allineamento

add-on/certm.yaml

@@ -0,0 +1,139 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    deployment.kubernetes.io/revision: "1"
+    meta.helm.sh/release-name: cert-manager
+    meta.helm.sh/release-namespace: cert-manager
+  creationTimestamp: "2026-02-08T14:54:09Z"
+  generation: 1
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/version: v1.19.3
+    helm.sh/chart: cert-manager-v1.19.3
+  name: cert-manager
+  namespace: cert-manager
+  resourceVersion: "90308180"
+  uid: addcc5cd-6990-45bc-81c0-8a5b84388744
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: cert-manager
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        prometheus.io/path: /metrics
+        prometheus.io/port: "9402"
+        prometheus.io/scrape: "true"
+      labels:
+        app: cert-manager
+        app.kubernetes.io/component: controller
+        app.kubernetes.io/instance: cert-manager
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cert-manager
+        app.kubernetes.io/version: v1.19.3
+        helm.sh/chart: cert-manager-v1.19.3
+    spec:
+      initContainers:
+      - name: resolve-gateway
+        image: busybox:1.35
+        command:
+          - sh
+          - -c
+          - |
+            GW_IP=$(getent hosts main-gateway-nginx.nginx-gateway.svc.cluster.local 2>/dev/null | awk '{print $1}')
+            if [ -n "$GW_IP" ]; then
+              echo "$GW_IP main-gateway-nginx.nginx-gateway.svc.cluster.local" >> /etc/hosts
+              echo "$GW_IP main-gateway-nginx" >> /etc/hosts
+              echo "Risoluzione aggiunta: $GW_IP main-gateway-nginx"
+            else
+              echo "Avviso: impossibile risolvere main-gateway-nginx.nginx-gateway.svc.cluster.local"
+            fi
+      containers:
+      - args:
+        - --v=2
+        - --config=/var/cert-manager/config/config.yaml
+        - --cluster-resource-namespace=$(POD_NAMESPACE)
+        - --leader-election-namespace=kube-system
+        - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.19.3
+        - --max-concurrent-challenges=60
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        image: quay.io/jetstack/cert-manager-controller:v1.19.3
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 8
+          httpGet:
+            path: /livez
+            port: http-healthz
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 15
+        name: cert-manager-controller
+        ports:
+        - containerPort: 9402
+          name: http-metrics
+          protocol: TCP
+        - containerPort: 9403
+          name: http-healthz
+          protocol: TCP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /var/cert-manager/config
+          name: config
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: false
+      hostAliases:
+        - ip: "127.0.0.1"
+          hostnames:
+            - "localhost.local"
+            - "example.local"
+        # Aggiungi altri domini locali qui:
+        # - ip: "10.0.0.1"
+        #   hostnames:
+        #     - "internal.domain"
+        #     - "api.domain"
+      nodeSelector:
+        kubernetes.io/os: linux
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccount: cert-manager
+      serviceAccountName: cert-manager
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: cert-manager
+        name: config