From 3a0f50a5b0c587cb1118fa1245591d1f874e5268 Mon Sep 17 00:00:00 2001
From: cortex-skynet <dangines@gmail.com>
Date: Tue, 11 Aug 2026 21:27:04 +0000
Subject: [PATCH] fix(cert-manager-config): make the Cloudflare ExternalSecret
 key configurable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`cluster-issuer-cloudflare.yaml` already had a secret-store branch, but its
`remoteRef.key` was hardcoded to `cloudflare-api-token` — a flat Azure Key
Vault name. On AWS the external-secrets IRSA role is scoped to
`estabilis/<deploymentId>/*`, so a bare key never resolves.

The effect was that the branch was unusable on AWS, leaving those deployments
on the direct-injection path, which writes the token in cleartext onto the
Application spec — an ArgoCD Application is a CRD, so it sits outside the EKS
`resources: ["secrets"]` envelope encryption, and it is readable in the ArgoCD
UI/API and the repo-server cache.

The key now reads from `kvSecrets.cloudflareApiToken`, defaulting to the
previous literal so Azure renders byte-identically. platform-root passes the
prefixed Secrets Manager path on AWS (companion PR in estabilis-platform).

Rendered: default -> "cloudflare-api-token"; with kvSecrets -> the full path;
with a direct token -> no ExternalSecret, direct path still wins.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VefhWrLXRQq6sEVgTTuXk5
---
 CHANGELOG.md                                      | 15 +++++++++++++++
 .../templates/cluster-issuer-cloudflare.yaml      |  7 +++++--
 components/cert-manager-config/values.yaml        | 12 +++++++++++-
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f271d27..d0fe524 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,21 @@ and the corresponding commit messages.
 
 ## [Unreleased]
 
+### Fixed
+
+- `components/cert-manager-config`: the ExternalSecret branch of
+  `cluster-issuer-cloudflare.yaml` hardcoded `remoteRef.key:
+  cloudflare-api-token`. That is a flat Azure Key Vault name; on AWS the
+  external-secrets IRSA role is scoped to `estabilis/<deploymentId>/*`, so a
+  bare key never resolves and the branch was unusable — leaving AWS
+  deployments on the direct-injection path, which writes the token in
+  cleartext onto the Application spec.
+
+  The key now comes from `kvSecrets.cloudflareApiToken`, defaulting to the
+  previous literal so Azure behaviour is unchanged. `platform-root` in
+  estabilis-platform >= the companion release passes the prefixed Secrets
+  Manager path on AWS.
+
 ## [0.42.10] - 2026-06-08
 
 ### Fixed
diff --git a/components/cert-manager-config/templates/cluster-issuer-cloudflare.yaml b/components/cert-manager-config/templates/cluster-issuer-cloudflare.yaml
index 1a1e3df..c7075d6 100644
--- a/components/cert-manager-config/templates/cluster-issuer-cloudflare.yaml
+++ b/components/cert-manager-config/templates/cluster-issuer-cloudflare.yaml
@@ -12,7 +12,10 @@ type: Opaque
 stringData:
   api-token: {{ .Values.global.cloudflareApiToken | quote }}
 {{- else }}
-{{- /* Workload path: token in workload Key Vault, read by ExternalSecrets. */ -}}
+{{- /* Secret-store path: token stays in the store, ESO materialises the
+       Secret. `remoteRef.key` comes from values so AWS deployments can pass
+       the full Secrets Manager path — a bare name only resolves against
+       Azure Key Vault, where names are flat. */ -}}
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -30,7 +33,7 @@ spec:
   data:
     - secretKey: api-token
       remoteRef:
-        key: cloudflare-api-token
+        key: {{ (default dict .Values.kvSecrets).cloudflareApiToken | default "cloudflare-api-token" | quote }}
 {{- end }}
 ---
 apiVersion: cert-manager.io/v1
diff --git a/components/cert-manager-config/values.yaml b/components/cert-manager-config/values.yaml
index 592f973..433905f 100644
--- a/components/cert-manager-config/values.yaml
+++ b/components/cert-manager-config/values.yaml
@@ -5,7 +5,17 @@ global:
   subscriptionId: ""        # used when dnsProvider=azure
   resourceGroup: ""         # used when dnsProvider=azure
   domain: ""
-  cloudflareApiToken: ""    # used when dnsProvider=cloudflare
+  cloudflareApiToken: ""    # used when dnsProvider=cloudflare — DIRECT injection (cleartext)
+
+# Secret-store path (used when global.cloudflareApiToken is empty): the name
+# or path of the secret holding the token.
+#
+# The default is the flat Azure Key Vault name this chart has always used. On
+# AWS, secrets live under `estabilis/<deploymentId>/*` — the IRSA scope of the
+# external-secrets role — so a bare name never resolves; platform-root
+# overrides this with the prefixed path.
+kvSecrets:
+  cloudflareApiToken: "cloudflare-api-token"
 identity:
   certManager:
     clientId: ""            # used when dnsProvider=azure