Switch Let's Encrypt ClusterIssuers to RFC2136/TSIG solver

The clouddns approach is dropped in favour of self-delegating the ACME
challenge to our own BIND: a one-time CNAME sends _acme-challenge.unkin.net
into acme.unkin.net (served by bind-external), and cert-manager solves DNS-01
via RFC2136+TSIG against it. No GCP service account or Vault KV secret needed.

- Replace the dns01 clouddns solver in both ClusterIssuers with rfc2136
  (nameserver 198.18.199.53:53, key certmanager, HMACSHA256, secret
  certmanager-tsig reflected into the cert-manager namespace).
- Remove the now-unneeded VaultAuth, VaultStaticSecret and clouddns
  ServiceAccount.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml

@@ -11,9 +11,10 @@ spec:
       name: letsencrypt-staging-account-key
     solvers:
       - dns01:
-          # project must match the GCP project hosting the unkin.net Cloud DNS zone
-          cloudDNS:
-            project: REPLACE-WITH-GCP-PROJECT
-            serviceAccountSecretRef:
-              name: cert-manager-clouddns
-              key: key.json
+          rfc2136:
+            nameserver: "198.18.199.53:53"
+            tsigKeyName: certmanager
+            tsigAlgorithm: HMACSHA256
+            tsigSecretSecretRef:
+              name: certmanager-tsig
+              key: secret

apps/base/cert-manager/clusterissuer_letsencrypt.yaml

@@ -11,9 +11,10 @@ spec:
       name: letsencrypt-account-key
     solvers:
       - dns01:
-          # project must match the GCP project hosting the unkin.net Cloud DNS zone
-          cloudDNS:
-            project: REPLACE-WITH-GCP-PROJECT
-            serviceAccountSecretRef:
-              name: cert-manager-clouddns
-              key: key.json
+          rfc2136:
+            nameserver: "198.18.199.53:53"
+            tsigKeyName: certmanager
+            tsigAlgorithm: HMACSHA256
+            tsigSecretSecretRef:
+              name: certmanager-tsig
+              key: secret

apps/base/cert-manager/kustomization.yaml

@@ -5,11 +5,8 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - serviceaccount.yaml
-  - serviceaccount_cert-manager-clouddns.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
   - vmservicescrape.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret_clouddns.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml

apps/base/cert-manager/serviceaccount_cert-manager-clouddns.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cert-manager-clouddns
-  namespace: cert-manager
-  labels:
-    app.kubernetes.io/name: cert-manager-config
-    app.kubernetes.io/instance: cert-manager-config
-    app.kubernetes.io/component: clouddns-solver
-automountServiceAccountToken: true

apps/base/cert-manager/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: cert-manager
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cert-manager
-  kubernetes:
-    role: cert_manager_clouddns
-    serviceAccount: cert-manager-clouddns
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/cert-manager/vaultstaticsecret_clouddns.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: clouddns
-  namespace: cert-manager
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/cert-manager/clouddns
-  refreshAfter: 5m
-  destination:
-    name: cert-manager-clouddns
-    create: true