From 6b107c872aa3728938e1a09a99483e452f24b170 Mon Sep 17 00:00:00 2001
From: emelinda <emelin_d_a@mail.ru>
Date: Tue, 4 Aug 2026 23:14:05 +0300
Subject: [PATCH] Remove deprecated Let's Encrypt ClusterIssuer configurations
 and update dependencies in `yc-ecp` cert-manager and Istio configuration.

---
 .../clusterissuer-letsencrypt-delete.yaml     |  5 +++++
 ...lusterissuer-letsencrypt-istio-delete.yaml |  5 +++++
 .../cert-manager/yc-ecp/kustomization.yaml    |  4 ++++
 .../istio-config/yc-ecp/istio-config.yaml     | 19 ++++++++++++++++---
 4 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml
 create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml

diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml
new file mode 100644
index 0000000..494e4ab
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml
@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer
+$patch: delete
diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml
new file mode 100644
index 0000000..9901d81
--- /dev/null
+++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml
@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer-istio
+$patch: delete
diff --git a/infrastructure/cert-manager/yc-ecp/kustomization.yaml b/infrastructure/cert-manager/yc-ecp/kustomization.yaml
index 6e03798..032cf3b 100644
--- a/infrastructure/cert-manager/yc-ecp/kustomization.yaml
+++ b/infrastructure/cert-manager/yc-ecp/kustomization.yaml
@@ -4,3 +4,7 @@ resources:
   - ../base
 patches:
   - path: cert-manager.yaml
+  # ClusterIssuer/letsencrypt-prod создаёт istio-config; issuer'ы из base здесь
+  # не нужны и вдобавок делят один privateKeySecretRef, затирая ACME-ключ друг друга
+  - path: clusterissuer-letsencrypt-delete.yaml
+  - path: clusterissuer-letsencrypt-istio-delete.yaml
diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml
index 1810ac9..00a2081 100644
--- a/infrastructure/istio-config/yc-ecp/istio-config.yaml
+++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml
@@ -5,8 +5,11 @@ metadata:
   namespace: default
 spec:
   # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
-  # в кластере нет — с зависимостями из base релиз никогда не станет Ready
-  dependsOn: []
+  # в кластере нет — с зависимостями из base релиз никогда не станет Ready.
+  # cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate
+  dependsOn:
+    - name: cert-manager
+      namespace: cert-manager
   interval: 5m
   timeout: 10m
   values:
@@ -16,7 +19,17 @@ spec:
       yc-ecp:
         namespaces: []
         certManager:
-          clusterIssuers: {}
+          clusterIssuers:
+            letsencrypt-prod:
+              acme:
+                email: "sarex@sarex.io"
+                server: "https://acme-v02.api.letsencrypt.org/directory"
+                privateKeySecretRef:
+                  name: letsencrypt-prod
+                solvers:
+                  - http01:
+                      ingress:
+                        class: istio
           certificates:
             gitea-tls-secret:
               namespace: istio-system