feat: migrate cert-manager from Terraform to ArgoCD

- Add cert-manager base ArgoCD application with namespace, RBAC resources
- Create cert-manager overlay for au-syd1 with Helm chart configuration
- Update platform ApplicationSet to include cert-manager deployment
- Configure cert-manager v1.19.2 with jetstack Helm repository
- Maintain one-to-one migration from Terraform configuration

.woodpecker/kubeconform.yaml

@@ -3,6 +3,6 @@ when:
 
 steps:
   - name: kubeconform
-    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
+    image: git.unkin.net/unkin/almalinux9-kubetest:20260308
     commands:
       - make kubeconform

apps/base/cattle-system/ingress.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - ingress.yaml

apps/base/cattle-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cattle-system

apps/base/cattle-system/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cattle-system
-  kubernetes:
-    role: rancher
-    serviceAccount: rancher
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/cattle-system/vaultstaticsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: rancher-bootstrap-secret
-  namespace: cattle-system
-spec:
-  vaultAuthRef: rancher
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/rancher/bootstrap-password
-  refreshAfter: 5m
-  destination:
-    name: rancher-bootstrap-secret
-    create: true

apps/overlays/au-syd1/cattle-system/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/cattle-system
-
-helmCharts:
-  - name: rancher
-    repo: https://releases.rancher.com/server-charts/stable
-    version: "2.13.1"
-    releaseName: rancher
-    namespace: cattle-system
-    valuesFile: values.yaml

apps/overlays/au-syd1/cattle-system/values.yaml

@@ -1,40 +0,0 @@
-hostname: rancher.k8s.syd1.au.unkin.net
-
-bootstrapPassword: ""
-
-extraEnv:
-  - name: CATTLE_BOOTSTRAP_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: rancher-bootstrap-secret
-        key: password
-
-ingress:
-  enabled: false
-
-tls: external
-
-replicas: 3
-
-priorityClassName: rancher-critical
-
-# Resource limits for production
-resources:
-  limits:
-    cpu: 2000m
-    memory: 8Gi
-  requests:
-    cpu: 50m
-    memory: 256Mi
-
-# Additional security settings
-antiAffinity: preferred
-
-# Audit logging configuration
-auditLog:
-  enabled: true
-  destination: sidecar
-  level: 1
-  maxAge: 7
-  maxBackup: 3
-  maxSize: 100

argocd/applicationsets/platform.yaml

@@ -11,7 +11,6 @@ spec:
       revision: HEAD
       directories:
       - path: apps/overlays/*/artifactapi
-      - path: apps/overlays/*/cattle-system
       - path: apps/overlays/*/certificates
       - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/reflector-system

argocd/projects/platform.yaml

@@ -10,17 +10,12 @@ spec:
     - https://git.unkin.net/unkin/argocd-apps
     - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
-    - https://releases.rancher.com/server-charts/stable
     - https://charts.jetstack.io
   destinations:
     - namespace: '*-system'
       server: https://kubernetes.default.svc
     - namespace: 'artifactapi'
       server: https://kubernetes.default.svc
-    - namespace: 'cert-manager'
-      server: https://kubernetes.default.svc
-    - namespace: 'certificates'
-      server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
     - namespace: 'puppet'
@@ -36,12 +31,6 @@ spec:
       kind: ClusterRoleBinding
     - group: 'apiextensions.k8s.io'
       kind: CustomResourceDefinition
-    - group: 'admissionregistration.k8s.io'
-      kind: MutatingWebhookConfiguration
-    - group: 'admissionregistration.k8s.io'
-      kind: ValidatingWebhookConfiguration
-    - group: 'scheduling.k8s.io'
-      kind: PriorityClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'