unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Import live vault-issuer ClusterIssuer into GitOps #328

Merged
benvin merged 1 commits from benvin/vault-issuer-gitops into main 2026-08-02 18:00:00 +10:00
Conversation 0 Commits 1 Files Changed 2
+28
unkinben commented 2026-08-02 17:19:41 +10:00
Owner
Copy Link
Copy Source

Why

The `vault-issuer` ClusterIssuer is applied out-of-band (Helm release `cert-manager-clusterissuer`) and is referenced by ~15 Gateways, but is not tracked in GitOps — so the live, load-bearing issuer is drift. This imports it so ArgoCD manages it. The committed spec matches the live object exactly (verified against `kubectl get clusterissuer vault-issuer -o yaml`), so adoption is a no-op.

Changes

  • Add `apps/base/cert-manager/clusterissuer_vault-issuer.yaml` capturing the live spec byte-faithfully: server `https://vault.service.consul:8200`, path `pki_int/sign/servers_default`, k8s auth mount `/v1/auth/k8s/au/syd1`, role `cert_manager_issuer`, serviceAccountRef `cert-manager-vault-issuer` (audience `vault`), caBundleSecretRef `vault-ca-cert`/`ca.crt`. Helm ownership labels/annotations kept so adoption produces zero diff.
  • Register the manifest in the cert-manager base kustomization (inserted between `clusterrolebinding.yaml` and `vmservicescrape.yaml` to avoid the lines #327 touches).

Depends on #327

ArgoCD can only adopt this resource once `{group: cert-manager.io, kind: ClusterIssuer}` is in the platform project `clusterResourceWhitelist`. That whitelist entry is added by #327, not here (to avoid a duplicate/conflicting change). Merge #327 first. There may be a small merge conflict with #327 in `apps/base/cert-manager/kustomization.yaml` (both append to the `resources` list); rebase on main after #327 merges.

Note: SA name discrepancy (not fixed here — committing live spec unchanged)

The live issuer authenticates as SA `cert-manager-vault-issuer`, but the repo scaffolding `serviceaccount.yaml` creates SA `vault-issuer`. Both SAs exist live in `cert-manager` (192d and 136d). The issuer uses `cert-manager-vault-issuer`, so this PR commits that name (live truth). The repo-managed `vault-issuer` SA appears unused by this issuer — worth a follow-up to reconcile which SA is canonical, but out of scope for a zero-change import.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

## Why The \`vault-issuer\` ClusterIssuer is applied out-of-band (Helm release \`cert-manager-clusterissuer\`) and is referenced by ~15 Gateways, but is not tracked in GitOps — so the live, load-bearing issuer is drift. This imports it so ArgoCD manages it. The committed spec matches the live object exactly (verified against \`kubectl get clusterissuer vault-issuer -o yaml\`), so adoption is a no-op. ## Changes - Add \`apps/base/cert-manager/clusterissuer_vault-issuer.yaml\` capturing the live spec byte-faithfully: server \`https://vault.service.consul:8200\`, path \`pki_int/sign/servers_default\`, k8s auth mount \`/v1/auth/k8s/au/syd1\`, role \`cert_manager_issuer\`, serviceAccountRef \`cert-manager-vault-issuer\` (audience \`vault\`), caBundleSecretRef \`vault-ca-cert\`/\`ca.crt\`. Helm ownership labels/annotations kept so adoption produces zero diff. - Register the manifest in the cert-manager base kustomization (inserted between \`clusterrolebinding.yaml\` and \`vmservicescrape.yaml\` to avoid the lines #327 touches). ## Depends on #327 ArgoCD can only adopt this resource once \`{group: cert-manager.io, kind: ClusterIssuer}\` is in the platform project \`clusterResourceWhitelist\`. That whitelist entry is added by #327, not here (to avoid a duplicate/conflicting change). **Merge #327 first.** There may be a small merge conflict with #327 in \`apps/base/cert-manager/kustomization.yaml\` (both append to the \`resources\` list); rebase on main after #327 merges. ## Note: SA name discrepancy (not fixed here — committing live spec unchanged) The live issuer authenticates as SA **\`cert-manager-vault-issuer\`**, but the repo scaffolding \`serviceaccount.yaml\` creates SA **\`vault-issuer\`**. Both SAs exist live in \`cert-manager\` (192d and 136d). The issuer uses \`cert-manager-vault-issuer\`, so this PR commits that name (live truth). The repo-managed \`vault-issuer\` SA appears unused by this issuer — worth a follow-up to reconcile which SA is canonical, but out of scope for a zero-change import. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben added 1 commit 2026-08-02 17:19:42 +10:00
Import live vault-issuer ClusterIssuer into GitOps
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
321192c4c7 
The vault-issuer ClusterIssuer is applied out-of-band (Helm) and referenced
by ~15 Gateways, but is not tracked in GitOps, causing config drift.

- Add apps/base/cert-manager/clusterissuer_vault-issuer.yaml capturing the
  live spec byte-faithfully (vault.service.consul pki_int/sign/servers_default,
  k8s auth mount k8s/au/syd1, role cert_manager_issuer, SA cert-manager-vault-issuer,
  caBundleSecretRef vault-ca-cert).
- Register the manifest in the cert-manager base kustomization.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
benvin merged commit 239ea07d5c into main 2026-08-02 18:00:00 +10:00
benvin deleted branch benvin/vault-issuer-gitops 2026-08-02 18:00:01 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#328
Delete Branch "benvin/vault-issuer-gitops"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?