cert-manager
Argo CD installs the upstream Jetstack chart v1.21.2 and owns the controller,
webhook, CRDs, and cluster-scoped RBAC. This directory supplies the two
homelab ClusterIssuers and four centrally managed Certificates. Other
Certificates, including those created from Ingress annotations, remain owned
by their respective applications or controllers.
The chart uses the existing cert-manager namespace and the existing
kube-system leader-election namespace. Its CRDs carry the upstream Helm
resource-policy: keep annotation, so Argo will preserve them if the chart is
removed; review CRD changes carefully during upgrades.
Secrets stay cluster-managed. Before rebuilding the cluster, restore
cert-manager/cloudflare-api-credentials with its apiKey entry. cert-manager
creates and retains the ACME account Secrets
letsencrypt-dns-account-key and letsencrypt-http-account-key in its
namespace. The resulting TLS Secrets remain in default for Ingresses to
reference. No Secret values are stored here.
For a local recovery install, read the chart version and values from
bootstrap/cert-manager.yaml and
values.yaml. Normal upgrades are made by changing that
Application's chart targetRevision and allowing Argo CD to reconcile it.