saggar.dev(kube): deploy

- cert-manager-webhook-porkbun via Flux (chart 2.0.7, octabits fork)
- porkbun DNS-01 solver on letsencrypt-production for saggar.dev
- porkbun API credentials secret (sops)
- saggar.dev apex Certificate + Caddy site block -> traefik

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -15,6 +15,7 @@ spec:
   dependsOn:
     - name: cert-manager
     - name: cert-manager-webhook-ovh
+    - name: cert-manager-webhook-porkbun
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-porkbun.yaml

@@ -0,0 +1,20 @@
+# Flux Kustomization for cert-manager-webhook-porkbun
+# Depends on cert-manager being fully operational (CRDs installed)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
+  dependsOn:
+    - name: cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - webhook.yaml
   - cert-manager.yaml
   - cert-manager-webhook-ovh.yaml
+  - cert-manager-webhook-porkbun.yaml
   - cert-manager-issuer.yaml
   - caddy-certificates.yaml
   - stalwart-certificates.yaml