This commit is contained in:
parent
270e08f9f4
commit
af58f99a08
|
@ -15,8 +15,8 @@ ingress:
|
|||
service: http://nitter.nitter.svc.cluster.local:8081
|
||||
- hostname: git.gmem.ca
|
||||
service: https://homelab.gmem.ca
|
||||
- hostname: proxmox.gmem.ca
|
||||
service: https://homelab.gmem.ca
|
||||
- hostname: proxmox-access.gmem.ca
|
||||
service: https://proxmox.gmem.ca
|
||||
- hostname: tokyo.gmem.ca
|
||||
service: https://homelab.gmem.ca
|
||||
- hostname: ibiza.gmem.ca
|
||||
|
|
88
kubernetes/misc/CronJob-proxmox-cert.yaml
Normal file
88
kubernetes/misc/CronJob-proxmox-cert.yaml
Normal file
|
@ -0,0 +1,88 @@
|
|||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: proxmox-cert
|
||||
namespace: default
|
||||
spec:
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
volumes:
|
||||
- secret:
|
||||
secretName: proxmox-gmem-ca
|
||||
name: cert
|
||||
containers:
|
||||
- command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- >
|
||||
curl "https://healthchecks.gmem.ca/ping/${HEALTHCHECKS_UUID}/start"
|
||||
|
||||
curl -k -X POST https://${BASE_URL}/api2/json/nodes/proxmox/certificates/custom
|
||||
-H "Authorization: PVEAPIToken=${TOKEN_ID}=${TOKEN_SECRET}"
|
||||
-H "Content-Type: application/x-www-form-urlencoded"
|
||||
--data-urlencode "key=$(cat /data/tls.key)"
|
||||
--data-urlencode "restart=1"
|
||||
--data-urlencode "force=1"
|
||||
--data-urlencode "certificates=$(cat /data/tls.crt)"
|
||||
|
||||
curl "https://healthchecks.gmem.ca/ping/${HEALTHCHECKS_UUID}/$?"
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: proxmox-cert
|
||||
- secretRef:
|
||||
name: proxmox-cert
|
||||
image: git.gmem.ca/arch/kutils
|
||||
name: upload-certificate
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: cert
|
||||
restartPolicy: Never
|
||||
schedule: "0 0 1 * *"
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: proxmox-gmem-ca
|
||||
namespace: default
|
||||
spec:
|
||||
# Secret names are always required.
|
||||
secretName: proxmox-gmem-ca
|
||||
|
||||
duration: 2160h # 90d
|
||||
renewBefore: 360h # 15d
|
||||
|
||||
dnsNames:
|
||||
- proxmox.gmem.ca
|
||||
issuerRef:
|
||||
name: le-issuer
|
||||
# We can reference ClusterIssuers by changing the kind here.
|
||||
# The default value is Issuer (i.e. a locally namespaced Issuer)
|
||||
kind: ClusterIssuer
|
||||
# This is optional since cert-manager will default to this value however
|
||||
# if you are using an external issuer, change this to that issuer group.
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
BASE_URL: proxmox.gmem.ca
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: proxmox-cert
|
||||
namespace: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: proxmox-cert
|
||||
namespace: default
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: proxmox-cert
|
||||
mount: kv
|
||||
path: default/proxmox-cert
|
||||
refreshAfter: 30s
|
||||
type: kv-v2
|
||||
vaultAuthRef: vault
|
|
@ -7,3 +7,4 @@ resources:
|
|||
- Namespace-misc.yaml
|
||||
- VaultAuth.yaml
|
||||
- CronJob-router-cert.yaml
|
||||
- CronJob-proxmox-cert.yaml
|
||||
|
|
Loading…
Reference in a new issue