fix: tryfix secret read permissions

kubernetes/system/cert-manager-issuer/kustomization.yaml

@@ -3,3 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - clusterissuer.yaml
+  - ovh-credentials-secret.yaml
+  - ovh-secret-reader-rbac.yaml

kubernetes/system/cert-manager-issuer/ovh-credentials-secret.yaml

@@ -0,0 +1,50 @@
+# OVH API Credentials for DNS-01 Challenges
+#
+# OVH API credentials with the following permissions:
+#   - GET, POST, PUT, DELETE on /domain/zone/*
+#
+# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager),
+# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace
+# to the webhook's own namespace, and the webhook looks up credential secrets
+# there (see ch.ResourceNamespace in the webhook's ovhClient() function).
+#
+# SOPS will encrypt the stringData fields on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ovh-credentials
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-credentials
+type: Opaque
+stringData:
+    applicationKey: ENC[AES256_GCM,data:0+y+m8n/eup5lY/vGW5ASQ==,iv:VSIhfNAvSNOLq92TVcaW54ygU1wgAv+u35HZ0cbP6UU=,tag:KD+cyIesTQgqEzGMro8xyA==,type:str]
+    applicationSecret: ENC[AES256_GCM,data:sP0febHRFF/atAFlRM6sYXoM+Lp6Rnf7d0IQKcsa0vY=,iv:nHYMHSsOclkZmQJSjcz2oXMHsDTct5hTmJz1L7xgvpA=,tag:oCGoRP7R0W+PTNRCeLFvyg==,type:str]
+    consumerKey: ENC[AES256_GCM,data:vw/Q39CpSc5o1ntPDMT3844aLbTHQrSYH8RhoZFFZrQ=,iv:6B0F9Zq56inpW7AS8okbpqJkRK3WkBjX6sIqclOP9Hs=,tag:nnbgwBMBM4JZg/IEYzRvVw==,type:str]
+sops:
+    lastmodified: "2026-07-10T05:06:52Z"
+    mac: ENC[AES256_GCM,data:0/VEDE1ZuIyzkaleosS/KHYX44762TbScrJGJylwV21d7U6YgpwRMOXvU9xn3rHsDXnh5IAmAtrXQTYJFN1vcF1DNw5O9+TQKVoO6B5rsel/YyKRU4s7aYcfDgbW9dO1wn33K65KFtM+0Qv187DzEn1by449TgWIWP/M5U40PE4=,iv:hIGzMwsas8VxC4941ABeoocYWSlVSz9KW7a5tTAoRXI=,tag:n/EJEkEBL20carqVesMBsw==,type:str]
+    pgp:
+        - created_at: "2026-07-10T05:06:52Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAu0va03SPYOU23iUjoTMiXJ6+nMhIX8lsurvmCvi+wIqk
+            c7qu0lTfXv62IjkY6fIKtOE7TN9TiipjzXG2QJaK94QeiFpe9M90qNo09qEIje9m
+            DepTrLfyINFT0SY2eihl+nXhBXuEDSiD5K60OsXGPN92hJMwCad5jJuB7xpmrX0m
+            X0A1Bl9orce/do/YJoy5hq0persB/VSeCKlptNzqpmpRIA3J6AdCDKXQOMqAymXN
+            FXAxbjEQNcXhfU12Y/cVpa1hS7ap5OJCnWOPkFEA8y1ESVnPpryuTIfVlFUhW3/Z
+            Dhpb9OXKdi2IVYdbaY8+3UfSsXxTVOge7jCMbJq3aa7ZvGt5fTjXG4zc9A6RqSGh
+            ASOPSkRRSZB0d97NhUQJGgfcaWFvsfkaTAUVB2Ip/+Udnt/tGIE99RGJizxSVO9N
+            2aVJIukqng8aNPfth8mgWYJpCETMb4piLmVg2ptDqelCqXlUAskxWzMWtAhyzOgw
+            lZ2dcAn7aj9YtLaKAW9rjV8EqHEqQg0ychRNMeyRiN/CnNJp6Q2wl1/EyQUpzb0a
+            1I/ifFAW8FbWTVIbZv6njkl1XNaoav54qEn1qSABcljM0h1Ulb9WKMJiXH4368jf
+            Yhl38JDAn5NZBEzxpuaih1XK5yVri0/1ascpuMvfOxLKniUR9tla8+WEL97+aejS
+            XgGsrH+/uzRVSAT+44rExi43MWCAwNRUaVrX8UiGjA/z8qPVdwBVih4CMKgfQ8VW
+            1KewStOY217BXuVrDbvHEAkuOotEP0Jnan0epoWs47DSasNgzAcWrBgom0l/avI=
+            =Gdou
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    version: 3.10.2

kubernetes/system/cert-manager-issuer/ovh-secret-reader-rbac.yaml

@@ -0,0 +1,41 @@
+# RBAC granting the cert-manager-webhook-ovh service account read access to the
+# OVH credentials secret.
+#
+# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
+# when using its built-in `issuers[]` mechanism. Since we manage the
+# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
+#
+# The webhook runs in the cert-manager namespace under the
+# `cert-manager-webhook-ovh` service account (created by the Helm release).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-secret-reader
+rules:
+    - apiGroups: [""]
+      resources: ["secrets"]
+      verbs: ["get", "watch"]
+      resourceNames:
+          - ovh-credentials
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-secret-reader
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+subjects:
+    - apiGroup: ""
+      kind: ServiceAccount
+      name: cert-manager-webhook-ovh
+      namespace: cert-manager