Ben Vincent 779e448686 Add Let's Encrypt DNS-01 clouddns ClusterIssuers ...

unkin.net public DNS is delegated to Google Cloud DNS, so publicly-trusted
wildcard certs need an ACME issuer using cert-manager's clouddns DNS-01
solver. The existing vault-issuer (internal PKI) is unchanged.

- Add ClusterIssuers letsencrypt (prod) and letsencrypt-staging, both using
  a dns01 clouddns solver with a GCP service-account key.
- Sync that key from Vault KV into Secret cert-manager-clouddns via a
  VaultStaticSecret + VaultAuth (role cert_manager_clouddns) and a dedicated
  cert-manager-clouddns service account.
- Wire the new files into the base kustomization.
- Whitelist cert-manager.io ClusterIssuer in the platform AppProject.

The clouddns project and the KV secret value are set out-of-band.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

2026-08-02 17:07:18 +10:00

..

base

Add Let's Encrypt DNS-01 clouddns ClusterIssuers

2026-08-02 17:07:18 +10:00

overlays/au-syd1

Add Tier-1 per-app Vector transform pipelines (structured logs) (#318)

2026-08-01 00:22:32 +10:00