refactor(certificate): move certificate config from ingress to certif…

…icate (#18392)
hongbo-miao · Jul 28, 2024 · fa096d9 · fa096d9
1 parent 11fcedd
commit fa096d9
Show file tree

Hide file tree

Showing 32 changed files with 140 additions and 78 deletions.
diff --git a/ops/argo-cd/applications/production-hm/airbyte/kubernetes-manifests/hm-airbyte-ingress.yaml b/ops/argo-cd/applications/production-hm/airbyte/kubernetes-manifests/hm-airbyte-ingress.yaml
@@ -9,12 +9,6 @@ metadata:
     # https://doc.traefik.io/traefik/routing/providers/kubernetes-ingress/#on-ingress
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...cations/production-hm/airbyte/kubernetes-manifests/production-hm-airbyte-certificate.yaml b/...cations/production-hm/airbyte/kubernetes-manifests/production-hm-airbyte-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-airbyte
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-airbyte.internal.hongbomiao.com
   secretName: production-hm-airbyte-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...plications/production-hm/airbyte/kubernetes-manifests/staging-hm-airbyte-certificate.yaml b/...plications/production-hm/airbyte/kubernetes-manifests/staging-hm-airbyte-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-airbyte
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-airbyte.internal.hongbomiao.com
   secretName: staging-hm-airbyte-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: staging-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/ops/argo-cd/applications/production-hm/akhq/kubernetes-manifests/hm-akhq-ingress.yaml b/ops/argo-cd/applications/production-hm/akhq/kubernetes-manifests/hm-akhq-ingress.yaml
@@ -11,12 +11,6 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-akhq.internal.hongbomiao.com
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/.../applications/production-hm/akhq/kubernetes-manifests/production-hm-akhq-certificate.yaml b/.../applications/production-hm/akhq/kubernetes-manifests/production-hm-akhq-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-akhq
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-akhq.internal.hongbomiao.com
   secretName: production-hm-akhq-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...-cd/applications/production-hm/akhq/kubernetes-manifests/staging-hm-akhq-certificate.yaml b/...-cd/applications/production-hm/akhq/kubernetes-manifests/staging-hm-akhq-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-akhq
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-akhq.internal.hongbomiao.com
   secretName: staging-hm-akhq-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: staging-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/ops/argo-cd/applications/production-hm/argo-cd/kubernetes-manifests/hm-argo-cd-ingress.yaml b/ops/argo-cd/applications/production-hm/argo-cd/kubernetes-manifests/hm-argo-cd-ingress.yaml
@@ -11,12 +11,6 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-argo-cd.internal.hongbomiao.com
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
   labels:
     app.kubernetes.io/name: hm-argo-cd-ingress
     app.kubernetes.io/part-of: production-hm-argo-cd

diff --git a/...cations/production-hm/argo-cd/kubernetes-manifests/production-hm-argo-cd-certificate.yaml b/...cations/production-hm/argo-cd/kubernetes-manifests/production-hm-argo-cd-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -12,3 +13,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...plications/production-hm/argo-cd/kubernetes-manifests/staging-hm-argo-cd-certificate.yaml b/...plications/production-hm/argo-cd/kubernetes-manifests/staging-hm-argo-cd-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -12,3 +13,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: staging-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...oduction-hm/cert-manager/kubernetes-manifests/production-lets-encrypt-cluster-issuer.yaml b/...oduction-hm/cert-manager/kubernetes-manifests/production-lets-encrypt-cluster-issuer.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/tutorials/zerossl/zerossl/#cluster-issuer
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer

diff --git a/.../production-hm/cert-manager/kubernetes-manifests/staging-lets-encrypt-cluster-issuer.yaml b/.../production-hm/cert-manager/kubernetes-manifests/staging-lets-encrypt-cluster-issuer.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/tutorials/zerossl/zerossl/#cluster-issuer
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer

diff --git a/...go-cd/applications/production-hm/kafbat-ui/kubernetes-manifests/hm-kafbat-ui-ingress.yaml b/...go-cd/applications/production-hm/kafbat-ui/kubernetes-manifests/hm-kafbat-ui-ingress.yaml
@@ -11,12 +11,6 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-kafbat-ui.internal.hongbomiao.com
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...ons/production-hm/kafbat-ui/kubernetes-manifests/production-hm-kafbat-ui-certificate.yaml b/...ons/production-hm/kafbat-ui/kubernetes-manifests/production-hm-kafbat-ui-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-kafbat-ui
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-kafbat-ui.internal.hongbomiao.com
   secretName: production-hm-kafbat-ui-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...ations/production-hm/kafbat-ui/kubernetes-manifests/staging-hm-kafbat-ui-certificate.yaml b/...ations/production-hm/kafbat-ui/kubernetes-manifests/staging-hm-kafbat-ui-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-kafbat-ui
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-kafbat-ui.internal.hongbomiao.com
   secretName: staging-hm-kafbat-ui-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: staging-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/ops/argo-cd/applications/production-hm/mlflow/kubernetes-manifests/hm-mlflow-ingress.yaml b/ops/argo-cd/applications/production-hm/mlflow/kubernetes-manifests/hm-mlflow-ingress.yaml
@@ -11,12 +11,6 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-mlflow.internal.hongbomiao.com
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...lications/production-hm/mlflow/kubernetes-manifests/production-hm-mlflow-certificate.yaml b/...lications/production-hm/mlflow/kubernetes-manifests/production-hm-mlflow-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-mlflow
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-mlflow.internal.hongbomiao.com
   secretName: production-hm-mlflow-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...applications/production-hm/mlflow/kubernetes-manifests/staging-hm-mlflow-certificate.yaml b/...applications/production-hm/mlflow/kubernetes-manifests/staging-hm-mlflow-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-mlflow
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-mlflow.internal.hongbomiao.com
   secretName: staging-hm-mlflow-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: staging-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/ops/argo-cd/applications/production-hm/netdata/kubernetes-manifests/hm-netdata-ingress.yaml b/ops/argo-cd/applications/production-hm/netdata/kubernetes-manifests/hm-netdata-ingress.yaml
@@ -11,12 +11,6 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-netdata.internal.hongbomiao.com
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...cations/production-hm/netdata/kubernetes-manifests/production-hm-netdata-certificate.yaml b/...cations/production-hm/netdata/kubernetes-manifests/production-hm-netdata-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-netdata
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-netdata.internal.hongbomiao.com
   secretName: production-hm-netdata-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...plications/production-hm/netdata/kubernetes-manifests/staging-hm-netdata-certificate.yaml b/...plications/production-hm/netdata/kubernetes-manifests/staging-hm-netdata-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-netdata
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-netdata.internal.hongbomiao.com
   secretName: staging-hm-netdata-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: staging-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always
diff --git a/...argo-cd/applications/production-hm/opencost/kubernetes-manifests/hm-opencost-ingress.yaml b/...argo-cd/applications/production-hm/opencost/kubernetes-manifests/hm-opencost-ingress.yaml
@@ -9,12 +9,6 @@ metadata:
     # https://doc.traefik.io/traefik/routing/providers/kubernetes-ingress/#on-ingress
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-    # https://letsencrypt.org/certificates
-    cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
-    cert-manager.io/private-key-algorithm: ECDSA
-    cert-manager.io/private-key-size: "384"
-    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...tions/production-hm/opencost/kubernetes-manifests/production-hm-opencost-certificate.yaml b/...tions/production-hm/opencost/kubernetes-manifests/production-hm-opencost-certificate.yaml
@@ -1,3 +1,4 @@
+# https://cert-manager.io/docs/usage/certificate
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -6,7 +7,7 @@ metadata:
   namespace: production-hm-opencost
   annotations:
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
-    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook: PreSync
 spec:
   commonName: hm-opencost.internal.hongbomiao.com
   secretName: production-hm-opencost-certificate
@@ -15,3 +16,8 @@ spec:
   issuerRef:
     kind: ClusterIssuer
     name: production-lets-encrypt-cluster-issuer
+  # https://letsencrypt.org/certificates
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+    rotationPolicy: Always