89 lines
2.4 KiB
YAML
89 lines
2.4 KiB
YAML
|
apiVersion: batch/v1
|
||
|
|
kind: CronJob
|
||
|
|
metadata:
|
||
|
|
name: proxmox-cert
|
||
|
|
namespace: default
|
||
|
|
spec:
|
||
|
|
jobTemplate:
|
||
|
|
spec:
|
||
|
|
template:
|
||
|
|
spec:
|
||
|
|
volumes:
|
||
|
|
- secret:
|
||
|
|
secretName: proxmox-gmem-ca
|
||
|
|
name: cert
|
||
|
|
containers:
|
||
|
|
- command:
|
||
|
|
- /bin/bash
|
||
|
|
- -c
|
||
|
|
- >
|
||
|
|
curl "https://healthchecks.gmem.ca/ping/${HEALTHCHECKS_UUID}/start"
|
||
|
|
|
||
|
|
curl -k -X POST https://${BASE_URL}/api2/json/nodes/proxmox/certificates/custom
|
||
|
|
-H "Authorization: PVEAPIToken=${TOKEN_ID}=${TOKEN_SECRET}"
|
||
|
|
-H "Content-Type: application/x-www-form-urlencoded"
|
||
|
|
--data-urlencode "key=$(cat /data/tls.key)"
|
||
|
|
--data-urlencode "restart=1"
|
||
|
|
--data-urlencode "force=1"
|
||
|
|
--data-urlencode "certificates=$(cat /data/tls.crt)"
|
||
|
|
|
||
|
|
curl "https://healthchecks.gmem.ca/ping/${HEALTHCHECKS_UUID}/$?"
|
||
|
|
envFrom:
|
||
|
|
- configMapRef:
|
||
|
|
name: proxmox-cert
|
||
|
|
- secretRef:
|
||
|
|
name: proxmox-cert
|
||
|
|
image: git.gmem.ca/arch/kutils
|
||
|
|
name: upload-certificate
|
||
|
|
volumeMounts:
|
||
|
|
- mountPath: /data
|
||
|
|
name: cert
|
||
|
|
restartPolicy: Never
|
||
|
|
schedule: "0 0 1 * *"
|
||
|
|
---
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: proxmox-gmem-ca
|
||
|
|
namespace: default
|
||
|
|
spec:
|
||
|
|
# Secret names are always required.
|
||
|
|
secretName: proxmox-gmem-ca
|
||
|
|
|
||
|
|
duration: 2160h # 90d
|
||
|
|
renewBefore: 360h # 15d
|
||
|
|
|
||
|
|
dnsNames:
|
||
|
|
- proxmox.gmem.ca
|
||
|
|
issuerRef:
|
||
|
|
name: le-issuer
|
||
|
|
# We can reference ClusterIssuers by changing the kind here.
|
||
|
|
# The default value is Issuer (i.e. a locally namespaced Issuer)
|
||
|
|
kind: ClusterIssuer
|
||
|
|
# This is optional since cert-manager will default to this value however
|
||
|
|
# if you are using an external issuer, change this to that issuer group.
|
||
|
|
group: cert-manager.io
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
data:
|
||
|
|
BASE_URL: proxmox.gmem.ca
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: proxmox-cert
|
||
|
|
namespace: default
|
||
|
|
---
|
||
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
||
|
|
kind: VaultStaticSecret
|
||
|
|
metadata:
|
||
|
|
name: proxmox-cert
|
||
|
|
namespace: default
|
||
|
|
spec:
|
||
|
|
destination:
|
||
|
|
create: true
|
||
|
|
name: proxmox-cert
|
||
|
|
mount: kv
|
||
|
|
path: default/proxmox-cert
|
||
|
|
refreshAfter: 30s
|
||
|
|
type: kv-v2
|
||
|
|
vaultAuthRef: vault
|