# cert-manager on Kubernetes

The operator is pinned to chart/app `v1.21.1` and remains an administrator
upgrade because it owns CRDs, admission webhooks, and cluster-wide RBAC. Gitea
Actions validates and deploys only the two exact ClusterIssuers and four exact
Certificates; it cannot read Secrets, create/delete resources, or modify the
operator.

`cloudflare-api-credentials.yaml` is intentionally ignored. Copy the `.example`,
insert the existing token, and run `./install.sh`; when the file is absent the
installer preserves the existing live Secret. Run `./create-ci-kubeconfig.sh`
once and save only its final line as repository secret `KUBE_CONFIG_BASE64`.