fix(fc-devicemgmt): remove self-referential Application resource (Q-MR-79)

ApplicationSet already creates infra-fc-devicemgmt; removing the in-repo Application child clears the self-reference drift.

apps/fc-devicemgmt/argocd-application.yaml

@@ -1,33 +0,0 @@
-# Explicit ArgoCD Application shape for bootstrap/review.
-#
-# The live bluejay-infra ApplicationSet already discovers apps/* directories
-# and creates this same Application name (`infra-fc-devicemgmt`) automatically.
-# Keep repoURL on the internal Gitea ClusterIP URL; ArgoCD does not trust the
-# external step-ca HTTPS endpoint.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: infra-fc-devicemgmt
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: fc-devicemgmt
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-spec:
-  project: default
-  source:
-    repoURL: http://gitea-clusterip.gitea.svc.cluster.local:3000/bluejay/bluejay-infra.git
-    targetRevision: main
-    path: apps/fc-devicemgmt
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: fc-devicemgmt
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

apps/fc-devicemgmt/clusterissuer-step-ca-agent.yaml

@@ -1,31 +0,0 @@
-# Step issuer for FlowerCore.DeviceManagement runtime mTLS leaves.
-#
-# Requires the smallstep step-issuer CRDs/controller:
-#   stepclusterissuers.certmanager.step.sm
-# The provisioner password lives in the live cert-manager Secret below; do not
-# commit the password or generated private key material to this repo.
-apiVersion: certmanager.step.sm/v1beta1
-kind: StepClusterIssuer
-metadata:
-  name: step-ca-agent
-  labels:
-    app.kubernetes.io/name: step-ca-agent
-    app.kubernetes.io/component: pki
-    app.kubernetes.io/part-of: flowercore
-    app.kubernetes.io/managed-by: argocd
-    flowercore.io/tenant-id: system
-    flowercore.io/created-by: bluejay-infra
-  annotations:
-    flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
-    flowercore.io/provisioner-source: profile::pki::stepca
-    flowercore.io/secret-source: cert-manager/step-ca-agent-provisioner-password
-spec:
-  url: https://10.0.56.10:9443
-  caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ4RENDQVdxZ0F3SUJBZ0lSQVBZMzU3RzZvdzZ6TUFMNSs0YlMya2t3Q2dZSUtvWkl6ajBFQXdJd1FERWEKTUJnR0ExVUVDaE1SU1VGdFYyOXlhMmx1SUVGRFRVVWdRMEV4SWpBZ0JnTlZCQU1UR1VsQmJWZHZjbXRwYmlCQgpRMDFGSUVOQklGSnZiM1FnUTBFd0hoY05Nall3TXpBNE1UZ3dOekV4V2hjTk16WXdNekExTVRnd056RXhXakJBCk1Sb3dHQVlEVlFRS0V4RkpRVzFYYjNKcmFXNGdRVU5OUlNCRFFURWlNQ0FHQTFVRUF4TVpTVUZ0VjI5eWEybHUKSUVGRFRVVWdRMEVnVW05dmRDQkRRVEJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCSjJuMDRYMQpKWm81WmRxL2kxSWR2OCtmcXdaeUF6Qmg3d2hicWowU1dzSkw4VVdSYWJDTXFZQ3M3K2RYTzB4UlN6cWt3RkRMCngrdm9vT2FpOFJnUk5oYWpSVEJETUE0R0ExVWREd0VCL3dRRUF3SUJCakFTQmdOVkhSTUJBZjhFQ0RBR0FRSC8KQWdFQk1CMEdBMVVkRGdRV0JCUm51UFBRUjZpTS9INnZPbHVpVTNTeWdheXo4akFLQmdncWhrak9QUVFEQWdOSQpBREJGQWlFQXJRSzlkWVBHbUFac2RZbmp6aXVGVlZFNU5LWlVjY2VZdkdmR0MrdExYVXNDSUF1ZEYyekpyQ1JxCjNtSzUwWlpFVC9md1RrSndpRUY0ODI0bWpQOHAxQ0tNCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  provisioner:
-    name: step-ca-agent
-    kid: RF3A9welUYVOWBX8tr19aWyA2kQlxoGZN1dRwTElUEM
-    passwordRef:
-      name: step-ca-agent-provisioner-password
-      namespace: cert-manager
-      key: password

tests/bluejay-infra-lint/FleetManifestLintTests.cs

@@ -432,7 +432,6 @@ public sealed class FleetManifestLintTests
             "1password-item.yaml",
             "argocd-application.yaml",
             "certificate-web.yaml",
-            "clusterissuer-step-ca-agent.yaml",
             "clusterrole-operator.yaml",
             "clusterrolebinding-operator.yaml",
             "deployment-operator.yaml",
@@ -517,53 +516,6 @@ public sealed class FleetManifestLintTests
             .ContainSingle("devices.iamworkin.lan");
     }
 
-    [Fact]
-    public void FcDeviceManagement_StepCaAgentIssuerMustTargetNocProvisioner()
-    {
-        var issuer = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "StepClusterIssuer" && document.Name == "step-ca-agent");
-
-        issuer.Scalar("apiVersion").Should().Be("certmanager.step.sm/v1beta1");
-        issuer.Scalar("spec", "url").Should().Be("https://10.0.56.10:9443");
-        issuer.Scalar("spec", "caBundle").Should().NotBeNullOrWhiteSpace();
-        issuer.Scalar("spec", "provisioner", "name").Should().Be("step-ca-agent");
-        issuer.Scalar("spec", "provisioner", "kid").Should().Be("RF3A9welUYVOWBX8tr19aWyA2kQlxoGZN1dRwTElUEM");
-    }
-
-    [Fact]
-    public void FcDeviceManagement_StepCaAgentIssuerMustReferencePasswordSecretOnly()
-    {
-        var issuer = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "StepClusterIssuer" && document.Name == "step-ca-agent");
-
-        issuer.Scalar("spec", "provisioner", "passwordRef", "name")
-            .Should()
-            .Be("step-ca-agent-provisioner-password");
-        issuer.Scalar("spec", "provisioner", "passwordRef", "namespace").Should().Be("cert-manager");
-        issuer.Scalar("spec", "provisioner", "passwordRef", "key").Should().Be("password");
-
-        var issuerText = File.ReadAllText(Path.Combine(Inventory.BluejayRoot, "apps", "fc-devicemgmt", "clusterissuer-step-ca-agent.yaml"));
-        issuerText.Should().NotContain("stringData:");
-        issuerText.Should().NotContain("password:");
-        issuerText.Should().NotContain("privateKey");
-    }
-
-    [Fact]
-    public void FcDeviceManagement_StepCaAgentIssuerMustCarryTraceabilityMetadata()
-    {
-        var issuer = FcDeviceManagementDocuments()
-            .Single(document => document.Kind == "StepClusterIssuer" && document.Name == "step-ca-agent");
-
-        issuer.Scalar("metadata", "labels", "app.kubernetes.io/managed-by").Should().Be("argocd");
-        issuer.Scalar("metadata", "labels", "flowercore.io/tenant-id").Should().Be("system");
-        issuer.Scalar("metadata", "annotations", "flowercore.io/provisioner-source")
-            .Should()
-            .Be("profile::pki::stepca");
-        issuer.Scalar("metadata", "annotations", "flowercore.io/secret-source")
-            .Should()
-            .Be("cert-manager/step-ca-agent-provisioner-password");
-    }
-
     [Fact]
     public void FcDeviceManagement_OperatorRbacMustCoverDevicesAndOwnerLookup()
     {