55 lines
1.3 KiB
YAML
55 lines
1.3 KiB
YAML
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: ClusterIssuer
|
||
|
|
metadata:
|
||
|
|
name: vault-postgres
|
||
|
|
spec:
|
||
|
|
vault:
|
||
|
|
path: pki_postgres/sign/server
|
||
|
|
server: https://vault-active-tls.vault.svc.cluster.local:443
|
||
|
|
serverName: vault-active-direct.vault.svc.cluster.local
|
||
|
|
caBundleSecretRef:
|
||
|
|
name: vault-root-ca
|
||
|
|
key: ca.crt
|
||
|
|
auth:
|
||
|
|
kubernetes:
|
||
|
|
role: cert-manager-postgres
|
||
|
|
mountPath: /v1/auth/kubernetes
|
||
|
|
serviceAccountRef:
|
||
|
|
name: cert-manager
|
||
|
|
---
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: main-server-vault
|
||
|
|
namespace: postgres
|
||
|
|
spec:
|
||
|
|
secretName: main-server-vault
|
||
|
|
duration: 2160h
|
||
|
|
renewBefore: 360h
|
||
|
|
secretTemplate:
|
||
|
|
labels:
|
||
|
|
cnpg.io/reload: ""
|
||
|
|
privateKey:
|
||
|
|
algorithm: ECDSA
|
||
|
|
size: 256
|
||
|
|
rotationPolicy: Always
|
||
|
|
usages:
|
||
|
|
- server auth
|
||
|
|
dnsNames:
|
||
|
|
- main-rw
|
||
|
|
- main-rw.postgres
|
||
|
|
- main-rw.postgres.svc
|
||
|
|
- main-rw.postgres.svc.cluster.local
|
||
|
|
- main-rw-lb
|
||
|
|
- main-rw-lb.postgres
|
||
|
|
- main-rw-lb.postgres.svc
|
||
|
|
- main-rw-lb.postgres.svc.cluster.local
|
||
|
|
- main-ro-lb
|
||
|
|
- main-ro-lb.postgres
|
||
|
|
- main-ro-lb.postgres.svc
|
||
|
|
- main-ro-lb.postgres.svc.cluster.local
|
||
|
|
- postgres-rw.quorate.internal
|
||
|
|
- postgres-ro.quorate.internal
|
||
|
|
issuerRef:
|
||
|
|
name: vault-postgres
|
||
|
|
kind: ClusterIssuer
|