From c152466001dd9ebb266b4ebaf2aff3c451712e98 Mon Sep 17 00:00:00 2001 From: Lee Chapman Date: Sun, 4 Oct 2026 16:52:23 -0700 Subject: [PATCH] chore(k8s): remove unused cert-manager ReferenceGrant allow-cert-manager-secrets let high-command Gateways reference cert-manager/wildcard-dataknife-ai-tls, a retired *.dataknife.ai wildcard (expired 2026-04-17). The Gateway uses its own cert-manager Certificate (high-command-gateway-https-dataknife-ai), so the grant is unused. Co-authored-by: Cursor --- k8s/README.md | 2 +- k8s/referencegrant.yaml | 14 -------------- 2 files changed, 1 insertion(+), 15 deletions(-) delete mode 100644 k8s/referencegrant.yaml diff --git a/k8s/README.md b/k8s/README.md index 7b02a48..aab8b27 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -20,7 +20,7 @@ Traffic flow: **Cloudflare Tunnel** → **Envoy Gateway** → **HTTPRoute** → - `gateway.yaml`, `gatewayclass.yaml`, `gateway-certificate.yaml` - Envoy Gateway - `gateway-tunnel-service.yaml` - Alias for Cloudflare Tunnel → Gateway - `cloudflared-tunnel-deployment.yaml` - Cloudflare Tunnel pod -- `mcp-service.yaml`, `mcp-referencegrant.yaml`, `referencegrant.yaml` - MCP routing +- `mcp-service.yaml`, `mcp-referencegrant.yaml` - MCP routing See `CLOUDFLARE_TUNNEL.md` for tunnel setup. diff --git a/k8s/referencegrant.yaml b/k8s/referencegrant.yaml deleted file mode 100644 index fc19137..0000000 --- a/k8s/referencegrant.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1beta1 -kind: ReferenceGrant -metadata: - name: allow-cert-manager-secrets - namespace: cert-manager -spec: - from: - - group: gateway.networking.k8s.io - kind: Gateway - namespace: high-command - to: - - group: "" - kind: Secret - name: wildcard-dataknife-ai-tls