mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-23 03:27:50 +09:00
IvanHunters
37f59369d3
Charts that publish a service compose their hostname as <sub>.<_namespace.host>. When the injected tenant apex is empty and no per-app host override is set, they used to emit a malformed trailing-dot hostname (e.g. "harbor.") into Ingresses, HTTPRoutes and Certificate dnsNames silently. Source the apex through cozy-lib.ns-host-required at each hostname-emitting site so the render fails with a clear message instead, matching the gateway path. Covered: harbor, postgres (external), qdrant (external), kubernetes (control-plane endpoint), vpn, seaweedfs, bootbox, monitoring (grafana, alerta, oidc client), and system/bucket (adds the cozy-lib subchart symlink it lacked). The guard is placed at the point each resource is actually emitted, so standalone renders, no-exposure tenants and the kubernetes no-etcd beacon path are unaffected. The post-delete cleanup hooks are left unguarded so an empty apex cannot block uninstall. Behavior change: a tenant with an empty injected apex and no host override that enables one of these components now fails its render (HelmRelease NotReady) instead of deploying a broken hostname. In practice the apex is always injected (root has root-host, children inherit it), so this only trips a genuinely misconfigured tenant. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
47 lines
1.8 KiB
YAML
47 lines
1.8 KiB
YAML
{{- $solver := (index .Values._cluster "solver") | default "http01" }}
|
|
{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
|
|
{{- $ingress := .Values._namespace.ingress }}
|
|
{{- $host := include "cozy-lib.ns-host-required" . }}
|
|
{{- $wildcardSecret := (index .Values._cluster "wildcard-secret-name") | default "" }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: bootbox
|
|
labels:
|
|
app: bootbox
|
|
{{- /* Operator wildcard mode: nginx serves the default SSL cert, so skip per-host ACME. Render annotations only when something remains. */}}
|
|
{{- if or (not $wildcardSecret) .Values.whitelistHTTP }}
|
|
annotations:
|
|
{{- if not $wildcardSecret }}
|
|
{{- if eq $solver "http01" }}
|
|
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
|
|
{{- end }}
|
|
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
|
|
{{- end }}
|
|
{{- if .Values.whitelistHTTP }}
|
|
nginx.ingress.kubernetes.io/whitelist-source-range: "{{ join "," (.Values.whitelist | default "0.0.0.0/32") }}"
|
|
{{- end }}
|
|
{{- end }}
|
|
spec:
|
|
ingressClassName: {{ $ingress }}
|
|
tls:
|
|
- hosts:
|
|
- "{{ printf "bootbox.%s" (.Values.host | default $host) }}"
|
|
{{- /* Operator wildcard mode: no per-host secret — ingress-nginx falls
|
|
back to the default SSL certificate while the tls section keeps
|
|
the HTTP-to-HTTPS redirect enforced. */}}
|
|
{{- if not $wildcardSecret }}
|
|
secretName: bootbox-tls
|
|
{{- end }}
|
|
rules:
|
|
- host: "{{ printf "bootbox.%s" (.Values.host | default $host) }}"
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
backend:
|
|
service:
|
|
name: bootbox
|
|
port:
|
|
name: http
|