vendor cert-manager v1.16.1 CRDs (resource-policy:keep stripped); subchart crds.enabled=false

values.yaml

@@ -43,8 +43,8 @@ certManager:
 # disconnect flows where the customer might re-add the cluster later.
 cert-manager:
   crds:
-    enabled: true
-    keep: false
+    enabled: false
+    keep: false # ignored when enabled=false
 
 # traefik — upstream chart. LoadBalancer Service so the customer's
 # k3s servicelb maps :80/:443 to the host. Tower currently doesn't
@@ -93,7 +93,7 @@ registry:
   # missing images from Gitea source on demand. So we don't need a
   # large or replicated PV here.
   persistence:
-    enabled: true
+    enabled: false
     size: 10Gi
     storageClass: ""  # "" = use the cluster's default; on k3s that's local-path
   resources: