cert-manager-deployment/README.md

cert-manager on Kubernetes

The operator is pinned to chart/app v1.21.1 and remains an administrator upgrade because it owns CRDs, admission webhooks, and cluster-wide RBAC. Gitea Actions validates and deploys only the two exact ClusterIssuers and four exact Certificates; it cannot read Secrets, create/delete resources, or modify the operator.

cloudflare-api-credentials.yaml is intentionally ignored. Copy the .example, insert the existing token, and run ./install.sh; when the file is absent the installer preserves the existing live Secret. Run ./create-ci-kubeconfig.sh once and save only its final line as repository secret KUBE_CONFIG_BASE64.