From eb4aa701d64467de43e3e3d007721b750043aa4d Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Fri, 16 Jan 2026 18:17:40 -0300
Subject: [PATCH] cert-manager: pin webhook and cainjector to rpi nodes

---
 infrastructure/cert-manager/helmrelease.yaml | 26 ++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/infrastructure/cert-manager/helmrelease.yaml b/infrastructure/cert-manager/helmrelease.yaml
index 7fdf2774..0a0ed220 100644
--- a/infrastructure/cert-manager/helmrelease.yaml
+++ b/infrastructure/cert-manager/helmrelease.yaml
@@ -39,3 +39,29 @@ spec:
                   values:
                     - rpi5
                     - rpi4
+    webhook:
+      nodeSelector:
+        node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values:
+                      - rpi5
+                      - rpi4
+    cainjector:
+      nodeSelector:
+        node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values:
+                      - rpi5
+                      - rpi4