# k8s/cert-manager/cert-manager-values.yaml
# cert-manager issues every per-hostname cert off homelab-ca and renews the
# wildcard cert nginx serves — certmanager_certificate_expiration_timestamp_seconds
# is the early-warning signal before any service's TLS breaks.

# CRDs must be installed by the chart — ArgoCD helm-template does not apply a
# chart's crds/ folder, and the ClusterIssuer/Certificate resources (wave 1)
# depend on them existing first.
installCRDs: true

# Tolerate the control-plane taint (talos-cp-1 is the only schedulable node).
tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule
webhook:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule
cainjector:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule
startupapicheck:
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

prometheus:
  enabled: true
  servicemonitor:
    enabled: true
    interval: 60s