# ------------------------------------------------------------------------------
# Certificate — ArgoCD TLS
# Issued by cert-manager via letsencrypt-prod + Cloudflare DNS-01
#
# The secret produced (argocd-tls) is referenced by the Gateway listener
# in cluster/platform/gateway-api/gateway.yaml via ReferenceGrant.
#
# Per the thematic naming convention: argocd.local.mk-labs.cloud is the
# service DNS name. No VM hostname alias needed here.
# ------------------------------------------------------------------------------
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: argocd-tls
  namespace: argocd
spec:
  secretName: argocd-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - argocd.local.mk-labs.cloud

---
# ReferenceGrant — allows the Gateway in gateway-system to reference
# the TLS secret in the argocd namespace
# Without this, cross-namespace secret references are denied
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: argocd-tls-grant
  namespace: argocd
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: Gateway
      namespace: gateway-system
  to:
    - group: ""
      kind: Secret
      name: argocd-tls