From fa239972a797b8cd392713f6be86482b285872c2 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:30:46 -0700
Subject: [PATCH] =?UTF-8?q?fix(cert-manager):=20render=20issuers=20via=20k?=
 =?UTF-8?q?ustomization=20resources=20list,=20restore=20automated=20sync?=
 =?UTF-8?q?=20=E2=80=94=20directory.include=20with=20bare=20filenames=20re?=
 =?UTF-8?q?ndered=20empty=20(never=20matched),=20so=20ArgoCD=20tracked=200?=
 =?UTF-8?q?=20resources=20and=20prune=20wiped=20the=20CA=20ConfigMaps=20+?=
 =?UTF-8?q?=20ClusterIssuers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/argocd/apps/00-substrate.yaml             | 14 ++++++++------
 k8s/bootstrap/cert-manager/kustomization.yaml | 11 +++++++++++
 2 files changed, 19 insertions(+), 6 deletions(-)
 create mode 100644 k8s/bootstrap/cert-manager/kustomization.yaml

diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml
index 50d742f..e5a20cd 100644
--- a/k8s/argocd/apps/00-substrate.yaml
+++ b/k8s/argocd/apps/00-substrate.yaml
@@ -88,17 +88,19 @@ spec:
   source:
     repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
+    # A real kustomization.yaml (resources: the 3 issuer/CA files) renders these
+    # deterministically. The previous directory.include with bare filenames
+    # rendered EMPTY — ArgoCD's include glob never matched — so this app silently
+    # tracked 0 resources; its ConfigMaps/Issuers only existed from bootstrap
+    # kubectl apply, and an automated prune wiped them.
     path: k8s/bootstrap/cert-manager
-    directory:
-      include: "letsencrypt-issuer.yaml,homelab-ca-issuer.yaml,homelab-ca-configmap.yaml"
   destination:
     server: https://kubernetes.default.svc
     namespace: cert-manager
   syncPolicy:
-    # automated sync intentionally disabled: ArgoCD directory.include renders
-    # this app's resources as EMPTY (root cause under investigation), so an
-    # automated prune wipes the ClusterIssuers + homelab-ca ConfigMaps. Keep
-    # manual until the render is fixed, then restore prune/selfHeal.
+    automated:
+      prune: true
+      selfHeal: true
     syncOptions:
       - CreateNamespace=true
 ---
diff --git a/k8s/bootstrap/cert-manager/kustomization.yaml b/k8s/bootstrap/cert-manager/kustomization.yaml
new file mode 100644
index 0000000..8368ceb
--- /dev/null
+++ b/k8s/bootstrap/cert-manager/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Issuers + CA trust-bundle ConfigMaps for the cert-manager-issuers Application.
+# Each resource sets its own metadata.namespace (the ConfigMaps target iam/cicd/
+# monitoring/sqs; ClusterIssuers are cluster-scoped) — so NO namespace transformer
+# here (that would rewrite them all into one namespace). cert-manager itself is a
+# separate Helm Application; cert-manager-values.yaml here is only its $values ref.
+resources:
+  - letsencrypt-issuer.yaml
+  - homelab-ca-issuer.yaml
+  - homelab-ca-configmap.yaml