Add cert-manager with Cloudflare DNS-01 ClusterIssuers

apps/cert-manager.yaml

@@ -0,0 +1,38 @@
+# cert-manager, installed like MetalLB and Longhorn: an Application pointing
+# at apps/cert-manager, a Helm chart that pulls in the upstream cert-manager
+# chart plus this cluster's ClusterIssuers. Once this syncs, an Ingress
+# anywhere in this repo can request a real, auto-renewing HTTPS certificate
+# just by adding one annotation. See docs/12-cert-manager.md.
+#
+# Deliberately NO resources-finalizer.argocd.argoproj.io here, same
+# reasoning as apps/longhorn.yaml. cert-manager's CRDs (Certificate,
+# ClusterIssuer, Order, Challenge) are cluster-wide — deleting them cascades
+# through Kubernetes' own garbage collector to delete every Certificate
+# custom resource in the cluster, and each Certificate owns its resulting
+# TLS Secret by default. Cascading this Application's deletion could
+# silently delete every HTTPS certificate this cluster has, cluster-wide,
+# not just cert-manager's own Pods. Removing this file from Git should be a
+# rare, deliberate act, confirmed by hand.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/cert-manager
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true