feat: add Custom Domain Certificates documentation - #540
Merged
Conversation
Four new pages under Developers covering TLS for customer-owned domains (issue internal-GlueOps/issues#387): - Overview with decision table (wildcards need DNS-01, CAA, SAN planning, multi-CA coexistence) and a DNS-PERSIST-01 'coming soon' note - Automated certificates with cert-manager via a namespaced Issuer and customResourcesMap (Route53 example, scoped IAM, creds from OpenBao) - Manual certificates with certbot (multi-domain wildcard, vault upload, kubernetes.io/tls ExternalSecret) - WAF/CDN overview (edge certs coexist with platform certs) Site builds clean with onBrokenLinks: throw. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Per review feedback: replace kubectl verification/troubleshooting steps with the Argo CD UI flow (sync, watch the Certificate/Challenge resources in the resource tree, then curl the domain), and remove the WAF/CDN page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Per review feedback: apps typically already pull env vars via an externalSecret entry with dataFrom — show that the route53-dns01 entry coexists with it rather than replacing it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
yesterdaysrebel
changed the title
Add Prerequisites (base-values with whoami image) and deployment/service to the envs values examples so each guide is a complete deployable app, matching the pattern used by the traefik ingress pages. Show the app env secret and the cert/ssl secret as separate externalSecret entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New Custom Domain Certificates section under Developers (ref: internal-GlueOps/issues#387) covering TLS for customer-owned domains, using only capabilities the platform already ships:
Issuer+Certificatethrough the app chart'scustomResourcesMap; scoped IAM policy in the customer's AWS account; secret key via OpenBao/ExternalSecret at a dedicated vault path. Verification and troubleshooting are written for the Argo CD UI flow (sync → watch Certificate/Challenge in the resource tree → curl).tls_crt/tls_key),kubernetes.io/tlsExternalSecret, ingress wiring, renewal caveats (incl. LE's move to 45-day lifetimes in 2026).Per review feedback already applied: kubectl commands replaced with the Argo CD UI flow; WAF/CDN page removed.
Notes for reviewers
secret/<app>-route53-dns01andsecret/<app>-tls(dedicated paths, kept separate from app env-var paths so key material can't leak into pod environments).Testing
npm run buildpasses withonBrokenLinks: "throw"(the two broken-anchor warnings in the log are pre-existing on unrelated admin pages).🤖 Generated with Claude Code