Stéphane Tailland
26aa89643c
LibreChat served the lab CA's own certificate as its server certificate — a CA:TRUE certificate valid for the whole *.sttlab.local wildcard, from a hand-made tls.yaml that also carried the CA's private key. Gitignored, so never leaked, but the only service in the estate still copying the CA around instead of being issued a leaf. Now a cert-manager Certificate for librechat.sttlab.local: CA:FALSE, one dnsNames, key generated in the cluster and rotated there. The two uses of that Secret had to be separated first, which is the part worth knowing: sttlab-tls was both the ingress certificate and the CA bundle mounted as NODE_EXTRA_CA_CERTS for outbound calls. Replacing it with a leaf alone would have left LibreChat unable to verify Keycloak. The CA certificate now comes from ca-configmap.yaml — the certificate, never the key, committed like the agents'. Verified: the ingress serves CA:FALSE with SAN librechat.sttlab.local, the pod's outbound call to Keycloak returns 200 with TLS verified, and the old secret is deleted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
40 lines
1.5 KiB
YAML
40 lines
1.5 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: librechat
|
|
namespace: librechat
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "20m"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-buffering: "off"
|
|
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
|
|
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
|
nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
|
|
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
|
# configuration-snippet (WebSocket Upgrade/Connection headers) removed —
|
|
# this cluster's ingress-nginx has snippet annotations disabled
|
|
# (admission webhook rejects them outright). If any LibreChat feature
|
|
# turns out to need raw WebSocket upgrade specifically (vs. the SSE/
|
|
# HTTP-1.1 streaming already covered by proxy-buffering/proxy-http-version
|
|
# above), this needs a different mechanism — e.g. a ConfigMap-based
|
|
# global nginx snippet if the cluster admin allows one, since per-Ingress
|
|
# snippets are blocked here.
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- librechat.sttlab.local
|
|
secretName: librechat-tls
|
|
rules:
|
|
- host: librechat.sttlab.local
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: librechat
|
|
port:
|
|
number: 80
|