panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

修复 cert-manager Gateway API ACME solver
yaml / yaml (pull_request) Successful in 11s
Details

Browse Source
This commit is contained in:
panxiao81
2026-09-16 12:16:23 +00:00
parent aae19850cf
commit 40703782ea
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/cert-manager/README.md
+4
View File
@@ -119,6 +119,10 @@ issuerRef:
kind: ClusterIssuer kind: ClusterIssuer
``` ```
`values.yaml` 必须保持 `config.gatewayAPI.enabled: true`。`bao-acme` 的 HTTP-01
solver 通过共享 Gateway 创建临时 HTTPRoute；关闭该项不会让 ClusterIssuer 变为
NotReady，而是会让每个 Challenge 卡在 `gateway api is not enabled`。
Issuance is capped by `default_directory_policy = role:bao-server` Issuance is capped by `default_directory_policy = role:bao-server`
(`../../infrastructure/openbao/terraform/pki.tf`), which permits `ad.ddupan.top` subdomains only. Clients (`../../infrastructure/openbao/terraform/pki.tf`), which permits `ad.ddupan.top` subdomains only. Clients
need the internal CA in their trust store — already true for the PVE nodes, the DC and need the internal CA in their trust store — already true for the PVE nodes, the DC and
platform/cert-manager/values.yaml
+7
View File
@@ -44,6 +44,13 @@ cainjector:
limits: limits:
memory: 256Mi memory: 256Mi
# bao-acme solves HTTP-01 through the shared Gateway. The ClusterIssuer can be
# accepted while this is disabled, but every Challenge then stays pending with
# "gateway api is not enabled". Gateway API CRDs are installed by Envoy Gateway.
config:
gatewayAPI:
enabled: true
# ⚠ DNS-01 self-check: cert-manager polls authoritative NS for the _acme-challenge # ⚠ DNS-01 self-check: cert-manager polls authoritative NS for the _acme-challenge
# TXT record before telling the CA to validate. By default it asks the cluster's # TXT record before telling the CA to validate. By default it asks the cluster's
# resolver, which for ad.ddupan.top is CoreDNS -> the Samba AD DC (k3s/coredns-custom.yaml). # resolver, which for ad.ddupan.top is CoreDNS -> the Samba AD DC (k3s/coredns-custom.yaml).