feat(substrate): deploy cert-manager/ingress-nginx/reloader + privileged PodSecurity for ingress-nginx

k8s/bootstrap/cert-manager/cert-manager-values.yaml

@@ -3,6 +3,32 @@
 # wildcard cert nginx serves — certmanager_certificate_expiration_timestamp_seconds
 # is the early-warning signal before any service's TLS breaks.
 
+# CRDs must be installed by the chart — ArgoCD helm-template does not apply a
+# chart's crds/ folder, and the ClusterIssuer/Certificate resources (wave 1)
+# depend on them existing first.
+installCRDs: true
+
+# Tolerate the control-plane taint (talos-cp-1 is the only schedulable node).
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+webhook:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+cainjector:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+startupapicheck:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 prometheus:
   enabled: true
   servicemonitor: