From 321192c4c71406b491894f5056e07c0cd2d4ee2d Mon Sep 17 00:00:00 2001
From: Ben Vincent <neotheo@gmail.com>
Date: Sun, 2 Aug 2026 17:19:21 +1000
Subject: [PATCH] Import live vault-issuer ClusterIssuer into GitOps

The vault-issuer ClusterIssuer is applied out-of-band (Helm) and referenced
by ~15 Gateways, but is not tracked in GitOps, causing config drift.

- Add apps/base/cert-manager/clusterissuer_vault-issuer.yaml capturing the
  live spec byte-faithfully (vault.service.consul pki_int/sign/servers_default,
  k8s auth mount k8s/au/syd1, role cert_manager_issuer, SA cert-manager-vault-issuer,
  caBundleSecretRef vault-ca-cert).
- Register the manifest in the cert-manager base kustomization.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
---
 .../clusterissuer_vault-issuer.yaml           | 27 +++++++++++++++++++
 apps/base/cert-manager/kustomization.yaml     |  1 +
 2 files changed, 28 insertions(+)
 create mode 100644 apps/base/cert-manager/clusterissuer_vault-issuer.yaml

diff --git a/apps/base/cert-manager/clusterissuer_vault-issuer.yaml b/apps/base/cert-manager/clusterissuer_vault-issuer.yaml
new file mode 100644
index 0000000..4c3d20a
--- /dev/null
+++ b/apps/base/cert-manager/clusterissuer_vault-issuer.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vault-issuer
+  labels:
+    app.kubernetes.io/instance: cert-manager-config
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cert-manager-config
+  annotations:
+    meta.helm.sh/release-name: cert-manager-clusterissuer
+    meta.helm.sh/release-namespace: cert-manager
+spec:
+  vault:
+    server: https://vault.service.consul:8200
+    path: pki_int/sign/servers_default
+    caBundleSecretRef:
+      key: ca.crt
+      name: vault-ca-cert
+    auth:
+      kubernetes:
+        mountPath: /v1/auth/k8s/au/syd1
+        role: cert_manager_issuer
+        serviceAccountRef:
+          name: cert-manager-vault-issuer
+          audiences:
+            - vault
diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml
index f1fcada..804444f 100644
--- a/apps/base/cert-manager/kustomization.yaml
+++ b/apps/base/cert-manager/kustomization.yaml
@@ -7,4 +7,5 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
+  - clusterissuer_vault-issuer.yaml
   - vmservicescrape.yaml
-- 
2.47.3