36 lines
2.0 KiB
Markdown
36 lines
2.0 KiB
Markdown
# cert-manager
|
|
|
|
Argo CD installs the upstream Jetstack chart `v1.21.2` and owns the controller,
|
|
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
|
|
homelab ClusterIssuers and four centrally managed Certificates. Other
|
|
Certificates, including those created from Ingress annotations, remain owned
|
|
by their respective applications or controllers.
|
|
|
|
The chart uses the existing `cert-manager` namespace and the existing
|
|
`kube-system` leader-election namespace. Its CRDs carry the upstream Helm
|
|
`resource-policy: keep` annotation, so Argo will preserve them if the chart is
|
|
removed; review CRD changes carefully during upgrades.
|
|
|
|
Secrets stay cluster-managed. Before rebuilding the cluster, restore
|
|
`cert-manager/cloudflare-api-credentials` with its `apiKey` entry. cert-manager
|
|
creates and retains the ACME account Secrets
|
|
`letsencrypt-dns-account-key` and `letsencrypt-http-account-key` in its
|
|
namespace. The resulting TLS Secrets remain in `default` for Ingresses to
|
|
reference. No Secret values are stored here.
|
|
|
|
For a local recovery install, read the chart version and values from
|
|
[`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and
|
|
[`values.yaml`](values.yaml). Normal upgrades are made by changing that
|
|
Application's chart `targetRevision` and allowing Argo CD to reconcile it.
|
|
|
|
The former `cert-manager-deployment` repository and its direct Kubernetes CI
|
|
writer have been retired and archived; its CI kubeconfig secret and deployer
|
|
RBAC are removed. Argo CD now owns the complete declarative cert-manager
|
|
configuration with automated sync, self-heal, and pruning. The
|
|
`watschn.studio` domain is no longer controlled, so its DNS-01 renewal cannot
|
|
complete. Its current Certificate remains Ready with the existing TLS Secret,
|
|
but the renewal challenge keeps this Application's health at Progressing. We
|
|
are retaining that Certificate and Secret for now rather than risking an
|
|
unreviewed TLS-resource deletion; remove them only if the service/domain owner
|
|
confirms they are no longer needed.
|