Enable Reloader secret watching, scope existing auto to configmap-only (#326)

The internal intermediate CA re-key broke CA consumers because Reloader
ignored Secrets and could not restart on the vault-ca-cert Secret. Enabling
generic secret watching naively would restart every workload on each
Vault/VSO secret rotation, so this scopes existing auto annotations to
ConfigMaps and makes secret reload opt-in per Secret.

- set reloader ignoreSecrets: false so Secrets are watched
- convert every generic reloader.stakater.com/auto to the configmap-only
  configmap.reloader.stakater.com/auto form (22 annotations, 19 files)
- add explicit secret.reloader.stakater.com/reload: "vault-ca-cert" to the CA
  consumers (artifactapi api, cephrgw-operator, puppetserver master+compiler,
  litellm, logarchiver) so CA rotation restarts them
- add secret.reloader.stakater.com/reload: "kanidm-tls" so the cert-manager
  leaf renewal rolls kanidm
- add docs/ca-rotation.md runbook and index it

Closes #326

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/age-api/deployment.yaml

@@ -12,7 +12,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app: age-api
     spec:

apps/base/artifactapi/api-deployment.yaml

@@ -5,7 +5,8 @@ metadata:
   name: api
   namespace: artifactapi
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
   selector:
     matchLabels:

apps/base/artifactapi/ui-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   name: ui
   namespace: artifactapi
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
 spec:
   selector:
     matchLabels:

apps/base/cephrgw-system/deployment.yaml

@@ -7,8 +7,10 @@ metadata:
   labels:
     app.kubernetes.io/name: cephrgw-operator
   annotations:
-    # Restart the operator when the credentials Secret rotates.
-    reloader.stakater.com/auto: "true"
+    # Restart on internal CA rotation only; cephrgw-credentials is Vault-rotated
+    # (VSO) and deliberately excluded so routine key rotation causes no restart.
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
   replicas: 1
   selector:

apps/base/encapi/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   name: encapi
   namespace: encapi
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
 spec:
   replicas: 2
   selector:

apps/base/kanidm/statefulset.yaml

@@ -5,7 +5,8 @@ metadata:
   name: kanidm
   namespace: kanidm
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "kanidm-tls"
   labels:
     app.kubernetes.io/name: kanidm
     app.kubernetes.io/instance: kanidm

apps/base/litellm/deployment.yaml

@@ -11,7 +11,8 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
+        secret.reloader.stakater.com/reload: "vault-ca-cert"
       labels:
         app: litellm
     spec:

apps/base/logging/deployment_logarchiver.yaml

@@ -10,7 +10,8 @@ metadata:
   name: logarchiver
   namespace: logging
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
   labels:
     app.kubernetes.io/name: logarchiver
     app.kubernetes.io/component: archiver

apps/base/pdbmux/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   name: pdbmux
   namespace: pdbmux
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
 spec:
   replicas: 2
   selector:

apps/base/puppet/deployment_puppetboard.yaml

@@ -21,7 +21,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app.kubernetes.io/component: puppetboard
         app.kubernetes.io/instance: puppetserver

apps/base/puppet/deployment_puppetdb.yaml

@@ -20,7 +20,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app.kubernetes.io/component: puppetdb
         app.kubernetes.io/instance: puppetserver

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -2,7 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
   labels:
     app.kubernetes.io/component: puppetserver-compilers
     app.kubernetes.io/instance: puppetserver

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -2,7 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
   labels:
     app.kubernetes.io/component: puppetserver
     app.kubernetes.io/instance: puppetserver
@@ -20,7 +21,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app.kubernetes.io/component: puppetserver
         app.kubernetes.io/instance: puppetserver