---
# cert-manager — issues trusted Let's Encrypt certs via ACME DNS-01 (ADR-0006). Phase 0 STUB.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: cert-manager
  namespace: cert-manager
spec:
  interval: 30m
  chart:
    spec:
      chart: cert-manager
      version: ">=1.16.0 <1.17.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: jetstack
        namespace: cert-manager
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    crds:
      enabled: true      # install CRDs with the chart
    # TODO(WS-SEC, Phase 2): DNS-01 recursive nameserver config if split-horizon DNS interferes
    #   with propagation checks (docs/09 split-horizon note).