Stéphane Tailland
26aa89643c
LibreChat served the lab CA's own certificate as its server certificate — a CA:TRUE certificate valid for the whole *.sttlab.local wildcard, from a hand-made tls.yaml that also carried the CA's private key. Gitignored, so never leaked, but the only service in the estate still copying the CA around instead of being issued a leaf. Now a cert-manager Certificate for librechat.sttlab.local: CA:FALSE, one dnsNames, key generated in the cluster and rotated there. The two uses of that Secret had to be separated first, which is the part worth knowing: sttlab-tls was both the ingress certificate and the CA bundle mounted as NODE_EXTRA_CA_CERTS for outbound calls. Replacing it with a leaf alone would have left LibreChat unable to verify Keycloak. The CA certificate now comes from ca-configmap.yaml — the certificate, never the key, committed like the agents'. Verified: the ingress serves CA:FALSE with SAN librechat.sttlab.local, the pod's outbound call to Keycloak returns 200 with TLS verified, and the old secret is deleted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
456 B
Plaintext
25 lines
456 B
Plaintext
# Secrets — ne jamais committer de valeurs réelles
|
|
secret.yaml
|
|
# tls.yaml : plus de fichier TLS local. Le certificat de service est émis par
|
|
# cert-manager (ingress/certificate.yaml) et sa clé reste dans le cluster ; le
|
|
# certificat du CA, lui, est public et versionné dans ca-configmap.yaml.
|
|
|
|
# Certificats TLS
|
|
*.crt
|
|
*.key
|
|
*.pem
|
|
|
|
# Overrides locaux
|
|
*.local.yaml
|
|
*.override.yaml
|
|
|
|
# Éditeurs
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*~
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
.claude |