From 8a7700e49a905d20165f72d198877a1be40a7550 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 22:39:47 -0500 Subject: [PATCH] fix(tls): switch dev to LE production issuer so in-cluster clients trust the wildcard cert MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit oauth2-proxy + Grafana OIDC discovery to keycloak.home.keithjackson.dev failed x509 'unknown authority' — the wildcard was LE-staging (untrusted). Prod issuer is registered + Ready; switching ACME_CLUSTER_ISSUER dev override staging->prod re-issues a publicly trusted cert. Needed for functional SSO (R-IDP) + R-TLS-01/03 'trusted'. NOTE: the trusted-tls conformance test embeds the LE-staging root and must be updated to the LE production root (ISRG Root X1) / system trust — follow-up. Co-Authored-By: Claude Opus 4.8 --- clusters/dev/kustomization.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/clusters/dev/kustomization.yaml b/clusters/dev/kustomization.yaml index 53abd1c..09e4dbe 100644 --- a/clusters/dev/kustomization.yaml +++ b/clusters/dev/kustomization.yaml @@ -58,10 +58,12 @@ patches: - op: replace path: /data/CLUSTER_ENV value: "dev" - # DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006. + # DNS-01 via LE PRODUCTION: in-cluster OIDC clients (oauth2-proxy, Grafana) must trust the + # wildcard cert for SSO to work; the staging root isn't in any trust store. Prod issuer is + # registered + Ready; one wildcard cert is well within LE rate limits — ADR-0006, R-TLS-01/03. - op: replace path: /data/ACME_CLUSTER_ISSUER - value: "letsencrypt-staging" + value: "letsencrypt-prod" # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas. - op: replace path: /data/LONGHORN_DEFAULT_REPLICA_COUNT