From eb14c382306ba37f95306fe276e446bfbea985f5 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Thu, 17 Sep 2026 08:32:17 +0530 Subject: [PATCH] Serve ArgoCD over TLS on the real domain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The argo-cd chart cannot express this. Its server.ingress.tls is a boolean covering the primary hostname plus every extraHost from one fixed secret, with no extraTls to scope it. Enabling it while nip.io is still served would request a single certificate spanning both names, which Let's Encrypt refuses — leaving neither name with TLS rather than the one it could have served. So the chart keeps serving the nip.io hostname over plain HTTP through its own Ingress, and this object serves the real domain over TLS. Same backend, port 80 rather than 443 because this deployment runs argocd-server with server.insecure: true — TLS terminates at Envoy, and pointing at 443 would have Envoy attempt TLS to a backend that does not speak it. When nip.io is retired this file should be deleted and the chart's own tls: true turned on instead: one hostname, one certificate, and no second object to remember. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N --- .../argocd-ingress-deployshed.yaml | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 extra-manifests/argocd-ingress-deployshed.yaml diff --git a/extra-manifests/argocd-ingress-deployshed.yaml b/extra-manifests/argocd-ingress-deployshed.yaml new file mode 100644 index 0000000..a1097bd --- /dev/null +++ b/extra-manifests/argocd-ingress-deployshed.yaml @@ -0,0 +1,45 @@ +# ArgoCD's own hostname on the real domain, with TLS. +# +# A standalone Ingress rather than the chart's, because the argo-cd chart +# cannot express this. Its server.ingress.tls is a BOOLEAN covering +# `hostname` plus every entry in `extraHosts`, all from one fixed secret, +# and there is no extraTls to scope it more narrowly. Turning it on while +# the nip.io hostname is still served would request a single certificate +# spanning both names — and Let's Encrypt cannot issue for nip.io, so the +# request fails and NEITHER name ends up with TLS. +# +# So the chart keeps serving argocd.35.238.248.203.nip.io over plain HTTP +# through its own Ingress, and this object serves the real domain over TLS. +# Both route to the same backend. When nip.io is retired, this file should +# go away and the chart's own tls: true should be turned on instead — one +# hostname, one certificate, no second object to remember. +# +# Backed by port 80, not 443: this deployment runs argocd-server with +# server.insecure: true, so it speaks plain HTTP and TLS terminates at +# Envoy. Pointing at 443 would have Envoy attempt TLS to a backend that +# does not serve it. +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-ingress-deployshed + namespace: argocd + annotations: + # ingress-shim issues and renews the certificate named in tls below. + cert-manager.io/cluster-issuer: letsencrypt-prod +spec: + ingressClassName: contour + tls: + - hosts: + - argocd.infra.deployshed.com + secretName: argocd-deployshed-tls + rules: + - host: argocd.infra.deployshed.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-admin-prd-server + port: + number: 80