Skip to content

fix(cert-manager-config): make the Cloudflare ExternalSecret key configurable #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielgines merged 1 commit into from
Aug 11, 2026
Merged

fix(cert-manager-config): make the Cloudflare ExternalSecret key configurable #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,21 @@ and the corresponding commit messages.

## [Unreleased]

### Fixed

- `components/cert-manager-config`: the ExternalSecret branch of
`cluster-issuer-cloudflare.yaml` hardcoded `remoteRef.key:
cloudflare-api-token`. That is a flat Azure Key Vault name; on AWS the
external-secrets IRSA role is scoped to `estabilis/<deploymentId>/*`, so a
bare key never resolves and the branch was unusable — leaving AWS
deployments on the direct-injection path, which writes the token in
cleartext onto the Application spec.

The key now comes from `kvSecrets.cloudflareApiToken`, defaulting to the
previous literal so Azure behaviour is unchanged. `platform-root` in
estabilis-platform >= the companion release passes the prefixed Secrets
Manager path on AWS.

## [0.42.10] - 2026-06-08

### Fixed
Expand Down
7 changes: 5 additions & 2 deletions components/cert-manager-config/templates/cluster-issuer-cloudflare.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,10 @@ type: Opaque
stringData:
api-token: {{ .Values.global.cloudflareApiToken | quote }}
{{- else }}
{{- /* Workload path: token in workload Key Vault, read by ExternalSecrets. */ -}}
{{- /* Secret-store path: token stays in the store, ESO materialises the
Secret. `remoteRef.key` comes from values so AWS deployments can pass
the full Secrets Manager path — a bare name only resolves against
Azure Key Vault, where names are flat. */ -}}
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
Expand All @@ -30,7 +33,7 @@ spec:
data:
- secretKey: api-token
remoteRef:
key: cloudflare-api-token
key: {{ (default dict .Values.kvSecrets).cloudflareApiToken | default "cloudflare-api-token" | quote }}
{{- end }}
---
apiVersion: cert-manager.io/v1
Expand Down
12 changes: 11 additions & 1 deletion components/cert-manager-config/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,17 @@ global:
subscriptionId: "" # used when dnsProvider=azure
resourceGroup: "" # used when dnsProvider=azure
domain: ""
cloudflareApiToken: "" # used when dnsProvider=cloudflare
cloudflareApiToken: "" # used when dnsProvider=cloudflare — DIRECT injection (cleartext)

# Secret-store path (used when global.cloudflareApiToken is empty): the name
# or path of the secret holding the token.
#
# The default is the flat Azure Key Vault name this chart has always used. On
# AWS, secrets live under `estabilis/<deploymentId>/*` — the IRSA scope of the
# external-secrets role — so a bare name never resolves; platform-root
# overrides this with the prefixed path.
kvSecrets:
cloudflareApiToken: "cloudflare-api-token"
identity:
certManager:
clientId: "" # used when dnsProvider=azure
Loading