fix(crowdsec): trust the CA that signed the LAPI cert, not the current root

crowdsec.renner.uno has answered 500 on every path since 2026-09-20. Traefik logs, every request: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "x509: ECDSA verification failure" while trying to verify candidate authority certificate "crowdsec-ca") Cause: the chart's CA (crowdsec-ca, no duration set, so cert-manager's 90d default) and its leaves (tls.certManager.duration 90d, renewBefore 30d) were created together and so renew at the same instant. cert-manager logs show crowdsec-ca, crowdsec-lapi and crowdsec-agent all triggered "Renewing" at 2026-09-20T06:24:37Z. The CA came back with a new ECDSA key, while the leaves issued in the same second were signed by the previous one. The ServersTransport trusted crowdsec-root-secret, so it holds the new CA and rejects the LAPI cert. Same subject, different key, hence "ECDSA verification failure". Fix: point the ServersTransport at the ca.crt of crowdsec-lapi-tls. For a CA issuer, cert-manager stores the signing CA there, so it matches the served cert whichever key the root holds. Traefik reads ca.crt from a rootCAs secret (Traefik v3.7 docs). Reloader also restarts the LAPI when crowdsec-lapi-tls changes. The LAPI reads its cert at start; without a restart a renewal would update ca.crt while the old leaf is still served, and the mismatch would come back. Impact while broken: the edge firewall bouncers on proxy-1/proxy-2 got no decisions from this endpoint.
chore(image-automation): bump gitea.renner.uno/gitea_admin/kuma-sync:2026-10-20-0933
2026-10-20 10:04:18 +00:00 · 2026-10-20 09:56:44 +00:00 · 2026-10-20 09:56:13 +00:00
3 changed files with 5 additions and 4 deletions
@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-19-0857 # {"$imagepolicy": "flux-system:kuma-sync"}
+          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-20-0933 # {"$imagepolicy": "flux-system:kuma-sync"}
          env:
            - name: KUMA_URL
              value: https://kuma.renner.uno
@@ -160,7 +160,8 @@ spec:
        # crowdsec-edge-bouncer-key rotates by hand together with
        # ansible/plays/install-netbird-proxy.yml; it still needs to be listed
        # here, because the LAPI side of that rotation is this env var.
-        secret.reloader.stakater.com/reload: crowdsec-bouncer-key,crowdsec-edge-bouncer-key
+        # crowdsec-lapi-tls: serve a renewed cert together with its new ca.crt.
+        secret.reloader.stakater.com/reload: crowdsec-bouncer-key,crowdsec-edge-bouncer-key,crowdsec-lapi-tls
      persistentVolume:
        data:
          # Kept OFF deliberately. The #337 attempt to set this `true` (persist
@@ -1,5 +1,5 @@
 # traefik.io CRD consumer for the public LAPI endpoint (crowdsec/lapi-ingress.yaml
-# holds the Ingress). The CA it names is the chart's self-signed LAPI CA.
+# holds the Ingress). Trusts ca.crt of the LAPI's own cert secret: the CA that signed it.
 apiVersion: traefik.io/v1alpha1
 kind: ServersTransport
 metadata:
@@ -8,4 +8,4 @@ metadata:
 spec:
  serverName: crowdsec-service.crowdsec.svc.cluster.local
  rootCAs:
-    - secret: crowdsec-root-secret
+    - secret: crowdsec-lapi-tls