From 0c42e20fc9c7fc8e6bb2071f5e1e6fcaa5e95a84 Mon Sep 17 00:00:00 2001
From: steled <34886888+steled@users.noreply.github.com>
Date: Fri, 6 Nov 2026 12:29:03 +0100
Subject: [PATCH] Remove cloudflare api token secret from
 cert-manager_cloudflare module

The secret is managed by ArgoCD via a SealedSecret. Managing it in
Terraform as well caused a permanent diff on the argocd tracking-id
annotation set by the sealed-secrets controller.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: steled <34886888+steled@users.noreply.github.com>
---
 cert-manager_cloudflare/README.md                 |  2 --
 cert-manager_cloudflare/cert-manager.tf           |  2 --
 .../clusterissuer_letsencrypt.tf                  |  4 ----
 cert-manager_cloudflare/secret.tf                 | 15 ---------------
 cert-manager_cloudflare/variables.tf              |  4 ----
 5 files changed, 27 deletions(-)
 delete mode 100644 cert-manager_cloudflare/secret.tf

diff --git a/cert-manager_cloudflare/README.md b/cert-manager_cloudflare/README.md
index e76701a..9862278 100644
--- a/cert-manager_cloudflare/README.md
+++ b/cert-manager_cloudflare/README.md
@@ -29,7 +29,6 @@ No modules.
 | [kubernetes_manifest.cert_manager_cluster_issuer_selfsigned_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 | [kubernetes_manifest.cert_manager_cluster_issuer_steled_ca_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 | [kubernetes_namespace_v1.certmanager](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1) | resource |
-| [kubernetes_secret_v1.cloudflare_api_token_secret](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
 
 ## Inputs
 
@@ -38,7 +37,6 @@ No modules.
 | <a name="input_cert_manager_email"></a> [cert\_manager\_email](#input\_cert\_manager\_email) | n/a | `string` | n/a | yes |
 | <a name="input_cert_manager_values_yaml"></a> [cert\_manager\_values\_yaml](#input\_cert\_manager\_values\_yaml) | Path to the cert-manager values.yml file, relative to the root module | `string` | n/a | yes |
 | <a name="input_cert_manager_version"></a> [cert\_manager\_version](#input\_cert\_manager\_version) | Set the version of cert-manager | `string` | n/a | yes |
-| <a name="input_cloudflare_api_token"></a> [cloudflare\_api\_token](#input\_cloudflare\_api\_token) | n/a | `string` | n/a | yes |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Name of the kubernetes namespace | `string` | n/a | yes |
 | <a name="input_namespace_annotations"></a> [namespace\_annotations](#input\_namespace\_annotations) | Additional annotations for the namespace | `map(string)` | `{}` | no |
 | <a name="input_namespace_labels"></a> [namespace\_labels](#input\_namespace\_labels) | Additional labels for the namespace | `map(string)` | `{}` | no |
diff --git a/cert-manager_cloudflare/cert-manager.tf b/cert-manager_cloudflare/cert-manager.tf
index 0755a4f..82644d4 100644
--- a/cert-manager_cloudflare/cert-manager.tf
+++ b/cert-manager_cloudflare/cert-manager.tf
@@ -22,6 +22,4 @@ resource "helm_release" "certmanager" {
     when    = destroy
     command = "kubectl delete crd certificaterequests.cert-manager.io certificates.cert-manager.io challenges.acme.cert-manager.io clusterissuers.cert-manager.io issuers.cert-manager.io orders.acme.cert-manager.io"
   }
-
-  depends_on = [kubernetes_secret_v1.cloudflare_api_token_secret]
 }
diff --git a/cert-manager_cloudflare/clusterissuer_letsencrypt.tf b/cert-manager_cloudflare/clusterissuer_letsencrypt.tf
index ba41188..701a92b 100644
--- a/cert-manager_cloudflare/clusterissuer_letsencrypt.tf
+++ b/cert-manager_cloudflare/clusterissuer_letsencrypt.tf
@@ -19,7 +19,6 @@
 # YAML
 
 #   depends_on = [
-#     kubernetes_secret_v1.cloudflare_api_token_secret,
 #     helm_release.certmanager
 #   ]
 # }
@@ -55,7 +54,6 @@ resource "kubernetes_manifest" "cert_manager_cluster_issuer_letsencrypt_staging"
   }
 
   depends_on = [
-    kubernetes_secret_v1.cloudflare_api_token_secret,
     helm_release.certmanager
   ]
 }
@@ -81,7 +79,6 @@ resource "kubernetes_manifest" "cert_manager_cluster_issuer_letsencrypt_staging"
 # YAML
 
 #   depends_on = [
-#     kubernetes_secret_v1.cloudflare_api_token_secret,
 #     helm_release.certmanager
 #   ]
 # }
@@ -117,7 +114,6 @@ resource "kubernetes_manifest" "cert_manager_cluster_issuer_letsencrypt_producti
   }
 
   depends_on = [
-    kubernetes_secret_v1.cloudflare_api_token_secret,
     helm_release.certmanager
   ]
 }
diff --git a/cert-manager_cloudflare/secret.tf b/cert-manager_cloudflare/secret.tf
deleted file mode 100644
index d406b8e..0000000
--- a/cert-manager_cloudflare/secret.tf
+++ /dev/null
@@ -1,15 +0,0 @@
-resource "kubernetes_secret_v1" "cloudflare_api_token_secret" {
-  metadata {
-    name      = "cloudflare-api-token"
-    namespace = kubernetes_namespace_v1.certmanager.metadata[0].name
-    annotations = {
-      "argocd.argoproj.io/tracking-id" = "helm-cert-manager:/Secret:cert-manager/cloudflare-api-token"
-    }
-  }
-
-  data = {
-    api-token = var.cloudflare_api_token
-  }
-
-  type = "Opaque"
-}
diff --git a/cert-manager_cloudflare/variables.tf b/cert-manager_cloudflare/variables.tf
index 869fac2..c276a9e 100644
--- a/cert-manager_cloudflare/variables.tf
+++ b/cert-manager_cloudflare/variables.tf
@@ -8,10 +8,6 @@ variable "cert_manager_values_yaml" {
   description = "Path to the cert-manager values.yml file, relative to the root module"
 }
 
-variable "cloudflare_api_token" {
-  type = string
-}
-
 variable "cert_manager_email" {
   type = string
 }