42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# Certificate — ArgoCD TLS
|
|
# Issued by cert-manager via letsencrypt-prod + Cloudflare DNS-01
|
|
#
|
|
# The secret produced (argocd-tls) is referenced by the Gateway listener
|
|
# in cluster/platform/gateway-api/gateway.yaml via ReferenceGrant.
|
|
#
|
|
# Per the thematic naming convention: argocd.local.mk-labs.cloud is the
|
|
# service DNS name. No VM hostname alias needed here.
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: argocd-tls
|
|
namespace: argocd
|
|
spec:
|
|
secretName: argocd-tls
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- argocd.local.mk-labs.cloud
|
|
|
|
---
|
|
# ReferenceGrant — allows the Gateway in gateway-system to reference
|
|
# the TLS secret in the argocd namespace
|
|
# Without this, cross-namespace secret references are denied
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: argocd-tls-grant
|
|
namespace: argocd
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
namespace: gateway-system
|
|
to:
|
|
- group: ""
|
|
kind: Secret
|
|
name: argocd-tls
|