ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/postgres/config/certificate.yaml

@@ -0,0 +1,55 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vault-postgres
+spec:
+  vault:
+    path: pki_postgres/sign/server
+    server: https://vault-active-tls.vault.svc.cluster.local:443
+    serverName: vault-active-direct.vault.svc.cluster.local
+    caBundleSecretRef:
+      name: vault-root-ca
+      key: ca.crt
+    auth:
+      kubernetes:
+        role: cert-manager-postgres
+        mountPath: /v1/auth/kubernetes
+        serviceAccountRef:
+          name: cert-manager
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: main-server-vault
+  namespace: postgres
+spec:
+  secretName: main-server-vault
+  duration: 2160h
+  renewBefore: 360h
+  secretTemplate:
+    labels:
+      cnpg.io/reload: ""
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+  usages:
+    - server auth
+  dnsNames:
+    - main-rw
+    - main-rw.postgres
+    - main-rw.postgres.svc
+    - main-rw.postgres.svc.cluster.local
+    - main-rw-lb
+    - main-rw-lb.postgres
+    - main-rw-lb.postgres.svc
+    - main-rw-lb.postgres.svc.cluster.local
+    - main-ro-lb
+    - main-ro-lb.postgres
+    - main-ro-lb.postgres.svc
+    - main-ro-lb.postgres.svc.cluster.local
+    - postgres-rw.quorate.internal
+    - postgres-ro.quorate.internal
+  issuerRef:
+    name: vault-postgres
+    kind: ClusterIssuer