Staged verification found cert-manager was using an unrelated 4-zone token named 'Caddy' (renner.uno + 3 personal zones, shared with something outside this repo), not the dedicated 'Kubernetes Cert-Manager' token that already existed (renner.uno only). Switched cert-manager to the dedicated token and pinned the rotation token-id to it, so Caddy is never rolled. Net: cert-manager drops write access to 3 personal zones.
Verified end-to-end: job rolls token af708481, OpenBao rotates, rolled token stays active/same scope, ESO syncs, cert-manager writes the DNS-01 TXT record (publicly resolvable), 27/27 prod certs Ready. suspend: false.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
claude-botandClaude Opus 4.8