GKE: values for gitea, argocd and cert-manager on gke-toolshed-prd-usc1

A new cluster directory rather than edits to k8s-admin-prd-ase1, so no
homelab value is ever reused for GCP by accident. Charts are the ones
already vendored here (gitea 12.7.0, argo-cd 7.7.23, cert-manager
v1.20.1); only the values are new. Verified with helm template.

What differs from the homelab, and why:

- gitea: storageClass standard-rwo, and Recreate for a different reason
  than the homelab's LevelDB lock — three nodes and a ReadWriteOnce disk
  mean a rolling update's new pod waits forever on Multi-Attach. The
  admin password comes from a Secret created at bootstrap instead of the
  chart's published default, which would otherwise be live on a public
  IP. Registration is disabled and webhooks are limited to private
  ranges, for the same reason.
- argocd: single ingress host (no Tailscale), and the homelab's Ingress
  health override is dropped, since Contour writes real load balancer
  status here. server and repoServer autoscale 1-3 on CPU; the chart
  omits replicas when autoscaling is on, so the HPA and ArgoCD's own
  self-management do not fight over the count. Memory is deliberately
  not a scaling metric: Go does not return memory promptly, so a memory
  target scales up and never back down.
- cert-manager: written fresh, not copied. The homelab file was never
  adapted from the fleet — it pulls from a private Meesho registry and
  pins pods to a node pool that does not exist here. The chart's own
  values.yaml carries that registry too, so imageRegistry and
  imageNamespace are overridden back to upstream's quay.io/jetstack.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

helm-overrides/gke-toolshed-prd-usc1/cert-manager/custom-values.yaml

@@ -0,0 +1,66 @@
+# GKE values for the vendored cert-manager chart (helm-templates/cert-manager,
+# v1.20.1). Written fresh rather than copied from k8s-admin-prd-ase1, whose
+# file was never adapted from the fleet: it pulls images from a private
+# Meesho Artifact Registry and pins pods to a "dedicated: devops" node pool
+# that does not exist here.
+#
+# Installed once by hand with `helm install cert-manager` (namespace
+# "cert-manager"), then adopted by the cert-manager Application in
+# devops-infra-argo-config-gcp.
+#
+# Its job here is Harbor's certificate, issued from the private registry CA
+# that toolshed-gke-infra's 10-infra creates and the node pool trusts. The
+# CA key pair reaches the cluster as the "registry-ca" Secret in this
+# namespace (kubectl, from terraform output); the ClusterIssuer that uses it
+# lives with Harbor's config, not here.
+# The vendored chart's own values.yaml was edited in the fleet to pull every
+# image from Meesho's private Artifact Registry, which these nodes cannot
+# reach. Back to upstream's registry (quay.io/jetstack/cert-manager-*).
+imageRegistry: quay.io
+imageNamespace: jetstack
+
+crds:
+  enabled: true
+  # A helm uninstall must not take every Certificate in the cluster with it.
+  keep: true
+
+replicaCount: 1
+resources:
+  requests:
+    cpu: 50m
+    memory: 96Mi
+  limits:
+    memory: 256Mi
+
+webhook:
+  replicaCount: 1
+  resources:
+    requests:
+      cpu: 20m
+      memory: 48Mi
+    limits:
+      memory: 128Mi
+
+cainjector:
+  enabled: true
+  replicaCount: 1
+  resources:
+    requests:
+      cpu: 20m
+      memory: 96Mi
+    limits:
+      memory: 256Mi
+
+startupapicheck:
+  enabled: true
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi
+    limits:
+      memory: 64Mi
+
+prometheus:
+  enabled: true
+  servicemonitor:
+    enabled: false