Pin the kubelet serving certificate approver instead of installing from upstream main #264

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

Found by the raw-manifest sweep on #205, against main at 679fe8b (2026-10-24):

• k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/kustomization.yaml pulls deploy/standalone-install.yaml from the upstream project's main branch by URL. What a new platform installs therefore changes whenever upstream pushes, with no review here, and two renders of the same template commit can differ.
• The reference platform vendors the upstream release's HA manifest and pins the image by tag and digest, guarded in CI (k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/ in devantler-tech/platform).
• Upstream publishes no maintained Helm chart, so a HelmRelease is not the fix; a pinned release is.

Audience and problem

Anyone creating a platform from this template: a component that approves kubelet serving certificates is installed from a moving branch.

Smallest useful change

Follow the platform: vendor a tagged upstream release's manifest (HA variant if the platform's reasons apply) and pin the image by digest.

Acceptance criteria

• The render no longer fetches from a branch; the manifest and image are pinned to one reviewed release.
• The Hetzner render and ksail workload validate stay green.

Size

S.