# cert-manager

Argo CD installs the upstream Jetstack chart `v1.21.2` and owns the controller,
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
homelab ClusterIssuers and four centrally managed Certificates. Other
Certificates, including those created from Ingress annotations, remain owned
by their respective applications or controllers.

The chart uses the existing `cert-manager` namespace and the existing
`kube-system` leader-election namespace. Its CRDs carry the upstream Helm
`resource-policy: keep` annotation, so Argo will preserve them if the chart is
removed; review CRD changes carefully during upgrades.

Secrets stay cluster-managed. Before rebuilding the cluster, restore
`cert-manager/cloudflare-api-credentials` with its `apiKey` entry. cert-manager
creates and retains the ACME account Secrets
`letsencrypt-dns-account-key` and `letsencrypt-http-account-key` in its
namespace. The resulting TLS Secrets remain in `default` for Ingresses to
reference. No Secret values are stored here.

For a local recovery install, read the chart version and values from
[`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and
[`values.yaml`](values.yaml). Normal upgrades are made by changing that
Application's chart `targetRevision` and allowing Argo CD to reconcile it.

The former `cert-manager-deployment` repository and its direct Kubernetes CI
writer have been retired and archived; its CI kubeconfig secret and deployer
RBAC are removed. Argo CD now owns the complete declarative cert-manager
configuration with automated sync, self-heal, and pruning. The
`watschn.studio` domain is no longer controlled, so its DNS-01 renewal cannot
complete. Its current Certificate remains Ready and its existing TLS Secret is
still referenced by the site Ingress. Keep both resources to avoid disrupting
the current deployment, but ignore this Certificate's Argo health: the stale
renewal challenge must not block unrelated cert-manager upgrades or parent
app-of-apps reconciliation. Remove the Certificate and Secret only after the
site/domain owner confirms they are no longer needed.