97 lines
2.3 KiB
YAML
97 lines
2.3 KiB
YAML
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: ha-gateway-tls
|
|
namespace: home-services
|
|
spec:
|
|
secretName: ha-gateway-tls
|
|
issuerRef:
|
|
name: internal-ca-issuer
|
|
kind: ClusterIssuer
|
|
commonName: ha-gateway
|
|
dnsNames:
|
|
- ha-gateway.home-services.svc.cluster.local
|
|
- ha-gateway
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
- key encipherment
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: discord-bot-tls
|
|
namespace: home-services
|
|
spec:
|
|
secretName: discord-bot-tls
|
|
issuerRef:
|
|
name: internal-ca-issuer
|
|
kind: ClusterIssuer
|
|
commonName: discord-bot
|
|
usages:
|
|
- client auth
|
|
- digital signature
|
|
- key encipherment
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: ai-gateway-tls
|
|
namespace: home-services
|
|
spec:
|
|
secretName: ai-gateway-tls
|
|
issuerRef:
|
|
name: internal-ca-issuer
|
|
kind: ClusterIssuer
|
|
commonName: ai-gateway
|
|
dnsNames:
|
|
- ai-gateway.home-services.svc.cluster.local
|
|
- ai-gateway
|
|
usages:
|
|
- server auth
|
|
- client auth
|
|
- digital signature
|
|
- key encipherment
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: tts-gateway-tls
|
|
namespace: home-services
|
|
spec:
|
|
secretName: tts-gateway-tls
|
|
issuerRef:
|
|
name: internal-ca-issuer
|
|
kind: ClusterIssuer
|
|
commonName: tts-gateway
|
|
dnsNames:
|
|
- tts-gateway.home-services.svc.cluster.local
|
|
- tts-gateway
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
- key encipherment
|
|
---
|
|
# Client-only cert for alexa-bridge's mTLS call to ha-gateway - modeled on
|
|
# discord-bot-tls above, not ai-gateway-tls, since alexa-bridge (like
|
|
# discord-bot) only dials out over mTLS and doesn't itself serve mTLS gRPC.
|
|
# This is a distinct cert/issuer from alexa-bridge's public HTTPS ingress
|
|
# cert (see alexa-bridge-public-ingress.yaml) - that one is letsencrypt-prod
|
|
# for the internet-facing Alexa endpoint; this one is the internal CA for
|
|
# the ha-gateway leg. Do not conflate the two.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: alexa-bridge-tls
|
|
namespace: home-services
|
|
spec:
|
|
secretName: alexa-bridge-tls
|
|
issuerRef:
|
|
name: internal-ca-issuer
|
|
kind: ClusterIssuer
|
|
commonName: alexa-bridge
|
|
usages:
|
|
- client auth
|
|
- digital signature
|
|
- key encipherment
|