{#
  Managed by Ansible (roles/k3s_cert_manager) — do not edit on the node.

  A HelmChart CR, same pattern as roles/k3s_metallb and roles/k3s_monitoring:
  k3s's bundled helm-controller reconciles it, the same mechanism it uses to
  install its own Traefik.
-#}
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: cert-manager
  namespace: kube-system
spec:
  chart: cert-manager
  repo: {{ k3s_cert_manager_chart_repo }}
  version: "{{ k3s_cert_manager_chart_version }}"
  targetNamespace: {{ k3s_cert_manager_namespace }}
  createNamespace: true
  valuesContent: |-
    # The chart installs its own CRDs. Without this they'd have to be applied
    # separately before the chart, which the helm-controller gives no ordering
    # hook for — and the ClusterIssuer this role also renders would then never
    # become appliable.
    crds:
      enabled: true

    # Sized for a Raspberry Pi 4, same reasoning as k3s_monitoring_values and
    # k3s_postgres_resources. cert-manager is idle almost all of the time —
    # it wakes to renew a certificate every 60 days — so these are set for
    # "doesn't get OOM-killed during a renewal", not for throughput.
    resources:
      requests:
        cpu: 10m
        memory: 64Mi
      limits:
        memory: 128Mi
    webhook:
      resources:
        requests:
          cpu: 10m
          memory: 64Mi
        limits:
          memory: 128Mi
    cainjector:
      resources:
        requests:
          cpu: 10m
          memory: 96Mi
        limits:
          memory: 192Mi

    # DNS-01 self-check queries the authoritative nameservers directly rather
    # than going through the cluster's resolver. Without this, CoreDNS
    # forwards to whatever the LAN's DNS is, and a split-horizon setup —
    # where the internal view of the zone doesn't carry the _acme-challenge
    # TXT record the public view does — makes cert-manager wait for a record
    # it will never see, until the order times out.
    dns01RecursiveNameservers: "1.1.1.1:53,9.9.9.9:53"
    dns01RecursiveNameserversOnly: true