Remove CA issuer reference CRs per review feedback

ACME remains the reference recommendation. CA issuer (and other issuer
types) are noted as allowable alternatives, but no reference CRs are
shipped for non-ACME issuers. Users may configure their own.

Hub-spoke trust (KlusterletConfig, CA ConfigMap), root CA expiration
monitoring, and kubeconfig trust documentation are retained — these
are issuer-agnostic.

Author: sebrandon1

telco-core/configuration/reference-crs-kube-compare/compare_ignore

@@ -39,5 +39,3 @@ custom-manifests/subscription-validator.yaml
 # This is an object-template-raw used only to validate pre-caching state
 custom-manifests/precache-validator.yaml
 
-# cert-manager config CRs (user-specific)
-optional/cert-manager/certManagerClusterIssuerCA.yaml

telco-core/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerClusterIssuerCA.yaml

@@ -18,10 +18,7 @@ Cert-manager automates the management and issuance of TLS certificates from vari
 
 ### Certificate Issuers
 
-Two ClusterIssuer types are available. Choose one based on your environment:
-
-- `certManagerClusterIssuer.yaml` - **ACME issuer** using Let's Encrypt with DNS-01 challenge (requires internet connectivity)
-- `certManagerClusterIssuerCA.yaml` - **CA issuer** using an internal certificate authority (disconnected environments with existing PKI)
+- `certManagerClusterIssuer.yaml` - **ACME issuer** using Let's Encrypt with DNS-01 challenge (reference recommendation)
 
 ### Certificate Resources
 - `apiServerCertificate.yaml` - Creates a certificate for the API Server endpoint
@@ -35,18 +32,13 @@ Two ClusterIssuer types are available. Choose one based on your environment:
 
 Before applying these configurations, you must customize the following:
 
-1. **ClusterIssuer** — choose one of the following issuer configurations:
-
-   **Option A: ACME issuer** (`certManagerClusterIssuer.yaml`) — for connected environments:
+1. **ClusterIssuer** (`certManagerClusterIssuer.yaml`):
    - Update `email` with your contact email
    - Configure the appropriate DNS provider for DNS-01 challenge (example shows Route53)
    - Reference pre-created Secrets for DNS provider credentials via `secretRef` — do not commit credentials in manifests
 
-   **Option B: Existing internal CA** (disconnected environments with existing PKI):
-   - This issuer does **not** generate its own CA — it requires a pre-existing CA from your organization's PKI
-   - Create a Secret named `root-ca-secret` in the `cert-manager` namespace containing your CA's `tls.crt` and `tls.key`
-   - Deploy only `certManagerClusterIssuerCA.yaml`
-   - Update the Certificate resources to reference `ca-issuer` in the `issuerRef` field
+   > **Note:** Other issuer types (e.g., CA issuer for disconnected environments with existing PKI) are allowable.
+   > Users may configure their own ClusterIssuer; no reference CR is provided for non-ACME issuers.
 
 2. **Certificates** (`apiServerCertificate.yaml` and `ingressCertificate.yaml`):
    - Update `commonName` and `dnsNames` to match your cluster's domain
@@ -63,7 +55,7 @@ Before applying these configurations, you must customize the following:
 3. Deploy the ClusterIssuer
 4. Deploy the Certificate resources
 5. Wait for certificates to be issued and secrets created
-6. **(Option B only)** Update kubeconfig to trust the new root CA (see "Kubeconfig Trust" section below)
+6. **(Custom CA only)** Update kubeconfig to trust the new root CA (see "Kubeconfig Trust" section below)
 7. Apply the APIServer and IngressController configurations
 
 ## Certificate Verification
@@ -76,7 +68,7 @@ After applying these configurations, verify that:
 
 ## Important: Kubeconfig Trust After API Server Cert Replacement
 
-> **Note:** For Option B (Existing internal CA), you must complete this kubeconfig update
+> **Note:** When using a custom CA issuer, you must complete this kubeconfig update
 > *before* applying the APIServer configuration (step 7 in the deployment order above).
 > Applying the APIServer configuration first will lock you out.
 

telco-core/configuration/reference-crs/optional/cert-manager/README.md

@@ -34,7 +34,6 @@ required/gitops/addPluginsPolicy.yaml
 required/acm/observabilityRoutePolicy.yaml
 
 # cert-manager config CRs (user-specific, and policies with hub-side templating)
-optional/cert-manager/certManagerClusterIssuerCA.yaml
 optional/cert-manager/certManagerRootCAExpirationPolicy.yaml
 optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml
 optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml

telco-core/configuration/reference-crs/optional/cert-manager/certManagerClusterIssuerCA.yaml

@@ -18,10 +18,7 @@ Cert-manager automates the management and issuance of TLS certificates from vari
 
 ### Certificate Issuers
 
-Two ClusterIssuer types are available. Choose one based on your environment:
-
-- `certManagerClusterIssuer.yaml` - **ACME issuer** using Let's Encrypt with DNS-01 challenge (requires internet connectivity)
-- `certManagerClusterIssuerCA.yaml` - **CA issuer** using an internal certificate authority (disconnected environments with existing PKI)
+- `certManagerClusterIssuer.yaml` - **ACME issuer** using Let's Encrypt with DNS-01 challenge (reference recommendation)
 
 ### Certificate Resources
 - `apiServerCertificate.yaml` - Creates a certificate for the API Server endpoint
@@ -35,18 +32,13 @@ Two ClusterIssuer types are available. Choose one based on your environment:
 
 Before applying these configurations, you must customize the following:
 
-1. **ClusterIssuer** — choose one of the following issuer configurations:
-
-   **Option A: ACME issuer** (`certManagerClusterIssuer.yaml`) — for connected environments:
+1. **ClusterIssuer** (`certManagerClusterIssuer.yaml`):
    - Update `email` with your contact email
    - Configure the appropriate DNS provider for DNS-01 challenge (example shows Route53)
    - Reference pre-created Secrets for DNS provider credentials via `secretRef` — do not commit credentials in manifests
 
-   **Option B: Existing internal CA** (disconnected environments with existing PKI):
-   - This issuer does **not** generate its own CA — it requires a pre-existing CA from your organization's PKI
-   - Create a Secret named `root-ca-secret` in the `cert-manager` namespace containing your CA's `tls.crt` and `tls.key`
-   - Deploy only `certManagerClusterIssuerCA.yaml`
-   - Update the Certificate resources to reference `ca-issuer` in the `issuerRef` field
+   > **Note:** Other issuer types (e.g., CA issuer for disconnected environments with existing PKI) are allowable.
+   > Users may configure their own ClusterIssuer; no reference CR is provided for non-ACME issuers.
 
 2. **Certificates** (`apiServerCertificate.yaml` and `ingressCertificate.yaml`):
    - Update `commonName` and `dnsNames` to match your cluster's domain
@@ -63,7 +55,7 @@ Before applying these configurations, you must customize the following:
 3. Deploy the ClusterIssuer
 4. Deploy the Certificate resources
 5. Wait for certificates to be issued and secrets created
-6. **(Option B only)** Update kubeconfig to trust the new root CA (see "Kubeconfig Trust" section below)
+6. **(Custom CA only)** Update kubeconfig to trust the new root CA (see "Kubeconfig Trust" section below)
 7. Apply the APIServer and IngressController configurations
 
 ## Certificate Verification
@@ -76,7 +68,7 @@ After applying these configurations, verify that:
 
 ## Important: Kubeconfig Trust After API Server Cert Replacement
 
-> **Note:** For Option B (Existing internal CA), you must complete this kubeconfig update
+> **Note:** When using a custom CA issuer, you must complete this kubeconfig update
 > *before* applying the APIServer configuration (step 7 in the deployment order above).
 > Applying the APIServer configuration first will lock you out.
 

telco-hub/configuration/reference-crs-kube-compare/compare_ignore

@@ -6,8 +6,6 @@ resources:
   - certManagerOperatorgroup.yaml
   - certManagerSubscription.yaml
   - certManagerClusterIssuer.yaml
-  # Alternative issuer for environments with existing PKI (comment out ACME issuer above):
-  # - certManagerClusterIssuerCA.yaml
   - ingressCertificate.yaml
   - ingressControllerConfig.yaml
   - apiServerCertificate.yaml

telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerClusterIssuerCA.yaml

@@ -40,7 +40,6 @@ storage-lso/StorageOperatorStatus.yaml
 cert-manager/apiServerCertificate.yaml
 cert-manager/apiServerConfig.yaml
 cert-manager/certManagerClusterIssuer.yaml
-cert-manager/certManagerClusterIssuerCA.yaml
 cert-manager/ingressCertificate.yaml
 cert-manager/ingressControllerConfig.yaml