2.1 KiB
cert-manager
Argo CD installs the upstream Jetstack chart v1.21.2 and owns the controller,
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
homelab ClusterIssuers and four centrally managed Certificates. Other
Certificates, including those created from Ingress annotations, remain owned
by their respective applications or controllers.
The chart uses the existing cert-manager namespace and the existing
kube-system leader-election namespace. Its CRDs carry the upstream Helm
resource-policy: keep annotation, so Argo will preserve them if the chart is
removed; review CRD changes carefully during upgrades.
Secrets stay cluster-managed. Before rebuilding the cluster, restore
cert-manager/cloudflare-api-credentials with its apiKey entry. cert-manager
creates and retains the ACME account Secrets
letsencrypt-dns-account-key and letsencrypt-http-account-key in its
namespace. The resulting TLS Secrets remain in default for Ingresses to
reference. No Secret values are stored here.
For a local recovery install, read the chart version and values from
bootstrap/cert-manager.yaml and
values.yaml. Normal upgrades are made by changing that
Application's chart targetRevision and allowing Argo CD to reconcile it.
The former cert-manager-deployment repository and its direct Kubernetes CI
writer have been retired and archived; its CI kubeconfig secret and deployer
RBAC are removed. Argo CD now owns the complete declarative cert-manager
configuration with automated sync, self-heal, and pruning. The
watschn.studio domain is no longer controlled, so its DNS-01 renewal cannot
complete. Its current Certificate remains Ready and its existing TLS Secret is
still referenced by the site Ingress. Keep both resources to avoid disrupting
the current deployment, but ignore this Certificate's Argo health: the stale
renewal challenge must not block unrelated cert-manager upgrades or parent
app-of-apps reconciliation. Remove the Certificate and Secret only after the
site/domain owner confirms they are no longer needed.