feat(cert-manager): switch to algorithm P-384 (#18098)

hongbo-miao · Jul 18, 2024 · 2f942b5 · 2f942b5
1 parent bbb5031
commit 2f942b5
Show file tree

Hide file tree

Showing 10 changed files with 40 additions and 0 deletions.
diff --git a/ops/argo-cd/applications/production-hm/airbyte/kubernetes-manifests/hm-airbyte-ingress.yaml b/ops/argo-cd/applications/production-hm/airbyte/kubernetes-manifests/hm-airbyte-ingress.yaml
@@ -10,7 +10,11 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/ops/argo-cd/applications/production-hm/akhq/kubernetes-manifests/hm-akhq-ingress.yaml b/ops/argo-cd/applications/production-hm/akhq/kubernetes-manifests/hm-akhq-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-akhq.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/ops/argo-cd/applications/production-hm/argo-cd/kubernetes-manifests/hm-argo-cd-ingress.yaml b/ops/argo-cd/applications/production-hm/argo-cd/kubernetes-manifests/hm-argo-cd-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-argo-cd.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
   labels:
     app.kubernetes.io/name: hm-argo-cd-ingress
     app.kubernetes.io/part-of: production-hm-argo-cd

diff --git a/...go-cd/applications/production-hm/kafbat-ui/kubernetes-manifests/hm-kafbat-ui-ingress.yaml b/...go-cd/applications/production-hm/kafbat-ui/kubernetes-manifests/hm-kafbat-ui-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-kafbat-ui.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/ops/argo-cd/applications/production-hm/mlflow/kubernetes-manifests/hm-mlflow-ingress.yaml b/ops/argo-cd/applications/production-hm/mlflow/kubernetes-manifests/hm-mlflow-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-mlflow.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/ops/argo-cd/applications/production-hm/netdata/kubernetes-manifests/hm-netdata-ingress.yaml b/ops/argo-cd/applications/production-hm/netdata/kubernetes-manifests/hm-netdata-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-netdata.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...argo-cd/applications/production-hm/opencost/kubernetes-manifests/hm-opencost-ingress.yaml b/...argo-cd/applications/production-hm/opencost/kubernetes-manifests/hm-opencost-ingress.yaml
@@ -10,7 +10,11 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...rgo-cd/applications/production-hm/prometheus/kubernetes-manifests/hm-grafana-ingress.yaml b/...rgo-cd/applications/production-hm/prometheus/kubernetes-manifests/hm-grafana-ingress.yaml
@@ -10,7 +10,11 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/ops/argo-cd/applications/production-hm/ray-cluster/kubernetes-manifests/hm-ray-ingress.yaml b/ops/argo-cd/applications/production-hm/ray-cluster/kubernetes-manifests/hm-ray-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-ray.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels:

diff --git a/...ions/production-hm/redpanda-console/kubernetes-manifests/hm-redpanda-console-ingress.yaml b/...ions/production-hm/redpanda-console/kubernetes-manifests/hm-redpanda-console-ingress.yaml
@@ -12,7 +12,11 @@ metadata:
     # https://kubernetes-sigs.github.io/external-dns/latest/annotations/annotations
     external-dns.alpha.kubernetes.io/hostname: hm-redpanda-console.internal.hongbomiao.com
     # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://letsencrypt.org/certificates
     cert-manager.io/cluster-issuer: production-lets-encrypt-cluster-issuer
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: "384"
+    cert-manager.io/private-key-rotation-policy: Always
     # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
     argocd.argoproj.io/hook: PostSync
   labels: