apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager
  labels:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager
  namespace: cert-manager
  labels:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager
  labels:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  - events
  verbs:
  - create
  - update
  - patch
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
  - update
  - patch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
  - patch
- apiGroups:
  - cert-manager.io
  resources:
  - certificates
  - certificaterequests
  - issuers
  - clusterissuers
  verbs:
  - create
  - update
  - patch
  - delete
  - get
  - list
  - watch
- apiGroups:
  - cert-manager.io
  resources:
  - certificates/status
  - certificaterequests/status
  - issuers/status
  - clusterissuers/status
  verbs:
  - update
  - patch
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges
  - orders
  verbs:
  - create
  - update
  - patch
  - delete
  - get
  - list
  - watch
- apiGroups:
  - acme.cert-manager.io
  resources:
  - challenges/status
  - orders/status
  verbs:
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager
  labels:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cert-manager
  namespace: cert-manager
  labels:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: cert-manager
      app.kubernetes.io/component: certificates
  template:
    metadata:
      labels:
        app.kubernetes.io/name: cert-manager
        app.kubernetes.io/component: certificates
    spec:
      serviceAccountName: cert-manager
      containers:
      - name: cert-manager
        image: quay.io/jetstack/cert-manager-controller:v1.12.0
        ports:
        - containerPort: 9402
          name: metrics
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: SERVICE_ACCOUNT_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.serviceAccountName
        args:
        - --v=2
        - --cluster-resource-namespace=$(POD_NAMESPACE)
        - --leader-election-namespace=$(POD_NAMESPACE)
        - --default-issuer-name=telecom-platform-ca
        - --default-issuer-kind=ClusterIssuer
        resources:
          requests:
            cpu: 10m
            memory: 32Mi
          limits:
            cpu: 100m
            memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  name: cert-manager
  namespace: cert-manager
  labels:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
spec:
  ports:
  - port: 9402
    name: metrics
    targetPort: 9402
  selector:
    app.kubernetes.io/name: cert-manager
    app.kubernetes.io/component: certificates
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: telecom-platform-ca
  labels:
    app.kubernetes.io/name: telecom-platform-ca
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
spec:
  ca:
    secretName: telecom-platform-ca-secret
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  labels:
    app.kubernetes.io/name: letsencrypt-staging
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: admin@telecom-platform.com
    privateKeySecretRef:
      name: letsencrypt-staging-account-key
    solvers:
    - http01:
        ingress:
          class: istio
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  labels:
    app.kubernetes.io/name: letsencrypt-prod
    app.kubernetes.io/component: certificates
    app.kubernetes.io/part-of: telecom-platform
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@telecom-platform.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
    - http01:
        ingress:
          class: istio