cert-manager
Argo CD installs the upstream Jetstack chart v1.21.2 and owns the controller,
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
homelab ClusterIssuers and four centrally managed Certificates. Other
Certificates, including those created from Ingress annotations, remain owned
by their respective applications or controllers.
The chart uses the existing cert-manager namespace and the existing
kube-system leader-election namespace. Its CRDs carry the upstream Helm
resource-policy: keep annotation, so Argo will preserve them if the chart is
removed; review CRD changes carefully during upgrades.
Secrets stay cluster-managed. Before rebuilding the cluster, restore
cert-manager/cloudflare-api-credentials with its apiKey entry. cert-manager
creates and retains the ACME account Secrets
letsencrypt-dns-account-key and letsencrypt-http-account-key in its
namespace. The resulting TLS Secrets remain in default for Ingresses to
reference. No Secret values are stored here.
For a local recovery install, read the chart version and values from
bootstrap/cert-manager.yaml and
values.yaml. Normal upgrades are made by changing that
Application's chart targetRevision and allowing Argo CD to reconcile it.
The former cert-manager-deployment repository and its direct Kubernetes CI
writer have been retired and archived; its CI kubeconfig secret and deployer
RBAC are removed. Argo CD now owns the complete declarative cert-manager
configuration with automated sync, self-heal, and pruning. The
watschn.studio domain is no longer controlled, so its DNS-01 renewal cannot
complete. Its current Certificate remains Ready with the existing TLS Secret,
but the renewal challenge keeps this Application's health at Progressing. We
are retaining that Certificate and Secret for now rather than risking an
unreviewed TLS-resource deletion; remove them only if the service/domain owner
confirms they are no longer needed.