Coreweave Support

[aldmbmtl]

Because Coreweave is already on k8s, we just need to make some changes to the annotations on the ingress in theory.

[alex-hughes-miris]

CoreWeave uses cert-manager and letsencrypt for their ingress (as all endpoints are <account>.coreweave.app the .app gives an HSTS error if you don't have a valid cert)

LetsEncrypt is trying to do the challenge test on port 80, but we're redirecting all http to https.

I think we can patch the cert manager ClusterIssuer to have ssl-redirect annotations

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: you@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            # This all below was added
            ingressClassName: nginx
            ingressTemplate:
              metadata:
                annotations:
                  nginx.ingress.kubernetes.io/ssl-redirect: "false"
                  nginx.ingress.kubernetes.io/force-ssl-redirect: "false"

We will likely also need to upgrade ingress-nginx to 4.12.6 (https://cert-manager.io/docs/releases/release-notes/release-notes-1.18/#acme-http01-challenge-paths-now-use-pathtype-exact-in-ingress-routes)