[rhanka]

deces.matchid.io currently serves a certificate that expired on 2026-09-07. cert-manager has been retrying since 2026-08-08, but matchid-prod uses all 10 allowed Secrets and issuance needs a temporary private-key Secret.

The infrastructure quota fix is merged in rhanka/k8s-ops#61 (ad7fc7de0fb4a75fbb2111b1f0056bb3a889adc5). This PR adds the explicit CI/CD promotion path requested for the incident: a manual workflow, restricted to main and the protected production environment, loads its dedicated platform kubeconfig, fails closed unless it can patch ResourceQuota, and verifies that Kubernetes, the expected Traefik load balancer and public DNS all identify the same production cluster. It applies only the merged Secret ceiling of 16, waits for certificate revision 2 with the correct hostname and at least seven days of remaining validity, and then performs a strict public HTTPS readiness check.

It also hardens future production releases: the certificate gate now validates the actual PEM stored in matchid-prod-tls. cert-manager left Ready=True stale after expiry, so the previous condition-only wait could report success for an expired certificate.

Validation:

• YAML parse for both workflows
• bash -n on all 30 shell blocks in both workflows
• git diff --check
• Kubernetes reviewer: GO after the production-environment, cluster-identity and PEM-hostname guards

No Kubernetes Secret value is printed or changed by this workflow. The former repo-wide platform kubeconfig secret has been replaced with KUBE_CONFIG_DATA_PLATFORM in the protected production environment. No workload, PVC, or application data is modified.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1d455285-e2eb-4719-962b-e0accaf99eba

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}