClusterIssuer
|
||
commonName: {{ $d.wildcardHost | quote }}
|
||
dnsNames:
|
||
- {{ $d.wildcardHost | quote }}
|
||
# Renew 30 days before expiry — Let's Encrypt certs are 90-day, so
|
||
# this gives cert-manager a 30-day window to retry if Cloudflare
|
||
# has a bad day during renewal.
|
||
renewBefore: 720h
|
||
{{- end }}
|
||
{{- end }}
|