Remove deprecated Let's Encrypt ClusterIssuer configurations and update dependencies in yc-ecp cert-manager and Istio configuration.

infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml

@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer
+$patch: delete

infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml

@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer-istio
+$patch: delete

infrastructure/cert-manager/yc-ecp/kustomization.yaml

@@ -4,3 +4,7 @@ resources:
   - ../base
 patches:
   - path: cert-manager.yaml
+  # ClusterIssuer/letsencrypt-prod создаёт istio-config; issuer'ы из base здесь
+  # не нужны и вдобавок делят один privateKeySecretRef, затирая ACME-ключ друг друга
+  - path: clusterissuer-letsencrypt-delete.yaml
+  - path: clusterissuer-letsencrypt-istio-delete.yaml

infrastructure/istio-config/yc-ecp/istio-config.yaml

@@ -5,8 +5,11 @@ metadata:
   namespace: default
 spec:
   # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
-  # в кластере нет — с зависимостями из base релиз никогда не станет Ready
-  dependsOn: []
+  # в кластере нет — с зависимостями из base релиз никогда не станет Ready.
+  # cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate
+  dependsOn:
+    - name: cert-manager
+      namespace: cert-manager
   interval: 5m
   timeout: 10m
   values:
@@ -16,7 +19,17 @@ spec:
       yc-ecp:
         namespaces: []
         certManager:
-          clusterIssuers: {}
+          clusterIssuers:
+            letsencrypt-prod:
+              acme:
+                email: "sarex@sarex.io"
+                server: "https://acme-v02.api.letsencrypt.org/directory"
+                privateKeySecretRef:
+                  name: letsencrypt-prod
+                solvers:
+                  - http01:
+                      ingress:
+                        class: istio
           certificates:
             gitea-tls-secret:
               namespace: istio-system