zeekayandHanzo Dev
59e61ff181
exchange/markets on lux-dev and lux-test, and the mpc-api hosts, all served Traefik's self-signed default and were unreachable over HTTPS (curl 000) while their backends ran. lux-devnet/lux-exchange was 2/2 the whole time, serving traffic nobody could reach. Root cause: their IngressRoutes ask for `certResolver: letsencrypt`, and that resolver does not exist. hanzo-ingress carries NO --certificatesresolvers.* argument at all -- TLS issuance was migrated to cert-manager (88 Certificates on this cluster) and the certResolver lines are un-migrated residue. Traefik cannot resolve a named resolver that was never configured, so it falls back to its default certificate. That the resolver's absence is deliberate, not decay, is worth stating: acme.json is frozen at 2026-07-14 and CF_API_* env linger from the old DNS-01 setup. Every host that WORKS today is covered by a cert-manager Certificate and renews normally -- I checked before concluding otherwise. Proof it was only ever the missing Certificate: each issued in ~100 seconds. ACME validation was never the problem. mpc-api is a SEPARATE route, not a tls change on lux-mpc, because that route matches six hosts on one tls block and three of them already work with their own Certificates. A single secretName there would have served all six from a cert covering only the mpc-api names. Verified after: devnet trio 200 with a real cert; mpc-api.lux/pars 200; mpc.lux.network unchanged at 200 with its own cert. The testnet trio now presents a valid cert and returns 503 -- its backend is scaled 0/0, which is a separate decision, but TLS is no longer the blocker. mpc-api.zoo.network is untouched: its DNS points at the ZOO load balancer, and zoo-k8s has zoo-mpc/mpc-node 5/5 but no Ingress or IngressRoute for mpc at all. That is a routing question, not a certificate one. Co-authored-by: Hanzo Dev <[email protected]>
63 lines
2.4 KiB
YAML
63 lines
2.4 KiB
YAML
###############################################################################
|
|
# TLS for the mpc-api hosts, split out from the lux-mpc IngressRoute.
|
|
#
|
|
# WHY A SEPARATE ROUTE, not a tls change on lux-mpc: that route matches SIX
|
|
# hosts on ONE tls block —
|
|
# mpc.lux.network mpc.pars.network mpc.zoo.network (working)
|
|
# mpc-api.lux.network mpc-api.pars.network mpc-api.zoo.network (were not)
|
|
# The three working ones already have their own cert-manager Certificates
|
|
# (mpc-lux-network-tls, mpc-pars-network-tls, mpc-zoo-network-tls). Setting a
|
|
# single `secretName` on the parent would have served ALL six from a cert that
|
|
# covers only the mpc-api names, breaking the three that worked.
|
|
#
|
|
# The mpc-api hosts served CN=INGRESS DEFAULT CERT because the parent asks for
|
|
# `certResolver: letsencrypt`, and that resolver no longer exists — issuance
|
|
# moved to cert-manager, and hanzo-ingress carries no --certificatesresolvers.*
|
|
# argument. Verified after the split: mpc-api.lux.network and
|
|
# mpc-api.pars.network return 200 with a real cert, and mpc.lux.network is
|
|
# unchanged at 200 with its own.
|
|
#
|
|
# mpc-api.zoo.network is listed here because the parent lists it, but its DNS
|
|
# points at the ZOO load balancer (209.38.118.103), not this cluster's
|
|
# (134.199.138.27) — so this route never sees it. zoo-k8s has zoo-mpc/mpc-node
|
|
# 5/5 but no Ingress or IngressRoute for mpc at all. Unresolved, deliberately:
|
|
# it is a routing question, not a certificate one.
|
|
###############################################################################
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: mpc-api-tls
|
|
namespace: lux-mpc
|
|
spec:
|
|
secretName: mpc-api-tls
|
|
dnsNames:
|
|
- mpc-api.lux.network
|
|
- mpc-api.pars.network
|
|
issuerRef:
|
|
group: cert-manager.io
|
|
kind: ClusterIssuer
|
|
name: letsencrypt-prod
|
|
usages:
|
|
- digital signature
|
|
- key encipherment
|
|
---
|
|
apiVersion: hanzo.ai/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: mpc-api
|
|
namespace: lux-mpc
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- kind: Rule
|
|
match: Host(`mpc-api.lux.network`) || Host(`mpc-api.pars.network`) || Host(`mpc-api.zoo.network`)
|
|
services:
|
|
# mpc-api-svc:8081 — taken from the parent route's own rule, not guessed.
|
|
# A hand-written `mpc-api:8080` here would have pointed the route at a
|
|
# service that does not exist.
|
|
- name: mpc-api-svc
|
|
port: 8081
|
|
tls:
|
|
secretName: mpc-api-tls
|