The vault-issuer ClusterIssuer is applied out-of-band (Helm) and referenced
by ~15 Gateways, but is not tracked in GitOps, causing config drift.
- Add apps/base/cert-manager/clusterissuer_vault-issuer.yaml capturing the
live spec byte-faithfully (vault.service.consul pki_int/sign/servers_default,
k8s auth mount k8s/au/syd1, role cert_manager_issuer, SA cert-manager-vault-issuer,
caBundleSecretRef vault-ca-cert).
- Register the manifest in the cert-manager base kustomization.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Ben Vincent
321192c4c7