# cert-manager issues this into the `n8n-tls` Secret, from the same
# ClusterIssuer as the rest of the estate.
#
# Deliberately not a copy of a certificate committed to git: the private key
# stays in the cluster, is rotated by cert-manager, and never reaches a repo.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: n8n-tls
  namespace: n8n
spec:
  secretName: n8n-tls
  dnsNames:
    - n8n.sttlab.local
  issuerRef:
    name: sttlab-local-ca
    kind: ClusterIssuer