# cert-manager

Argo CD installs the upstream Jetstack chart `v1.21.2` and owns the controller,
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
homelab ClusterIssuers and four centrally managed Certificates. Other
Certificates, including those created from Ingress annotations, remain owned
by their respective applications or controllers.

The chart uses the existing `cert-manager` namespace and the existing
`kube-system` leader-election namespace. Its CRDs carry the upstream Helm
`resource-policy: keep` annotation, so Argo will preserve them if the chart is
removed; review CRD changes carefully during upgrades.

Secrets stay cluster-managed. Before rebuilding the cluster, restore
`cert-manager/cloudflare-api-credentials` with its `apiKey` entry. cert-manager
creates and retains the ACME account Secrets
`letsencrypt-dns-account-key` and `letsencrypt-http-account-key` in its
namespace. The resulting TLS Secrets remain in `default` for Ingresses to
reference. No Secret values are stored here.

For a local recovery install, read the chart version and values from
[`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and
[`values.yaml`](values.yaml). Normal upgrades are made by changing that
Application's chart `targetRevision` and allowing Argo CD to reconcile it.

The former `cert-manager-deployment` repository and its direct Kubernetes CI
writer have been retired and archived; its CI kubeconfig secret and deployer
RBAC are removed. Argo CD now owns the complete declarative cert-manager
configuration with automated sync, self-heal, and pruning. The
`watschn.studio` domain is no longer controlled, so its DNS-01 renewal cannot
complete. Its current Certificate remains Ready with the existing TLS Secret,
but the renewal challenge keeps this Application's health at Progressing. We
are retaining that Certificate and Secret for now rather than risking an
unreviewed TLS-resource deletion; remove them only if the service/domain owner
confirms they are no longer needed.