Setup self-signed issuer for ESO

charts/external-secrets/templates/selfsigned-issuer.yaml

@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned
+  namespace: external-secrets
+spec:
+  selfSigned: {}

charts/external-secrets/values.yaml

@@ -1,6 +1,7 @@
 # External Secrets Operator helm values
 # Uses EC2 instance role for AWS auth - no credentials needed
-# cert-manager handles webhook TLS instead of the built-in cert-controller
+# cert-manager handles webhook TLS with a self-signed issuer (internal cluster DNS,
+# not publicly routable - Let's Encrypt cannot issue for these names)
 installCRDs: true
 
 certController:
@@ -11,5 +12,5 @@ webhook:
     enabled: true
     cert:
       issuerRef:
-        name: letsencrypt-prod
-        kind: ClusterIssuer
+        name: selfsigned
+        kind: Issuer