crds:
  enabled: true
# Check DNS-01 records against public resolvers, not the cluster's CoreDNS rewrites.
dns01RecursiveNameservers: "1.1.1.1:53,9.9.9.9:53"
dns01RecursiveNameserversOnly: true
global:
  # Holds the Cloudflare token; keep every cert-manager component off the node where CI runs.
  nodeSelector:
    node-role.kubernetes.io/control-plane: "true"