feat(cert-manager): add ConfigMap for runtime values and update HelmRelease to use it

flux/infrastructure/infra-devops/helmrelease-cert-manager.yaml

@@ -6,6 +6,11 @@ metadata:
 spec:
   interval: 30m
   timeout: 15m
+  valuesFrom:
+    - kind: ConfigMap
+      name: cert-manager-runtime-values
+      valuesKey: values.yaml
+      optional: true
   chart:
     spec:
       chart: cert-manager
@@ -19,8 +24,8 @@ spec:
     crds: CreateReplace
   upgrade:
     crds: CreateReplace
-  # 首次install时servicemonitor=false(CRD尚不存在)
-  # infra-monitor层部署后通过SSA patch开启
+  # 首次 install 时 ServiceMonitor CRD 尚不存在，保持 chart 默认值 false。
+  # infra-devops-post 在 CRD 就绪后通过可选 valuesFrom 开启 ServiceMonitor。
   values:
     crds:
       enabled: true
@@ -28,5 +33,3 @@ spec:
     enableCertificateOwnerRef: true
     prometheus:
       enabled: true
-      servicemonitor:
-        enabled: false

flux/infrastructure/infra-devops/post/configmap-cert-manager-runtime-values.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cert-manager-runtime-values
+  namespace: infra-devops
+  labels:
+    reconcile.fluxcd.io/watch: Enabled
+data:
+  values.yaml: |
+    prometheus:
+      servicemonitor:
+        enabled: true
+        interval: 300s
+        prometheusInstance: kube-prometheus

flux/infrastructure/infra-devops/post/helmrelease-cert-manager-patch.yaml

@@ -1,24 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: infra-devops
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: cert-manager
-      version: v1.19.3
-      sourceRef:
-        kind: HelmRepository
-        name: jetstack
-        namespace: infra-gitops
-      interval: 12h
-  values:
-    prometheus:
-      servicemonitor:
-        enabled: true
-        interval: 300s
-        prometheusInstance: kube-prometheus

flux/infrastructure/infra-devops/post/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - clusterissuer-dnspod.yaml
-  - helmrelease-cert-manager-patch.yaml
+  - configmap-cert-manager-runtime-values.yaml