feat(k8s): standardize IngressRoutes — LE prod certs, prod→local→dev order, Traefik values fix

2026-06-08 12:27:55 +02:00
parent 36922a177c
commit e19660fdf4
21 changed files with 145 additions and 121 deletions
@@ -1,36 +1,3 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: dashboard-dev
-  namespace: traefik
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`traefik.gigaforust.internal`)
-    kind: Rule
-    services:
-    - name: api@internal
-      kind: TraefikService
-  tls:
-    secretName: local-tls
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: dashboard-local
-  namespace: traefik
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`traefik.workstation.internal`)
-    kind: Rule
-    services:
-    - name: api@internal
-      kind: TraefikService
-  tls:
-    secretName: local-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -41,10 +8,44 @@ spec:
  entryPoints:
    - websecure
  routes:
-  - match: Host(`traefik.forust.xyz`)
-    kind: Rule
-    services:
-    - name: api@internal
-      kind: TraefikService
+    - match: Host(`traefik.forust.xyz`)
+      kind: Rule
+      services:
+        - name: api@internal
+          kind: TraefikService
  tls:
-    {}
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-local
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`traefik.workstation.internal`)
+      kind: Rule
+      services:
+        - name: api@internal
+          kind: TraefikService
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-dev
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`traefik.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: api@internal
+          kind: TraefikService
+  tls:
+    secretName: local-tls
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: local-tls
-  namespace: traefik
-type: kubernetes.io/tls
-data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXVENDQWtHZ0F3SUJBZ0lVR0FpNCtsWDlCOUFteVdmcVpUSWl3UTlYYkcwd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0Z6RVZNQk1HQTFVRUF3d01LaTVtYjNKMWMzUXVlSGw2TUI0WERUSTJNRFl3T0RBMk1qazFObG9YRFRNMgpNRFl3TlRBMk1qazFObG93RnpFVk1CTUdBMVVFQXd3TUtpNW1iM0oxYzNRdWVIbDZNSUlCSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF5c2VLRnBmaDRJVGR0NGdHR2JNV01pQ1F2bTc5UkZ4UDgwa3QKNDVWOTF5VkVRWUZaMmptRjFpOS9JRTNiKzhacXR6cXQ2bWU5aHN4L21LTXE5Z05tQ1M1NWUxc0NMNkttRCs3bgpSOXJtM2h2TEJWRUpselIwZW9FOXhWS091dzJYNkNvcEZRelVQU1ZzUFRSajExQlUyVDVqekVUc00xTG5LVFhHCnlzMHpCcjByZHMvRlM2cUV2alY4TkREdUVZWVNCaU1hMUdpclpPSndvd2NiZ0pBVWRiRnUyMHRGRmZMb3B2R0wKSEFQcnA3TXpYWTdVQ3RRYW9xY0xMeTN1NEdKN3dyNUcyRURvVUhmdXlJaFBtTStibENZbWkzY2NlZ0tBQ2hKcApZQTQyMGRXVkRBYWpmT1hFc2c1VTFFT3JLK2hQaTluRVc3MUlYYnNYdWp3ZG9zbEgvd0lEQVFBQm80R2NNSUdaCk1CMEdBMVVkRGdRV0JCVHkxdFlLWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFmQmdOVkhTTUVHREFXZ0JUeTF0WUsKWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFQQmdOVkhSTUJBZjhFQlRBREFRSC9NRVlHQTFVZEVRUS9NRDJDRENvdQpabTl5ZFhOMExuaDVlb0lXS2k1M2IzSnJjM1JoZEdsdmJpNXBiblJsY201aGJJSVZLaTVuYVdkaFptOXlkWE4wCkxtbHVkR1Z5Ym1Gc01BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1ZTQ21Sekl2RjhhdXRWVkxZRXpuVHN6OHUKWlNWOGJSYkxYalpDVWVSZUJidW1OR2JQS1c5dExLS2JBWmJqUit1dWZIbGxMMGk1TjdrdFRvNm5NU05vS3NjaApOSjdrRkJoVHRwcmRZUjhMNFpnUkh1VFZGTmViR0pBL1RPRFpUSjhUNTNXaVdoa2tUWnRWOEViQ2hwZ3Zqb2tuCkJCSEpBbEo2dkZFczBzSE9pMVp4Yk5VU2ZLQWdiMlJiSXpJRlhPZkllR095ZjZCL3hFcGtndVNzN3drMGJrK3QKV2YyNVJ5WnZiYmg0amc4WDVOVGQwS2dwdU5NZU96aERlUHNKNlM0b3o5STA0UlEvdENRdWErdlRYNEM3NkFrWgpjcnYxYlR4Wm5pNjBzYVZKeC8wVDI0LzBPN2dGbXFkelcvL1U0QS82eUx3RzlRMG9jZ1JYcGFlVmFLeUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREt4NG9XbCtIZ2hOMjMKaUFZWnN4WXlJSkMrYnYxRVhFL3pTUzNqbFgzWEpVUkJnVm5hT1lYV0wzOGdUZHY3eG1xM09xM3FaNzJHekgrWQpveXIyQTJZSkxubDdXd0l2b3FZUDd1ZEgydWJlRzhzRlVRbVhOSFI2Z1QzRlVvNjdEWmZvS2lrVkROUTlKV3c5Ck5HUFhVRlRaUG1QTVJPd3pVdWNwTmNiS3pUTUd2U3QyejhWTHFvUytOWHcwTU80UmhoSUdJeHJVYUt0azRuQ2oKQnh1QWtCUjFzVzdiUzBVVjh1aW04WXNjQSt1bnN6TmRqdFFLMUJxaXB3c3ZMZTdnWW52Q3ZrYllRT2hRZCs3SQppRStZejV1VUppYUxkeHg2QW9BS0VtbGdEamJSMVpVTUJxTjg1Y1N5RGxUVVE2c3I2RStMMmNSYnZVaGR1eGU2ClBCMml5VWYvQWdNQkFBRUNnZ0VBRWdrZlloVU9OUTc4UFdldXl6aGZnQVBmZStDWlRDdzl2RERGRVJucHdHb0QKSVNSbEhvREJRNlNqMVBhMzJ6UHhwK3hqTFpjZWgwL0hCWWQxdWIzaHBHMXF4cXI0amM0VW9SUXBvLzEzVFVnQgpqYTZBZ045Y2dNemY5cDM2TGU3dWxPcXpEcmsrWTFYaHc2dldPWDllbkpmcy9tMGU2UTIxbTdlNXY2M3luT1dyCjN0cFhWcXNPNVhrVWwyb2lCQWNHNG1STnhOSzVkdTZjamJMSTlIenBZSEQrYVpNNVBnTDdUUDltQ3djN1M2dnEKWks4M1h2UC9DL0U2alJzMmwyTWJLRzFkSzllOVl3cnVaNmpCbTRVVVRtR0xOVU1JamVnZ09XTWNnaDVhVHRBRAo5N2JTUFovWHYxeWgwZzUyMkhNbUFHYW52WlZRNWs3VkIyY3dCc2FabVFLQmdRRG8zTm5EWGhsM1l2ajRFQUtDCk1TK2ZkVEp2NFYzem9oWnlLZlYxN053U2dpQ2ZQaldKbDduRGluSVdhR2p1QzY2OENPM0dURys5Q25IY2dLS2UKcnp5QWhaUGpzc2EvQVZuSGE0MDBTYm9Cb3RacUVQdnA5eTVQTzVnNGkyT1k3ZUFjTDZZakJsUmVmOUsyNUNkbQpIR1d3MjNnRG5UeDRXMDFncjY4Uk5GOVZEUUtCZ1FEZTdYditkVUhCT1BzcHNSVmVlV1FuWjB3WlJFVGxvSE1KCnZ3OVZsdlYrN1hIYTRDb0gyMUg5TU1IbkM5TkhuYmlTaUpvR09lc1FLMUowUnhVNjZMMkZDQUJnQk9USTlqYU4KZmNmaTNKcGZ4a2N3c2VWRXB1WmQrZHFZbVlPNjlRZG1nODJOa3o0emwrTWREU0RBOVQ5Uk1XS1V4WHZVSEVPcgpuTE9pU0VQbU93S0JnQ3V1c2xNSjVmRVZhZXJ1NWVtU1hJS25NNHoxVS9DT0tYUEZGenpGOEFxd3lublU2Nm9pCkFrRUNTYUNXZVlpZVBHc2RxYTBYVGFiQ3ZOVkdkRHNjV0ZjcnQ3QnhLd05OdDQvSFJ6ZlYxTVRWelM4Y2ZJVkoKVHpDaDEwNVVKNXpha3IzMjJrMmJ0RnY5MG9Ob2pWT0VaRGNuRkg1cEVwenBVN3lkZUZQYjVUNUpBb0dCQUlVNAp6Um5TL3htMnNMcElubW1ZQjlkWWJ1ekdsSm5abWdYZ0RRenNLd2ZRWkhNVjlXZytsQy9IL0lqVDAwNkFIZlpMCjlpZjBZdHFGMlQrdDN5MFdPM1FOeFJPY3VSQ3p1d1F4Zjh1K1krOEtjaTdTa1IzRzAvS2pSeFJjNFpGUHJ6MS8KVk03ZmlKT1NtR0liSDFEUS95YkphWTFZdTFpV0Q0YTJIYy9FZWZkVEFvR0FQRmcxZW14U1BoYUdCN3RKVkVFaQptNzhCUEhpZ01OTXd6VDFWRVcrV1BXeks4a3lvak1XU1puRkIyamEwZ25VL0dOSjkzY3F3T0xGck1aOCtSL1JyClRnRnVJZ0JENGRENUJ0MGd4WlQ1SC9QU0dUOGszUU0vYloxamZaTXk0WG1vTlFONytaVXIrS2EycWNaSjhMZHYKbmlvdGhGTGg3VmI4d0grTGhvNnVzaFE9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVWRENDQXJ5Z0F3SUJBZ0lSQUpkbVJpaHoxNWNpeXczUU5wTVgxVGd3RFFZSktvWklodmNOQVFFTEJRQXcKZFRFZU1Cd0dBMVVFQ2hNVmJXdGpaWEowSUdSbGRtVnNiM0J0Wlc1MElFTkJNU1V3SXdZRFZRUUxEQnhtYjNKMQpjM1JBWjJsbllXWnZjblZ6ZENBb1RYSkdiM0oxYzNRcE1Td3dLZ1lEVlFRRERDTnRhMk5sY25RZ1ptOXlkWE4wClFHZHBaMkZtYjNKMWMzUWdLRTF5Um05eWRYTjBLVEFlRncweU5URXlNRFV4TWpVME16UmFGdzB5T0RBek1EVXgKTWpVME16UmFNRkF4SnpBbEJnTlZCQW9USG0xclkyVnlkQ0JrWlhabGJHOXdiV1Z1ZENCalpYSjBhV1pwWTJGMApaVEVsTUNNR0ExVUVDd3djWm05eWRYTjBRR2RwWjJGbWIzSjFjM1FnS0UxeVJtOXlkWE4wS1RDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUx1c2dJNUJuQVJnZzVTS1hpR29PT3dXSkFocXBXSUQKOWg4cGtUMjFTZzhxM3haeU80anZjUEVWbmpOVzRnRFQ0WUhFdjNIZDdZY25IRFdOWG5qSW9LdUd2N2lMOUQyagpLMllNUGtXOGM4RmhJRzFycTJmNTR5YXYxbm1QVmtoYVk2WkJRdzRVT0ZCKzRYRHprbDJTZXcxQnBCV3JIQmZmCitYT2gzUUllcFRiZGdGalhsS0VQdEZuR0YrZFhyZmZmZm5Ucm80ejJ4QVpYeUdSb2pqZTZSbi9tMjJYeHZVRXYKcnhnUE5sM2Y4N0grZXpmZXgrQndMZWNSbVVhQkU0MEFmOHpobSs3T0JvZ1psQU4vZGU2TnZrT1JWdjRydGdIWgpaczFacGYzYmxqTGpwUmh2NGNwYVhPam44bW9UaEEzNUsrRVVUY3hBaUVZSE5pVHZFY2tMZXFjQ0F3RUFBYU9CCmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0V3SHdZRFZSMGoKQkJnd0ZvQVVYU25JWGM5cU55TktibDhEZjZ4T3V3UHZFQW93T0FZRFZSMFJCREV3TDRJVktpNW5hV2RoWm05eQpkWE4wTG1sdWRHVnlibUZzZ2hZcUxuZHZjbXR6ZEdGMGFXOXVMbWx1ZEdWeWJtRnNNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCZ1FETVdmMXUzQm5IRnV4TlpRN29CYnZBQk5Xb0xlOTlSb2N6TFk2c2dzZkdCZFFIWXdvUzMxT2EKZXgwT0ZYVXZQb2N2NWRIdWdtSlpvUlN0NDU1QndZRzVuTUM0VTJhY0NzNm53TjJGK2paa3BNL2xCUEdtek1WWgpvM0lNc1M0VU5IYzZXRGllRWp3Y1J1Q005bldWQnRrTmE4RTdsdWJxZk5SclhZTjB4L0YzWGpud2RWUS8wT0l0CnZvc2ZyRTRzMVJUdEhmY3VQWnhBZW9NSVdFN0pSQjRMOHhabHU5T0RZeituRGwva3BOTDkwVThHdXQwWFFucHgKY1RScVhnNC9nT1RKOUFlUnMwMHIrQU9wV1V3ZExFTmZnQVZ4Z0MrZ3FWVmFMV0NlVkFTWi9UNFJNWmt6K0YxeQpZRU5PR2o2L09hdm5wd25Wd21GcVRya1lHWURqU3RNWW9GZHBrWHB1VjY1dkg3Qnk4cHkyNmpMWFZ3VUpsUjQyClFUMGZnV0RDVFcxZTEwQ0o4N2NZMVNFQ3N2T2kwWVM0ZmtUTHJCM0FsMEhoQVZiWkFicmRSSHErMWQySzhtSTIKcUVpOXVPVnZZckZneHFtcWxIRUR1cFJMM095bWJ6bnRQeFZabXpzMmRiRXNVd0lxUXo0VFRiTzU4ZWs0eVI2dApQdG5hNyttNzJIMD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQzdySUNPUVp3RVlJT1UKaWw0aHFEanNGaVFJYXFWaUEvWWZLWkU5dFVvUEt0OFdjanVJNzNEeEZaNHpWdUlBMCtHQnhMOXgzZTJISnh3MQpqVjU0eUtDcmhyKzRpL1E5b3l0bURENUZ2SFBCWVNCdGE2dG4rZU1tcjlaNWoxWklXbU9tUVVNT0ZEaFFmdUZ3Cjg1SmRrbnNOUWFRVnF4d1gzL2x6b2QwQ0hxVTIzWUJZMTVTaEQ3Ulp4aGZuVjYzMzMzNTA2Nk9NOXNRR1Y4aGsKYUk0M3VrWi81dHRsOGIxQkw2OFlEelpkMy9PeC9uczMzc2ZnY0MzbkVabEdnUk9OQUgvTTRadnV6Z2FJR1pRRApmM1h1amI1RGtWYitLN1lCMldiTldhWDkyNVl5NDZVWWIrSEtXbHpvNS9KcUU0UU4rU3ZoRkUzTVFJaEdCellrCjd4SEpDM3FuQWdNQkFBRUNnZ0VBR1dmNDMwa3lmY1V6Q3VEUWJXNEFoclZZbTJzVWlIaFEwVmNuT2x0WWMwVXkKZmk5b3I5ajZTU2pNQ2RjeE1UdDl3N3VHenp0ajlHL3UrYkR4b1JoSDUvQ044OFcrZ3JtY0hteDU0YWJwWkx4cApUMmJNQlg5bXFNNFZFcys4dG43R0RyTzNDQ2prbHNFV2M5d0ZiSFZ3QXhObnl5Y20zblNMcUlPNUQ1aG1kVTY3CmlRR1c3bEd3WGJicWlTbUZ1NjIyaERNWWE0Z3RYUnB5cXkrZlpjcGNES29iSXpJRjBCcmhQRDN5RytCellhaFYKVVpIZVBlRm9mTjQvOXI4MTVmOWE3MndPSFBJa0Z6NWdNSlBIREdkUDh1aHdrdzlUOEV2NHAvT0lLZlJTYmc2cgp3VVdlMVowNFUzL0VvenkyczRwYURua1VYVXBoRytINzhnTnVta2VIQVFLQmdRREpOM0VSMURjMHplWEo0Um5oCmI3TldzY1RDV09sS2FkVGN2YlFFY3ViRnVjZzE3Vkc4UzNrVjhSYStmam9zVGNpN0hmR1dZSUc2MS90dXNXYTgKTDVJVUNRNnJlSFhpempLM1BsK0oyOW9TM1RhbjZDdDlxOEtaalYwMXZKTXEzYk1FQVg5VUVwL2JTbHdPUWVqeApOZkZrZ2JFMkRmSEJRVTY3SVlsQ2lVMy9FUUtCZ1FEdXhTWGd3UTRYT1h6T1hrMzlVZE56TVB3S2tDUFhMZkgxCjRGbElTUXZHU05QY1FmK0t0WVVvL1hGNXF2RkkxTUNEa1JBT01FMWZCcFQ4OW9wbEVLUXQ3M3RLc1BoUHhzSHgKem5sL2t0MVRZdUZrcDZtdk9wOHpLdHZqRGVoRGoxUmJZTVN3OFZJNkNlSTRqcDZoSmdZQVhhNURwbFkxM3dFegpHMnhCV1dyT053S0JnRDQ3UEdna056TEluMUlSb1h4OG5IMnFtMHowVEtxc0VwNTJ1VzlLemg3Rzk2bmVEUkpzClVUVzlDNmk4eDJjZVkzK2pvaTA5Q2NKc3ZDR2ZFa1FQZm1GZDc4Q09qLzhtZ0w3MXRueWZsMUdRUXpBbytSSjAKQmNxUjB3c2ttR3VBaDdZc2RHSGZKTHVnd3RuUi9xWmpaWllOR202NlgxUEN6QVBLT25adW1zWFJBb0dBY2pURQphRnVQRk5hL2Rxb3UzWkxzOC9VaktSNUd0bDdZbEFYS1RzUDVxTThlM3dTR2FWOW5vUEtRKzJRall2VzRXM1hnCld4a0plUUZaOUNFc2t5akJqdU0wY3NaeER4OS9sdHh1eXZHQmdhZ1RMU1R4Q2NxZGFVai93ZnZkODZxejY3MCsKZDNBR0o1S2dyUEt5dDF2TGxSTTZEa3VhZ3N2MjgrNFMrckw5WGtNQ2dZQjQ0d0IzdUs4N0lsK3F0dGFNdG5SQwp5NkcwNlBsUkZlbGF6THoxc2F0aC9Gam1JUm5rd2tqcUEzRFRwV04wM1RWRStqdDRQY2h5VkQ2cWw0S3JJQzZMCjdKWDc4Qm1Yc1NGTkxZZ3h4NUNCejJUU0wvODA1amdVRnVmZGg5TjlWZm9YWnJKSldSakpqTTg4UU5xTmxNSWMKbVVobkMzU01kajdkdDVMSU9pNE5NUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+kind: Secret
+metadata:
+  name: local-tls
+type: kubernetes.io/tls
@@ -2,6 +2,17 @@

 hostNetwork: true

+securityContext:
+  capabilities:
+    add:
+      - NET_BIND_SERVICE
+
+podSecurityContext: ~
+
+service:
+  spec:
+    type: ClusterIP
+
 api:
  dashboard: true
  insecure: true
@@ -63,6 +74,13 @@ certificatesResolvers:
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
      httpChallenge:
        entryPoint: web
+  letsencrypt:
+    acme:
+      email: bobrovod@national.shitposting.agency
+      storage: /data/letsencrypt/acme.json
+      caServer: https://acme-v02.api.letsencrypt.org/directory
+      httpChallenge:
+        entryPoint: web

 volumes:
  - name: traefik-dynamic