Aleksei Sviridkin 4218e4cd19 feat(ingress): issue shared DNS-01 wildcard on the publishing controller ...

When the platform signals shared wildcard issuance via
_cluster.wildcard-issue, the publishing controller (Release.Namespace ==
expose-ingress) renders one cert-manager Certificate for <root-host> +
*.<root-host>. The resulting Secret is served as the controller's default
SSL certificate and the existing wildcard-secret-name consumption path
makes the system services drop per-host ACME. The Certificate uses the
DNS-01 ClusterIssuer that cert-manager-issuers already renders in dns01
mode, so no per-tenant Issuer is minted. Only the publishing controller
renders it — the Secret must be same-namespace for ingress-nginx to read
it.

Part of #2811.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-06-22 20:01:40 +03:00

..

bootbox

Prepare release v1.5.0

2026-06-22 10:55:37 +00:00

etcd

fix(etcd): set VPA updateMode to Initial to stop member-evicting churn

2026-06-18 14:08:48 +05:00

external-dns

fix(platform): drop deprecated upgrade.force from HelmReleases; fix kafka WorkloadMonitor replicas paths

2026-05-28 12:43:50 +05:00

gateway

feat(platform,gateway): distribute operator wildcard secret name

2026-06-10 03:08:07 +03:00

info

fix(info): use root-host for Keycloak OIDC issuer URL in tenant kubeconfig

2026-05-21 11:28:20 +05:00

ingress

feat(ingress): issue shared DNS-01 wildcard on the publishing controller

2026-06-22 20:01:40 +03:00

monitoring

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

seaweedfs

Prepare release v1.5.0

2026-06-22 10:55:37 +00:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00