Skip to content

Commit 2b6e20c

Browse files
myasnikovdaniilmyasnikovdaniil
committed
fix(platform): migrate ACME HTTP-01 to ingressClassName API
ClusterIssuer solver referenced IngressClass "nginx" which does not exist on cozystack clusters — real classes are named after tenant namespaces (e.g. tenant-root). Cert issuance only worked because every requesting Ingress overrode the ClusterIssuer via the legacy acme.cert-manager.io/http01-ingress-class annotation. Switch both sides to the modern cert-manager API (available since cert-manager 1.12; cozystack ships 1.19.3): - ClusterIssuer: http01.ingress.ingressClassName, value parameterized from _cluster.expose-ingress (default "tenant-root") - Ingress annotation: http01-ingress-ingressclassname These must migrate together — mixing ingressClassName (ClusterIssuer) with the old http01-ingress-class annotation triggers cert-manager's "fields ingressClassName and class cannot be set at the same time" validation and breaks issuance. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
1 parent 171c793 commit 2b6e20c

11 files changed

Lines changed: 18 additions & 17 deletions

File tree

‎packages/apps/harbor/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ metadata:
1515
nginx.ingress.kubernetes.io/ssl-redirect: "true"
1616
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
1717
{{- if eq $solver "http01" }}
18-
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
18+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
1919
{{- end }}
2020
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
2121
spec:

‎packages/extra/bootbox/templates/matchbox/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ metadata:
1010
app: bootbox
1111
annotations:
1212
{{- if eq $solver "http01" }}
13-
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
13+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
1414
{{- end }}
1515
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
1616
{{- if .Values.whitelistHTTP }}

‎packages/extra/seaweedfs/templates/seaweedfs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ spec:
243243
nginx.ingress.kubernetes.io/proxy-body-size: "0"
244244
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
245245
{{- if eq $solver "http01" }}
246-
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
246+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
247247
{{- end }}
248248
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
249249
tls:

‎packages/system/bucket/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ metadata:
1212
nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
1313
nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
1414
{{- if eq $solver "http01" }}
15-
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
15+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
1616
{{- end }}
1717
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
1818
spec:

‎packages/system/cert-manager-issuers/templates/cluster-issuers.yaml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{{- $solver := (index .Values._cluster "solver") | default "http01" }}
2+
{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
23

3-
apiVersion: cert-manager.io/v1
4+
apiVersion: cert-manager.io/v1
45
kind: ClusterIssuer
56
metadata:
67
name: letsencrypt-prod
@@ -17,9 +18,9 @@ spec:
1718
name: cloudflare-api-token-secret
1819
key: api-token
1920
{{- else }}
20-
http01:
21-
ingress:
22-
class: nginx
21+
http01:
22+
ingress:
23+
ingressClassName: {{ $exposeIngress }}
2324
{{- end }}
2425

2526
---
@@ -41,9 +42,9 @@ spec:
4142
name: cloudflare-api-token-secret
4243
key: api-token
4344
{{- else }}
44-
http01:
45-
ingress:
46-
class: nginx
45+
http01:
46+
ingress:
47+
ingressClassName: {{ $exposeIngress }}
4748
{{- end }}
4849

4950
---

‎packages/system/dashboard/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ metadata:
1111
annotations:
1212
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
1313
{{- if eq $solver "http01" }}
14-
acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
14+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
1515
{{- end }}
1616
nginx.ingress.kubernetes.io/rewrite-target: /
1717
nginx.ingress.kubernetes.io/client-max-body-size: 100m

‎packages/system/keycloak/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ metadata:
1111
{{- with .Values.ingress.annotations }}
1212
annotations:
1313
{{- if eq $solver "http01" }}
14-
acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
14+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
1515
{{- end }}
1616
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
1717
{{- toYaml . | nindent 4 }}

‎packages/system/linstor-gui/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ metadata:
2222
annotations:
2323
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
2424
{{- if eq $solver "http01" }}
25-
acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
25+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
2626
{{- end }}
2727
nginx.ingress.kubernetes.io/proxy-body-size: 100m
2828
# Keycloak access+refresh+id tokens make the oauth2-proxy session

‎packages/system/monitoring/templates/alerta/alerta.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ metadata:
181181
app: alerta
182182
annotations:
183183
{{- if eq $solver "http01" }}
184-
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
184+
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
185185
{{- end }}
186186
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
187187
spec:

‎packages/system/monitoring/templates/grafana/grafana.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ spec:
7474
metadata:
7575
annotations:
7676
{{- if eq $solver "http01" }}
77-
acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
77+
acme.cert-manager.io/http01-ingress-ingressclassname: "{{ $ingress }}"
7878
{{- end }}
7979
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
8080
spec:

0 commit comments

Comments
 (0)