- Shipped
- September 23, 2026 at 2:22 PM UTC
- Author
- Kamo
- Commit
- f8aed82
Listing computers.kamocrm.com for issuance is only half of it. Traefik requires a TLS secret in the IngressRoute's OWN namespace, so the cert is issued in `kamo` and mirrored into `hosted-computers` — and auto-cert-service could not write a Secret here. It holds a namespaced Role per mirror target, deliberately, and there was no Role for this namespace: `kubectl auth can-i create secrets -n hosted-computers` as that ServiceAccount answered no. The failure this avoids is a late and quiet one. The certificate would issue correctly in `kamo`, the mirror step would 403 past a log line nobody is reading, and hc-https would go on referencing tls-computers-kamocrm-com in a namespace that does not have it — so opening a Hosted Computer still gives you a browser tab that closes, with a perfectly valid certificate sitting one namespace away. That is a worse hour than no certificate at all. Applied to the cluster and added to the deploy step, so a rebuilt cluster does not have to rediscover it.