From 40703782ea25954ffa8f50c1a0d5a122fde8b27a Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 12:16:23 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20cert-manager=20Gateway=20A?=
 =?UTF-8?q?PI=20ACME=20solver?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/cert-manager/README.md   | 4 ++++
 platform/cert-manager/values.yaml | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/platform/cert-manager/README.md b/platform/cert-manager/README.md
index 13d28c9..73047da 100644
--- a/platform/cert-manager/README.md
+++ b/platform/cert-manager/README.md
@@ -119,6 +119,10 @@ issuerRef:
   kind: ClusterIssuer
 ```
 
+`values.yaml` 必须保持 `config.gatewayAPI.enabled: true`。`bao-acme` 的 HTTP-01
+solver 通过共享 Gateway 创建临时 HTTPRoute；关闭该项不会让 ClusterIssuer 变为
+NotReady，而是会让每个 Challenge 卡在 `gateway api is not enabled`。
+
 Issuance is capped by `default_directory_policy = role:bao-server`
 (`../../infrastructure/openbao/terraform/pki.tf`), which permits `ad.ddupan.top` subdomains only. Clients
 need the internal CA in their trust store — already true for the PVE nodes, the DC and
diff --git a/platform/cert-manager/values.yaml b/platform/cert-manager/values.yaml
index 61ae949..41b6743 100644
--- a/platform/cert-manager/values.yaml
+++ b/platform/cert-manager/values.yaml
@@ -44,6 +44,13 @@ cainjector:
     limits:
       memory: 256Mi
 
+# bao-acme solves HTTP-01 through the shared Gateway. The ClusterIssuer can be
+# accepted while this is disabled, but every Challenge then stays pending with
+# "gateway api is not enabled". Gateway API CRDs are installed by Envoy Gateway.
+config:
+  gatewayAPI:
+    enabled: true
+
 # ⚠ DNS-01 self-check: cert-manager polls authoritative NS for the _acme-challenge
 # TXT record before telling the CA to validate. By default it asks the cluster's
 # resolver, which for ad.ddupan.top is CoreDNS -> the Samba AD DC (k3s/coredns-custom.yaml).