# cert-manager Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
#
# crds.enabled: true                          # install CRDs with the chart
# dns01RecursiveNameservers / -Only           # TODO(WS-SEC): may be needed with split-horizon DNS
# ClusterIssuers (letsencrypt-staging/-prod) live in clusterissuers.yaml, not here.
# Cloudflare API token: SOPS-encrypted secret `cloudflare-api-token` (WS-SEC, OQ-4) — name only.
# prometheus.servicemonitor.enabled: true     # scrape the controller's 9402 metrics port; without it
#                                             # the certmanager_* family is absent from the TSDB and
#                                             # the three Certificate* alert rules in
#                                             # platform/monitoring/alerts.yaml are INERT. Mutually
#                                             # exclusive with prometheus.podmonitor.enabled.