44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
# Routes requests for demo.ahmza.com through ingress-nginx (docs/11-ingress.md)
|
|
# to the demo Service's ClusterIP, on ingress-nginx's one shared address
|
|
# (10.10.60.12) instead of this app having its own dedicated MetalLB address.
|
|
#
|
|
# No ingressClassName is set here because apps/ingress-nginx/values.yaml
|
|
# marks its IngressClass as this cluster's default — the same "don't repeat
|
|
# yourself" convenience Longhorn gives PVCs that don't name a
|
|
# storageClassName.
|
|
#
|
|
# cert-manager.io/cluster-issuer triggers cert-manager's "ingress-shim": it
|
|
# notices this annotation, creates a Certificate resource for the
|
|
# hostname(s) in tls.hosts below, and keeps it renewed automatically
|
|
# forever. This was proven against letsencrypt-staging first — see
|
|
# docs/12-cert-manager.md — before switching to the real, browser-trusted
|
|
# letsencrypt-prod here. Always prove a new hostname against staging
|
|
# first; production has much stricter rate limits.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: demo
|
|
namespace: demo
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- demo.ahmza.com
|
|
# cert-manager creates and keeps this Secret updated automatically —
|
|
# nothing to create by hand, and nothing to encrypt with sops; a TLS
|
|
# certificate isn't a credential you chose, it's issued fresh by
|
|
# Let's Encrypt and safe to regenerate at any time.
|
|
secretName: demo-tls
|
|
rules:
|
|
- host: demo.ahmza.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: demo
|
|
port:
|
|
number: 80
|