From 239ea07d5c45b16a68a8767bf80e06695f19fa4a Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 2 Aug 2026 18:00:00 +1000 Subject: [PATCH] Import live vault-issuer ClusterIssuer into GitOps (#328) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The \`vault-issuer\` ClusterIssuer is applied out-of-band (Helm release \`cert-manager-clusterissuer\`) and is referenced by ~15 Gateways, but is not tracked in GitOps — so the live, load-bearing issuer is drift. This imports it so ArgoCD manages it. The committed spec matches the live object exactly (verified against \`kubectl get clusterissuer vault-issuer -o yaml\`), so adoption is a no-op. ## Changes - Add \`apps/base/cert-manager/clusterissuer_vault-issuer.yaml\` capturing the live spec byte-faithfully: server \`https://vault.service.consul:8200\`, path \`pki_int/sign/servers_default\`, k8s auth mount \`/v1/auth/k8s/au/syd1\`, role \`cert_manager_issuer\`, serviceAccountRef \`cert-manager-vault-issuer\` (audience \`vault\`), caBundleSecretRef \`vault-ca-cert\`/\`ca.crt\`. Helm ownership labels/annotations kept so adoption produces zero diff. - Register the manifest in the cert-manager base kustomization (inserted between \`clusterrolebinding.yaml\` and \`vmservicescrape.yaml\` to avoid the lines #327 touches). ## Depends on #327 ArgoCD can only adopt this resource once \`{group: cert-manager.io, kind: ClusterIssuer}\` is in the platform project \`clusterResourceWhitelist\`. That whitelist entry is added by #327, not here (to avoid a duplicate/conflicting change). **Merge #327 first.** There may be a small merge conflict with #327 in \`apps/base/cert-manager/kustomization.yaml\` (both append to the \`resources\` list); rebase on main after #327 merges. ## Note: SA name discrepancy (not fixed here — committing live spec unchanged) The live issuer authenticates as SA **\`cert-manager-vault-issuer\`**, but the repo scaffolding \`serviceaccount.yaml\` creates SA **\`vault-issuer\`**. Both SAs exist live in \`cert-manager\` (192d and 136d). The issuer uses \`cert-manager-vault-issuer\`, so this PR commits that name (live truth). The repo-managed \`vault-issuer\` SA appears unused by this issuer — worth a follow-up to reconcile which SA is canonical, but out of scope for a zero-change import. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/328 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../clusterissuer_vault-issuer.yaml | 27 +++++++++++++++++++ apps/base/cert-manager/kustomization.yaml | 1 + 2 files changed, 28 insertions(+) create mode 100644 apps/base/cert-manager/clusterissuer_vault-issuer.yaml diff --git a/apps/base/cert-manager/clusterissuer_vault-issuer.yaml b/apps/base/cert-manager/clusterissuer_vault-issuer.yaml new file mode 100644 index 0000000..4c3d20a --- /dev/null +++ b/apps/base/cert-manager/clusterissuer_vault-issuer.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: vault-issuer + labels: + app.kubernetes.io/instance: cert-manager-config + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: cert-manager-config + annotations: + meta.helm.sh/release-name: cert-manager-clusterissuer + meta.helm.sh/release-namespace: cert-manager +spec: + vault: + server: https://vault.service.consul:8200 + path: pki_int/sign/servers_default + caBundleSecretRef: + key: ca.crt + name: vault-ca-cert + auth: + kubernetes: + mountPath: /v1/auth/k8s/au/syd1 + role: cert_manager_issuer + serviceAccountRef: + name: cert-manager-vault-issuer + audiences: + - vault diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml index 33e1bc4..934cbc2 100644 --- a/apps/base/cert-manager/kustomization.yaml +++ b/apps/base/cert-manager/kustomization.yaml @@ -7,6 +7,7 @@ resources: - serviceaccount.yaml - clusterrole.yaml - clusterrolebinding.yaml + - clusterissuer_vault-issuer.yaml - vmservicescrape.yaml - clusterissuer_letsencrypt.yaml - clusterissuer_letsencrypt-staging.yaml