fix: Utils | update public and internal cert algorithms

utils/cert-manager/cloudflare.ts

@@ -19,7 +19,7 @@ export class CloudflareCertificate extends Certificate {
   constructor(
     scope: Construct,
     id: string,
-    opts: Omit<CertificateOptions, "issuerRef">,
+    opts: Omit<CertificateOptions, "issuerRef" | "privateKey">,
   ) {
     super(scope, id, {
       ...opts,
@@ -27,6 +27,10 @@ export class CloudflareCertificate extends Certificate {
         name: "cloudflare-issuer",
         kind: "ClusterIssuer",
       },
+      privateKey: {
+        algorithm: "RSA",
+        size: 4096,
+      },
     });
   }
 }

utils/cert-manager/internal.ts

@@ -23,7 +23,7 @@ export class PrivateCertificate extends Certificate {
   constructor(
     scope: Construct,
     id: string,
-    opts: Omit<CertificateOptions, "issuerRef">,
+    opts: Omit<CertificateOptions, "issuerRef" | "privateKey">,
   ) {
     super(scope, id, {
       ...opts,
@@ -31,6 +31,10 @@ export class PrivateCertificate extends Certificate {
         name: "cluster-issuer", // internal CA
         kind: "ClusterIssuer",
       },
+      privateKey: {
+        algorithm: "Ed25519",
+        size: 384,
+      },
     });
   }
 }

utils/traefik/ingress/ingress.ts

@@ -2,7 +2,7 @@ import { Construct } from "constructs";
 import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
 import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
 
-import { CloudflareCertificate, PrivateCertificate } from "../../cert-manager";
+import { PrivateCertificate } from "../../cert-manager";
 
 export type IngressRouteOptions = {
   provider: KubernetesProvider;
@@ -110,14 +110,6 @@ export class IngressRoute extends Construct {
       spec.tls = {
         secretName: opts.tlsSecretName,
       };
-
-      new CloudflareCertificate(this, `${name}-cert`, {
-        provider,
-        namespace,
-        name: opts.host,
-        secretName: opts.tlsSecretName,
-        dnsNames: [opts.host],
-      });
     }
 
     this.manifest = new Manifest(this, name, {

utils/traefik/ingress/internalIngress.ts

@@ -2,6 +2,7 @@ import { Construct } from "constructs";
 import { IngressRoute, IngressRouteOptions } from "./ingress";
 import { DataTerraformRemoteStateS3 } from "cdktf";
 import { DataKubernetesNamespaceV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-namespace-v1";
+import { PrivateCertificate } from "../../cert-manager";
 
 type InternalIngressRouteOptions = Omit<
   IngressRouteOptions,
@@ -47,17 +48,31 @@ export class InternalIngressRoute extends Construct {
     );
     const namespace = namespaceResource.metadata.name;
 
+    const { provider, name, host, serviceName, servicePort, serviceProtocol } =
+      opts;
+
+    const tlsSecretName = `${name}-tls`;
+
+    new PrivateCertificate(this, `${name}-cert`, {
+      provider,
+      namespace,
+      name: host,
+      secretName: tlsSecretName,
+      dnsNames: [host],
+    });
+
     new IngressRoute(this, opts.name, {
-      provider: opts.provider,
+      provider,
-      namespace: opts.namespace,
+      namespace,
-      host: opts.host,
+      host,
+      serviceName,
+      servicePort,
+      serviceProtocol,
+      tlsSecretName,
+      name,
       path: opts.path ?? "/",
-      serviceName: opts.serviceName,
-      servicePort: opts.servicePort,
       entryPoints: ["websecure"],
-      tlsSecretName: `${opts.name}-tls`,
       middlewares: [`${namespace}/ip-allow-list`],
-      name: opts.name,
     });
   }
 }

utils/traefik/ingress/publicIngress.ts

@@ -1,7 +1,6 @@
 import { Construct } from "constructs";
 import { IngressRoute, IngressRouteOptions } from "./ingress";
-import { DataTerraformRemoteStateS3 } from "cdktf";
+import { CloudflareCertificate } from "../../cert-manager";
-import { DataKubernetesNamespaceV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-namespace-v1";
 
 type PublicIngressRouteOptions = Omit<
   IngressRouteOptions,
@@ -12,53 +11,38 @@ export class PublicIngressRoute extends Construct {
   constructor(scope: Construct, id: string, opts: PublicIngressRouteOptions) {
     super(scope, id);
 
-    const r2Endpoint = `${process.env.ACCOUNT_ID!}.r2.cloudflarestorage.com`;
+    const {
+      provider,
+      name,
+      namespace,
+      host,
+      serviceName,
+      servicePort,
+      serviceProtocol,
+    } = opts;
 
-    const coreServicesState = new DataTerraformRemoteStateS3(
+    const tlsSecretName = `${name}-tls`;
-      this,
+
-      "core-services-state",
+    new CloudflareCertificate(this, `${name}-cert`, {
-      {
+      provider,
-        usePathStyle: true,
+      namespace,
-        skipRegionValidation: true,
+      name: host,
-        skipCredentialsValidation: true,
+      secretName: tlsSecretName,
-        skipRequestingAccountId: true,
+      dnsNames: [host],
-        skipS3Checksum: true,
+    });
-        encrypt: true,
-        bucket: "terraform-state",
-        key: "core-services/terraform.tfstate",
-        endpoints: {
-          s3: `https://${r2Endpoint}`,
-        },
-        region: "auto",
-        accessKey: process.env.ACCESS_KEY,
-        secretKey: process.env.SECRET_KEY,
-      },
-    );
-    const namespaceName = coreServicesState.getString("namespace-output");
-    const namespaceResource = new DataKubernetesNamespaceV1(
-      this,
-      "core-services-namespace",
-      {
-        provider: opts.provider,
-        metadata: {
-          name: namespaceName,
-        },
-      },
-    );
-    const namespace = namespaceResource.metadata.name;
 
     new IngressRoute(this, opts.name, {
-      provider: opts.provider,
+      provider,
-      namespace: opts.namespace,
+      namespace,
-      host: opts.host,
+      host,
+      tlsSecretName,
+      serviceName,
+      servicePort,
+      serviceProtocol,
+      name,
       path: opts.path ?? "/",
-      serviceName: opts.serviceName,
-      servicePort: opts.servicePort,
-      serviceProtocol: opts.serviceProtocol,
       entryPoints: ["websecure"],
-      tlsSecretName: `${opts.name}-tls`,
       middlewares: [`${namespace}/rate-limit`],
-      name: opts.name,
     });
   }
 }