panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
21 lines
862 B
YAML
21 lines
862 B
YAML
# Template for cert-manager/secret.yaml (gitignored). Copy, fill in, apply.
|
|
#
|
|
# Same token as cloudflared/terraform/terraform.tfvars — extract it with:
|
|
# sed -nE 's/^[[:space:]]*cloudflare_api_token[[:space:]]*=[[:space:]]*"([^"]*)".*/\1/p' \
|
|
# cloudflared/terraform/terraform.tfvars
|
|
# (a naive `cut -d= -f2` also swallows the trailing comment on that line)
|
|
#
|
|
# Must live in the cert-manager namespace: a ClusterIssuer resolves solver Secret
|
|
# refs in the namespace where cert-manager runs, not where the Certificate is.
|
|
#
|
|
# ⚠ This token also carries Account·Cloudflare Tunnel:Edit. Replacing it with one
|
|
# scoped to Zone·DNS:Edit on ddupan.top would shrink the blast radius to DNS.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cloudflare-api-token
|
|
namespace: cert-manager
|
|
type: Opaque
|
|
stringData:
|
|
api-token: "REPLACE_WITH_CLOUDFLARE_API_TOKEN"
|