cert-manager needs a Google Cloud DNS service-account key to solve
Let's Encrypt DNS-01 challenges for publicly-trusted certs. VSO syncs it
from Vault KV, so the cert-manager namespace needs its own k8s auth role
and a policy granting read on the KV path.
- Add k8s auth role cert_manager_clouddns bound to SA
cert-manager-clouddns in the cert-manager namespace.
- Add policy granting read on
kv/service/kubernetes/au/syd1/cert-manager/clouddns, bound to that role.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben
ea380b9417