Update .gitignore to include .env file and enhance README.md with instructions for deploying secrets. Refactor noble.yml to improve Kubernetes health check handling and update templates for error reporting. Modify cert-manager and metallb tasks to apply secrets from .env and adjust timeout settings. Clarify Newt installation requirements in tasks. These changes aim to streamline deployment processes and improve documentation clarity.

ansible/roles/noble_cert_manager/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# Warn when **cloudflare-dns-api-token** is missing after apply (also set in **group_vars/all.yml** when loaded).
+noble_cert_manager_require_cloudflare_secret: true

ansible/roles/noble_cert_manager/tasks/from_env.yml

@@ -0,0 +1,28 @@
+---
+# See repository **.env.sample** — copy to **.env** (gitignored).
+- name: Stat repository .env for deploy secrets
+  ansible.builtin.stat:
+    path: "{{ noble_repo_root }}/.env"
+  register: noble_deploy_env_file
+  changed_when: false
+
+- name: Create cert-manager Cloudflare DNS secret from .env
+  ansible.builtin.shell: |
+    set -euo pipefail
+    set -a
+    . "{{ noble_repo_root }}/.env"
+    set +a
+    if [ -z "${CLOUDFLARE_DNS_API_TOKEN:-}" ]; then
+      echo NO_TOKEN
+      exit 0
+    fi
+    kubectl -n cert-manager create secret generic cloudflare-dns-api-token \
+      --from-literal=api-token="${CLOUDFLARE_DNS_API_TOKEN}" \
+      --dry-run=client -o yaml | kubectl apply -f -
+    echo APPLIED
+  environment:
+    KUBECONFIG: "{{ noble_kubeconfig }}"
+  when: noble_deploy_env_file.stat.exists | default(false)
+  no_log: true
+  register: noble_cf_secret_from_env
+  changed_when: "'APPLIED' in (noble_cf_secret_from_env.stdout | default(''))"

ansible/roles/noble_cert_manager/tasks/main.yml

@@ -29,6 +29,9 @@
     KUBECONFIG: "{{ noble_kubeconfig }}"
   changed_when: true
 
+- name: Apply secrets from repository .env (optional)
+  ansible.builtin.include_tasks: from_env.yml
+
 - name: Check Cloudflare DNS API token Secret (required for ClusterIssuers)
   ansible.builtin.command:
     argv:
@@ -50,7 +53,7 @@
       Secret cert-manager/cloudflare-dns-api-token not found.
       Create it per clusters/noble/apps/cert-manager/README.md before ClusterIssuers can succeed.
   when:
-    - noble_cert_manager_require_cloudflare_secret | bool
+    - noble_cert_manager_require_cloudflare_secret | default(true) | bool
     - noble_cf_secret.rc != 0
 
 - name: Apply ClusterIssuers (staging + prod)