Deploy apps on subdomain

[giannoug]

Is it possible to deploy multiple clusters under the same Cloudflare domain? I just gave it a try using bootstrap_cloudflare_domain: rpi4.example.com and even though it completed successfully, CF domains are not respecting that and are using the base domain.

The idea behind that is to use one base domain for a couple of clusters, testing, etc.

[onedr0p]

The template doesn't support this out of the box since it uses a wildcart cert for the base domain. cloudflare doesn't support wildcard certs for sub-domains unless you pay. You should be able to get around it thou by not using wildcard certs and instead having cert-manager create a cert per sub-domain using a cert-manager cluster issuer ingress annotation.

That was wrong I was thinking of a wildcard DNS off the base domain, hopefully I can follow up with a correct answer lol

I converted this issue to a discussion.

[onedr0p]

ERR_SSL_VERSION_OR_CIPHER_MISMATCH could be related to using letsencrypt-staging. However I am more concerned with that error on Cloudflares side. What is in the green? It looks too short to be the domain, is it only the subdomain?

This is what mine looks like without a subdomain.domain.tld

[giannoug]

Could be the same error, according to this: https://github.com/cloudflare/cloudflare-docs/blob/production/content/ssl/edge-certificates/additional-options/total-tls/error-messages.md#error-messages

It's only the subdomain, yes. Records are created correctly, I can resolve them from my machine 🎉 I'll enable the production issuer and report back

[giannoug]

Hmm, no luck. New cert got installed, at least according to task cluster:certificates but I'm still getting ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

[onedr0p]

Without trying this myself I am unsure how to guide you into fixing this issue. I hope you can poke around and get it working though! My only suggestion in the meantime would be buy a new domain (they are cheap) and use that instead. I imagine this isn't the only issue you will run into :/

[giannoug]

Yeah I agree at this point. Money isn't the issue, I thought I could group servers under the same domain. I'm going to get some new ones for the time being. Thanks for your help!

[onedr0p]

To circle back on this multi-level subdomains like you want to do here are not covered by the CF Universal Certificate

https://developers.cloudflare.com/ssl/troubleshooting/version-cipher-mismatch/#multi-level-subdomains