unkinben
239ea07d5c
## Why The \`vault-issuer\` ClusterIssuer is applied out-of-band (Helm release \`cert-manager-clusterissuer\`) and is referenced by ~15 Gateways, but is not tracked in GitOps — so the live, load-bearing issuer is drift. This imports it so ArgoCD manages it. The committed spec matches the live object exactly (verified against \`kubectl get clusterissuer vault-issuer -o yaml\`), so adoption is a no-op. ## Changes - Add \`apps/base/cert-manager/clusterissuer_vault-issuer.yaml\` capturing the live spec byte-faithfully: server \`https://vault.service.consul:8200\`, path \`pki_int/sign/servers_default\`, k8s auth mount \`/v1/auth/k8s/au/syd1\`, role \`cert_manager_issuer\`, serviceAccountRef \`cert-manager-vault-issuer\` (audience \`vault\`), caBundleSecretRef \`vault-ca-cert\`/\`ca.crt\`. Helm ownership labels/annotations kept so adoption produces zero diff. - Register the manifest in the cert-manager base kustomization (inserted between \`clusterrolebinding.yaml\` and \`vmservicescrape.yaml\` to avoid the lines #327 touches). ## Depends on #327 ArgoCD can only adopt this resource once \`{group: cert-manager.io, kind: ClusterIssuer}\` is in the platform project \`clusterResourceWhitelist\`. That whitelist entry is added by #327, not here (to avoid a duplicate/conflicting change). **Merge #327 first.** There may be a small merge conflict with #327 in \`apps/base/cert-manager/kustomization.yaml\` (both append to the \`resources\` list); rebase on main after #327 merges. ## Note: SA name discrepancy (not fixed here — committing live spec unchanged) The live issuer authenticates as SA **\`cert-manager-vault-issuer\`**, but the repo scaffolding \`serviceaccount.yaml\` creates SA **\`vault-issuer\`**. Both SAs exist live in \`cert-manager\` (192d and 136d). The issuer uses \`cert-manager-vault-issuer\`, so this PR commits that name (live truth). The repo-managed \`vault-issuer\` SA appears unused by this issuer — worth a follow-up to reconcile which SA is canonical, but out of scope for a zero-change import. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #328 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
28 lines
736 B
YAML
28 lines
736 B
YAML
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: vault-issuer
|
|
labels:
|
|
app.kubernetes.io/instance: cert-manager-config
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: cert-manager-config
|
|
annotations:
|
|
meta.helm.sh/release-name: cert-manager-clusterissuer
|
|
meta.helm.sh/release-namespace: cert-manager
|
|
spec:
|
|
vault:
|
|
server: https://vault.service.consul:8200
|
|
path: pki_int/sign/servers_default
|
|
caBundleSecretRef:
|
|
key: ca.crt
|
|
name: vault-ca-cert
|
|
auth:
|
|
kubernetes:
|
|
mountPath: /v1/auth/k8s/au/syd1
|
|
role: cert_manager_issuer
|
|
serviceAccountRef:
|
|
name: cert-manager-vault-issuer
|
|
audiences:
|
|
- vault
|