37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# cert-manager
|
|
|
|
Argo CD installs the upstream Jetstack chart `v1.21.2` and owns the controller,
|
|
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
|
|
homelab ClusterIssuers and four centrally managed Certificates. Other
|
|
Certificates, including those created from Ingress annotations, remain owned
|
|
by their respective applications or controllers.
|
|
|
|
The chart uses the existing `cert-manager` namespace and the existing
|
|
`kube-system` leader-election namespace. Its CRDs carry the upstream Helm
|
|
`resource-policy: keep` annotation, so Argo will preserve them if the chart is
|
|
removed; review CRD changes carefully during upgrades.
|
|
|
|
Secrets stay cluster-managed. Before rebuilding the cluster, restore
|
|
`cert-manager/cloudflare-api-credentials` with its `apiKey` entry. cert-manager
|
|
creates and retains the ACME account Secrets
|
|
`letsencrypt-dns-account-key` and `letsencrypt-http-account-key` in its
|
|
namespace. The resulting TLS Secrets remain in `default` for Ingresses to
|
|
reference. No Secret values are stored here.
|
|
|
|
For a local recovery install, read the chart version and values from
|
|
[`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and
|
|
[`values.yaml`](values.yaml). Normal upgrades are made by changing that
|
|
Application's chart `targetRevision` and allowing Argo CD to reconcile it.
|
|
|
|
The former `cert-manager-deployment` repository and its direct Kubernetes CI
|
|
writer have been retired and archived; its CI kubeconfig secret and deployer
|
|
RBAC are removed. Argo CD now owns the complete declarative cert-manager
|
|
configuration with automated sync, self-heal, and pruning. The
|
|
`watschn.studio` domain is no longer controlled, so its DNS-01 renewal cannot
|
|
complete. Its current Certificate remains Ready and its existing TLS Secret is
|
|
still referenced by the site Ingress. Keep both resources to avoid disrupting
|
|
the current deployment, but ignore this Certificate's Argo health: the stale
|
|
renewal challenge must not block unrelated cert-manager upgrades or parent
|
|
app-of-apps reconciliation. Remove the Certificate and Secret only after the
|
|
site/domain owner confirms they are no longer needed.
|