diff --git a/kubernetes/system/caddy/caddyfile.yaml b/kubernetes/system/caddy/caddyfile.yaml index 65e988f..d383978 100644 --- a/kubernetes/system/caddy/caddyfile.yaml +++ b/kubernetes/system/caddy/caddyfile.yaml @@ -2,7 +2,7 @@ # This file contains all route definitions, imported by the main Caddyfile. # Edit this file to add/modify routes. # -# Certificate files are mounted from the caddy-certificates Secret +# Certificate files are mounted from cert-manager-managed TLS Secrets # at /etc/caddy/certs/ apiVersion: v1 diff --git a/kubernetes/system/caddy/kustomization.yaml b/kubernetes/system/caddy/kustomization.yaml index 9f8c9a4..7fe53d7 100644 --- a/kubernetes/system/caddy/kustomization.yaml +++ b/kubernetes/system/caddy/kustomization.yaml @@ -6,7 +6,6 @@ resources: - repository.yaml - release.yaml - certificates.yaml - - ovh-credentials-secret.yaml - caddyfile.yaml secretGenerator: - name: caddy-values diff --git a/kubernetes/system/caddy/ovh-credentials-secret.yaml b/kubernetes/system/caddy/ovh-credentials-secret.yaml deleted file mode 100644 index 05131ce..0000000 --- a/kubernetes/system/caddy/ovh-credentials-secret.yaml +++ /dev/null @@ -1,45 +0,0 @@ -# OVH API Credentials for DNS-01 Challenges -# -# OVH API credentials with the following permissions: -# - GET, POST, PUT, DELETE on /domain/zone/* -# -# SOPS will encrypt them on pre-commit. -apiVersion: v1 -kind: Secret -metadata: - name: ovh-credentials - namespace: caddy - labels: - app.kubernetes.io/name: caddy - app.kubernetes.io/component: ovh-credentials -type: Opaque -stringData: - applicationKey: ENC[AES256_GCM,data:kBPCJRdm3VeoFKsmig+l8g==,iv:Y21zRzFpA7tqjNFruHCIIZV8hsSGhypZhcWgh7AcUus=,tag:8F0160EP0ELVFe4bp2AarA==,type:str] - applicationSecret: ENC[AES256_GCM,data:0r9bolcuWfbgQ993L+wPZaqfLB4TXcptCFw+/D9t9LI=,iv:j1pdJI4DrAzQxP8W/qJ0UBg/2rZQn/Z3aY0qZcqJqQ8=,tag:wNk8FxsUXBUiiYEayl3c1g==,type:str] - consumerKey: ENC[AES256_GCM,data:79prnqUwFgpc6peVWYtkp+L66HuB7bcXHNljSdVkpqU=,iv:sxNGszLobl7/uK6HpXhuUlA9BiURS9j9bLjeY+iwrxw=,tag:JoOKkvK+y5k45U9M6TC1cA==,type:str] -sops: - lastmodified: "2026-07-09T22:12:21Z" - mac: ENC[AES256_GCM,data:xPUFPlXWHWY/c/EzhfQhWc0JsRZ6qvuB7amxksqkotSbIIYuw90YheKHNwj9ZEqlE2gSmZYI0Cog03KCZlijeX7qKOWDgiLSf4zFT/X0uxcUoOuWvrj2nISjqT+mUJFjzPPHwBgtObH+N0LEYGhURdeJgIvbKh15kZRNqxKlCQw=,iv:E9xOdeiX+lbLR8Lz3APEYudOeF5mQk0Nvq2byzXiSxg=,tag:shDwlpvDfzacKiPuqzQzrg==,type:str] - pgp: - - created_at: "2026-07-09T22:12:21Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA7uy4qQr71wiAQ//b7KcKq2BXfSU8DynNDo/QlZ77lfCYHsPMutbNh5ckpCi - JPoy06kZ9JtwET86lnv8awUuztA1CPN6uarrGqokZW4zaATHmQ0M5qHHOXClnI+X - VIL3/mcCH/sTN+/RO0vmnPcah8XnETzy/51GDvoMAeFIndVz/t/uKbAErwch1+Ol - Ds51d0MrdZxCAXxYcWr9WcLK7rLCyFd0r+TFb4buHswNIRNQvzJti0rkPac7wFNE - vjb05wr3ejdes5P9drQF5sUhZXZHAWOoZUKGBm4hUBLaQqSfqFnskKeSuyVXR+di - xiqrkuvOydNSPVpO9M+qCyZqiiE+cPL1t8wwqXiNPUhibeKsdUKOibI/XGO4QvCr - wDZt/Dcj8JfVw6SFEUP/TVaP+SW4T8tEoxIScR17DEn/eKiFp/dFQZ9pokaKM2kd - uhxrO7/FbA5KDMK2IZncV40IioAG/caFswM944ShMbJ5IJlFQv7OASPjwtauGnuY - 9O/7XMAZas7u+PhBuxqdQ/3YVrCVyYnvxsQ/+TbX6pIY1w9rgwh+XamVln083P+c - 4gcBfL/1vv2RzVKhkAQ9k5++Af3Vn6JpkKu1FqUHVmOf3nH9vUxqQTwSwAu6Pi2W - 6BZKq0UdbYi6v6Ozi06V1z4qa0t2IC+LOA5dILpReE7M2EM+b/tRRpp514NAmUzS - XAEAAY0b6IKDlwAqHQVAg2TuTDGHm7rHSpxtllsXx+902zYttisRZKjQgJuWLdST - kb4WPMRUq1y97BMJddXjf6L6ganzRSpDV/1cq832S8x+7Qe2aiQ6/nnLxP0I - =8mxw - -----END PGP MESSAGE----- - fp: DC6910268E657FF70BA7EC289974494E76938DDC - encrypted_regex: ^(data|stringData|.*.key|.*.crt)$ - version: 3.10.2 diff --git a/kubernetes/system/cert-manager-issuer/kustomization.yaml b/kubernetes/system/cert-manager-issuer/kustomization.yaml index 9a27bac..d92a3f6 100644 --- a/kubernetes/system/cert-manager-issuer/kustomization.yaml +++ b/kubernetes/system/cert-manager-issuer/kustomization.yaml @@ -3,3 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - clusterissuer.yaml + - ovh-credentials-secret.yaml + - ovh-secret-reader-rbac.yaml diff --git a/kubernetes/system/cert-manager-issuer/ovh-credentials-secret.yaml b/kubernetes/system/cert-manager-issuer/ovh-credentials-secret.yaml new file mode 100644 index 0000000..234fa1f --- /dev/null +++ b/kubernetes/system/cert-manager-issuer/ovh-credentials-secret.yaml @@ -0,0 +1,50 @@ +# OVH API Credentials for DNS-01 Challenges +# +# OVH API credentials with the following permissions: +# - GET, POST, PUT, DELETE on /domain/zone/* +# +# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager), +# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace +# to the webhook's own namespace, and the webhook looks up credential secrets +# there (see ch.ResourceNamespace in the webhook's ovhClient() function). +# +# SOPS will encrypt the stringData fields on pre-commit. +apiVersion: v1 +kind: Secret +metadata: + name: ovh-credentials + namespace: cert-manager + labels: + app.kubernetes.io/name: cert-manager-webhook-ovh + app.kubernetes.io/component: ovh-credentials +type: Opaque +stringData: + applicationKey: ENC[AES256_GCM,data:0+y+m8n/eup5lY/vGW5ASQ==,iv:VSIhfNAvSNOLq92TVcaW54ygU1wgAv+u35HZ0cbP6UU=,tag:KD+cyIesTQgqEzGMro8xyA==,type:str] + applicationSecret: ENC[AES256_GCM,data:sP0febHRFF/atAFlRM6sYXoM+Lp6Rnf7d0IQKcsa0vY=,iv:nHYMHSsOclkZmQJSjcz2oXMHsDTct5hTmJz1L7xgvpA=,tag:oCGoRP7R0W+PTNRCeLFvyg==,type:str] + consumerKey: ENC[AES256_GCM,data:vw/Q39CpSc5o1ntPDMT3844aLbTHQrSYH8RhoZFFZrQ=,iv:6B0F9Zq56inpW7AS8okbpqJkRK3WkBjX6sIqclOP9Hs=,tag:nnbgwBMBM4JZg/IEYzRvVw==,type:str] +sops: + lastmodified: "2026-07-10T05:06:52Z" + mac: ENC[AES256_GCM,data:0/VEDE1ZuIyzkaleosS/KHYX44762TbScrJGJylwV21d7U6YgpwRMOXvU9xn3rHsDXnh5IAmAtrXQTYJFN1vcF1DNw5O9+TQKVoO6B5rsel/YyKRU4s7aYcfDgbW9dO1wn33K65KFtM+0Qv187DzEn1by449TgWIWP/M5U40PE4=,iv:hIGzMwsas8VxC4941ABeoocYWSlVSz9KW7a5tTAoRXI=,tag:n/EJEkEBL20carqVesMBsw==,type:str] + pgp: + - created_at: "2026-07-10T05:06:52Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiARAAu0va03SPYOU23iUjoTMiXJ6+nMhIX8lsurvmCvi+wIqk + c7qu0lTfXv62IjkY6fIKtOE7TN9TiipjzXG2QJaK94QeiFpe9M90qNo09qEIje9m + DepTrLfyINFT0SY2eihl+nXhBXuEDSiD5K60OsXGPN92hJMwCad5jJuB7xpmrX0m + X0A1Bl9orce/do/YJoy5hq0persB/VSeCKlptNzqpmpRIA3J6AdCDKXQOMqAymXN + FXAxbjEQNcXhfU12Y/cVpa1hS7ap5OJCnWOPkFEA8y1ESVnPpryuTIfVlFUhW3/Z + Dhpb9OXKdi2IVYdbaY8+3UfSsXxTVOge7jCMbJq3aa7ZvGt5fTjXG4zc9A6RqSGh + ASOPSkRRSZB0d97NhUQJGgfcaWFvsfkaTAUVB2Ip/+Udnt/tGIE99RGJizxSVO9N + 2aVJIukqng8aNPfth8mgWYJpCETMb4piLmVg2ptDqelCqXlUAskxWzMWtAhyzOgw + lZ2dcAn7aj9YtLaKAW9rjV8EqHEqQg0ychRNMeyRiN/CnNJp6Q2wl1/EyQUpzb0a + 1I/ifFAW8FbWTVIbZv6njkl1XNaoav54qEn1qSABcljM0h1Ulb9WKMJiXH4368jf + Yhl38JDAn5NZBEzxpuaih1XK5yVri0/1ascpuMvfOxLKniUR9tla8+WEL97+aejS + XgGsrH+/uzRVSAT+44rExi43MWCAwNRUaVrX8UiGjA/z8qPVdwBVih4CMKgfQ8VW + 1KewStOY217BXuVrDbvHEAkuOotEP0Jnan0epoWs47DSasNgzAcWrBgom0l/avI= + =Gdou + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(data|stringData|.*.key|.*.crt)$ + version: 3.10.2 diff --git a/kubernetes/system/cert-manager-issuer/ovh-secret-reader-rbac.yaml b/kubernetes/system/cert-manager-issuer/ovh-secret-reader-rbac.yaml new file mode 100644 index 0000000..1145617 --- /dev/null +++ b/kubernetes/system/cert-manager-issuer/ovh-secret-reader-rbac.yaml @@ -0,0 +1,41 @@ +# RBAC granting the cert-manager-webhook-ovh service account read access to the +# OVH credentials secret. +# +# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role +# when using its built-in `issuers[]` mechanism. Since we manage the +# ClusterIssuer and the credentials secret manually, we declare the RBAC here. +# +# The webhook runs in the cert-manager namespace under the +# `cert-manager-webhook-ovh` service account (created by the Helm release). +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-webhook-ovh:ovh-secret-reader + namespace: cert-manager + labels: + app.kubernetes.io/name: cert-manager-webhook-ovh + app.kubernetes.io/component: ovh-secret-reader +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "watch"] + resourceNames: + - ovh-credentials +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-webhook-ovh:ovh-secret-reader + namespace: cert-manager + labels: + app.kubernetes.io/name: cert-manager-webhook-ovh + app.kubernetes.io/component: ovh-secret-reader +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-webhook-ovh:ovh-secret-reader +subjects: + - apiGroup: "" + kind: ServiceAccount + name: cert-manager-webhook-ovh + namespace: cert-manager