imfreedom/k8s-cluster

Update to cert-manager 0.13

2020-01-27, Gary Kramlich
d906498797d2
Parents 11fbdc9b40c6
Children bbe071299a84
Update to cert-manager 0.13
1 files changed, 1839 insertions(+), 1673 deletions(-)
  • +1839 -1673
    10-cert-manager.yaml
    • --- a/10-cert-manager.yaml Mon Jan 27 08:34:18 2020 -0600
    +++ b/10-cert-manager.yaml Mon Jan 27 10:08:05 2020 -0600
    @@ -1,12 +1,482 @@
    -# This is the official 0.11.0 manifest
    +# This is the official 0.13.0 cert-manager.yaml manifest
    # from https://github.com/jetstack/cert-manager/releases. No changes, aside
    # from this header have been made.
    # yamllint disable
    +apiVersion: apiextensions.k8s.io/v1beta1
    +kind: CustomResourceDefinition
    +metadata:
    + name: certificaterequests.cert-manager.io
    +spec:
    + additionalPrinterColumns:
    + - JSONPath: .status.conditions[?(@.type=="Ready")].status
    + name: Ready
    + type: string
    + - JSONPath: .spec.issuerRef.name
    + name: Issuer
    + priority: 1
    + type: string
    + - JSONPath: .status.conditions[?(@.type=="Ready")].message
    + name: Status
    + priority: 1
    + type: string
    + - JSONPath: .metadata.creationTimestamp
    + description: CreationTimestamp is a timestamp representing the server time when
    + this object was created. It is not guaranteed to be set in happens-before order
    + across separate operations. Clients may not set this value. It is represented
    + in RFC3339 form and is in UTC.
    + name: Age
    + type: date
    + group: cert-manager.io
    + preserveUnknownFields: false
    + names:
    + kind: CertificateRequest
    + listKind: CertificateRequestList
    + plural: certificaterequests
    + shortNames:
    + - cr
    + - crs
    + singular: certificaterequest
    + scope: Namespaced
    + subresources:
    + status: {}
    + validation:
    + openAPIV3Schema:
    + description: CertificateRequest is a type to represent a Certificate Signing
    + Request
    + type: object
    + properties:
    + apiVersion:
    + description: 'APIVersion defines the versioned schema of this representation
    + of an object. Servers should convert recognized schemas to the latest
    + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    + type: string
    + kind:
    + description: 'Kind is a string value representing the REST resource this
    + object represents. Servers may infer this from the endpoint the client
    + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    + type: string
    + metadata:
    + type: object
    + spec:
    + description: CertificateRequestSpec defines the desired state of CertificateRequest
    + type: object
    + required:
    + - csr
    + - issuerRef
    + properties:
    + csr:
    + description: Byte slice containing the PEM encoded CertificateSigningRequest
    + type: string
    + format: byte
    + duration:
    + description: Requested certificate default Duration
    + type: string
    + isCA:
    + description: IsCA will mark the resulting certificate as valid for signing.
    + This implies that the 'cert sign' usage is set
    + type: boolean
    + issuerRef:
    + description: IssuerRef is a reference to the issuer for this CertificateRequest. If
    + the 'kind' field is not set, or set to 'Issuer', an Issuer resource
    + with the given name in the same namespace as the CertificateRequest
    + will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
    + with the provided name will be used. The 'name' field in this stanza
    + is required at all times. The group field refers to the API group
    + of the issuer which defaults to 'cert-manager.io' if empty.
    + type: object
    + required:
    + - name
    + properties:
    + group:
    + type: string
    + kind:
    + type: string
    + name:
    + type: string
    + usages:
    + description: Usages is the set of x509 actions that are enabled for
    + a given key. Defaults are ('digital signature', 'key encipherment')
    + if empty
    + type: array
    + items:
    + description: 'KeyUsage specifies valid usage contexts for keys. See:
    + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
    + Valid KeyUsage values are as follows: "signing", "digital signature",
    + "content commitment", "key encipherment", "key agreement", "data
    + encipherment", "cert sign", "crl sign", "encipher only", "decipher
    + only", "any", "server auth", "client auth", "code signing", "email
    + protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
    + user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
    + sgc"'
    + type: string
    + enum:
    + - signing
    + - digital signature
    + - content commitment
    + - key encipherment
    + - key agreement
    + - data encipherment
    + - cert sign
    + - crl sign
    + - encipher only
    + - decipher only
    + - any
    + - server auth
    + - client auth
    + - code signing
    + - email protection
    + - s/mime
    + - ipsec end system
    + - ipsec tunnel
    + - ipsec user
    + - timestamping
    + - ocsp signing
    + - microsoft sgc
    + - netscape sgc
    + status:
    + description: CertificateStatus defines the observed state of CertificateRequest
    + and resulting signed certificate.
    + type: object
    + properties:
    + ca:
    + description: Byte slice containing the PEM encoded certificate authority
    + of the signed certificate.
    + type: string
    + format: byte
    + certificate:
    + description: Byte slice containing a PEM encoded signed certificate
    + resulting from the given certificate signing request.
    + type: string
    + format: byte
    + conditions:
    + type: array
    + items:
    + description: CertificateRequestCondition contains condition information
    + for a CertificateRequest.
    + type: object
    + required:
    + - status
    + - type
    + properties:
    + lastTransitionTime:
    + description: LastTransitionTime is the timestamp corresponding
    + to the last status change of this condition.
    + type: string
    + format: date-time
    + message:
    + description: Message is a human readable description of the details
    + of the last transition, complementing reason.
    + type: string
    + reason:
    + description: Reason is a brief machine readable explanation for
    + the condition's last transition.
    + type: string
    + status:
    + description: Status of the condition, one of ('True', 'False',
    + 'Unknown').
    + type: string
    + enum:
    + - "True"
    + - "False"
    + - Unknown
    + type:
    + description: Type of the condition, currently ('Ready', 'InvalidRequest').
    + type: string
    + failureTime:
    + description: FailureTime stores the time that this CertificateRequest
    + failed. This is used to influence garbage collection and back-off.
    + type: string
    + format: date-time
    + version: v1alpha2
    + versions:
    + - name: v1alpha2
    + served: true
    + storage: true
    ---
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    - creationTimestamp: null
    + name: certificates.cert-manager.io
    +spec:
    + additionalPrinterColumns:
    + - JSONPath: .status.conditions[?(@.type=="Ready")].status
    + name: Ready
    + type: string
    + - JSONPath: .spec.secretName
    + name: Secret
    + type: string
    + - JSONPath: .spec.issuerRef.name
    + name: Issuer
    + priority: 1
    + type: string
    + - JSONPath: .status.conditions[?(@.type=="Ready")].message
    + name: Status
    + priority: 1
    + type: string
    + - JSONPath: .metadata.creationTimestamp
    + description: CreationTimestamp is a timestamp representing the server time when
    + this object was created. It is not guaranteed to be set in happens-before order
    + across separate operations. Clients may not set this value. It is represented
    + in RFC3339 form and is in UTC.
    + name: Age
    + type: date
    + group: cert-manager.io
    + preserveUnknownFields: false
    + names:
    + kind: Certificate
    + listKind: CertificateList
    + plural: certificates
    + shortNames:
    + - cert
    + - certs
    + singular: certificate
    + scope: Namespaced
    + subresources:
    + status: {}
    + validation:
    + openAPIV3Schema:
    + description: Certificate is a type to represent a Certificate from ACME
    + type: object
    + properties:
    + apiVersion:
    + description: 'APIVersion defines the versioned schema of this representation
    + of an object. Servers should convert recognized schemas to the latest
    + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    + type: string
    + kind:
    + description: 'Kind is a string value representing the REST resource this
    + object represents. Servers may infer this from the endpoint the client
    + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    + type: string
    + metadata:
    + type: object
    + spec:
    + description: CertificateSpec defines the desired state of Certificate. A
    + valid Certificate requires at least one of a CommonName, DNSName, or URISAN
    + to be valid.
    + type: object
    + required:
    + - issuerRef
    + - secretName
    + properties:
    + commonName:
    + description: CommonName is a common name to be used on the Certificate.
    + The CommonName should have a length of 64 characters or fewer to avoid
    + generating invalid CSRs.
    + type: string
    + dnsNames:
    + description: DNSNames is a list of subject alt names to be used on the
    + Certificate.
    + type: array
    + items:
    + type: string
    + duration:
    + description: Certificate default Duration
    + type: string
    + ipAddresses:
    + description: IPAddresses is a list of IP addresses to be used on the
    + Certificate
    + type: array
    + items:
    + type: string
    + isCA:
    + description: IsCA will mark this Certificate as valid for signing. This
    + implies that the 'cert sign' usage is set
    + type: boolean
    + issuerRef:
    + description: IssuerRef is a reference to the issuer for this certificate.
    + If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
    + with the given name in the same namespace as the Certificate will
    + be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
    + with the provided name will be used. The 'name' field in this stanza
    + is required at all times.
    + type: object
    + required:
    + - name
    + properties:
    + group:
    + type: string
    + kind:
    + type: string
    + name:
    + type: string
    + keyAlgorithm:
    + description: KeyAlgorithm is the private key algorithm of the corresponding
    + private key for this certificate. If provided, allowed values are
    + either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize is
    + not provided, key size of 256 will be used for "ecdsa" key algorithm
    + and key size of 2048 will be used for "rsa" key algorithm.
    + type: string
    + enum:
    + - rsa
    + - ecdsa
    + keyEncoding:
    + description: KeyEncoding is the private key cryptography standards (PKCS)
    + for this certificate's private key to be encoded in. If provided,
    + allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
    + respectively. If KeyEncoding is not specified, then PKCS#1 will be
    + used by default.
    + type: string
    + enum:
    + - pkcs1
    + - pkcs8
    + keySize:
    + description: KeySize is the key bit size of the corresponding private
    + key for this certificate. If provided, value must be between 2048
    + and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
    + and value must be one of (256, 384, 521) when KeyAlgorithm is set
    + to "ecdsa".
    + type: integer
    + organization:
    + description: Organization is the organization to be used on the Certificate
    + type: array
    + items:
    + type: string
    + renewBefore:
    + description: Certificate renew before expiration duration
    + type: string
    + secretName:
    + description: SecretName is the name of the secret resource to store
    + this secret in
    + type: string
    + subject:
    + description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
    + type: object
    + properties:
    + countries:
    + description: Countries to be used on the Certificate.
    + type: array
    + items:
    + type: string
    + localities:
    + description: Cities to be used on the Certificate.
    + type: array
    + items:
    + type: string
    + organizationalUnits:
    + description: Organizational Units to be used on the Certificate.
    + type: array
    + items:
    + type: string
    + postalCodes:
    + description: Postal codes to be used on the Certificate.
    + type: array
    + items:
    + type: string
    + provinces:
    + description: State/Provinces to be used on the Certificate.
    + type: array
    + items:
    + type: string
    + serialNumber:
    + description: Serial number to be used on the Certificate.
    + type: string
    + streetAddresses:
    + description: Street addresses to be used on the Certificate.
    + type: array
    + items:
    + type: string
    + uriSANs:
    + description: URISANs is a list of URI Subject Alternative Names to be
    + set on this Certificate.
    + type: array
    + items:
    + type: string
    + usages:
    + description: Usages is the set of x509 actions that are enabled for
    + a given key. Defaults are ('digital signature', 'key encipherment')
    + if empty
    + type: array
    + items:
    + description: 'KeyUsage specifies valid usage contexts for keys. See:
    + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
    + Valid KeyUsage values are as follows: "signing", "digital signature",
    + "content commitment", "key encipherment", "key agreement", "data
    + encipherment", "cert sign", "crl sign", "encipher only", "decipher
    + only", "any", "server auth", "client auth", "code signing", "email
    + protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
    + user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
    + sgc"'
    + type: string
    + enum:
    + - signing
    + - digital signature
    + - content commitment
    + - key encipherment
    + - key agreement
    + - data encipherment
    + - cert sign
    + - crl sign
    + - encipher only
    + - decipher only
    + - any
    + - server auth
    + - client auth
    + - code signing
    + - email protection
    + - s/mime
    + - ipsec end system
    + - ipsec tunnel
    + - ipsec user
    + - timestamping
    + - ocsp signing
    + - microsoft sgc
    + - netscape sgc
    + status:
    + description: CertificateStatus defines the observed state of Certificate
    + type: object
    + properties:
    + conditions:
    + type: array
    + items:
    + description: CertificateCondition contains condition information for
    + an Certificate.
    + type: object
    + required:
    + - status
    + - type
    + properties:
    + lastTransitionTime:
    + description: LastTransitionTime is the timestamp corresponding
    + to the last status change of this condition.
    + type: string
    + format: date-time
    + message:
    + description: Message is a human readable description of the details
    + of the last transition, complementing reason.
    + type: string
    + reason:
    + description: Reason is a brief machine readable explanation for
    + the condition's last transition.
    + type: string
    + status:
    + description: Status of the condition, one of ('True', 'False',
    + 'Unknown').
    + type: string
    + enum:
    + - "True"
    + - "False"
    + - Unknown
    + type:
    + description: Type of the condition, currently ('Ready').
    + type: string
    + lastFailureTime:
    + type: string
    + format: date-time
    + notAfter:
    + description: The expiration time of the certificate stored in the secret
    + named by this resource in spec.secretName.
    + type: string
    + format: date-time
    + version: v1alpha2
    + versions:
    + - name: v1alpha2
    + served: true
    + storage: true
    +---
    +apiVersion: apiextensions.k8s.io/v1beta1
    +kind: CustomResourceDefinition
    +metadata:
    name: challenges.acme.cert-manager.io
    spec:
    additionalPrinterColumns:
    @@ -28,6 +498,7 @@
    name: Age
    type: date
    group: acme.cert-manager.io
    + preserveUnknownFields: false
    names:
    kind: Challenge
    listKind: ChallengeList
    @@ -40,6 +511,9 @@
    openAPIV3Schema:
    description: Challenge is a type to represent a Challenge request with an ACME
    server
    + type: object
    + required:
    + - metadata
    properties:
    apiVersion:
    description: 'APIVersion defines the versioned schema of this representation
    @@ -54,6 +528,15 @@
    metadata:
    type: object
    spec:
    + type: object
    + required:
    + - authzURL
    + - dnsName
    + - issuerRef
    + - key
    + - token
    + - type
    + - url
    properties:
    authzURL:
    description: AuthzURL is the URL to the ACME Authorization resource
    @@ -69,6 +552,9 @@
    not exist, processing will be retried. If the Issuer is not an 'ACME'
    Issuer, an error will be returned and the Challenge will be marked
    as failed.
    + type: object
    + required:
    + - name
    properties:
    group:
    type: string
    @@ -76,25 +562,29 @@
    type: string
    name:
    type: string
    - required:
    - - name
    - type: object
    key:
    description: Key is the ACME challenge key for this challenge
    type: string
    solver:
    description: Solver contains the domain solving configuration that should
    - be used to solve this challenge resource. Only **one** of 'config'
    - or 'solver' may be specified, and if both are specified then no action
    - will be performed on the Challenge resource.
    + be used to solve this challenge resource.
    + type: object
    properties:
    dns01:
    + type: object
    properties:
    acmedns:
    description: ACMEIssuerDNS01ProviderAcmeDNS is a structure containing
    the configuration for ACME-DNS servers
    + type: object
    + required:
    + - accountSecretRef
    + - host
    properties:
    accountSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -104,21 +594,23 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    host:
    type: string
    - required:
    - - accountSecretRef
    - - host
    - type: object
    akamai:
    description: ACMEIssuerDNS01ProviderAkamai is a structure containing
    the DNS configuration for Akamai DNS—Zone Record Management
    API
    + type: object
    + required:
    + - accessTokenSecretRef
    + - clientSecretSecretRef
    + - clientTokenSecretRef
    + - serviceConsumerDomain
    properties:
    accessTokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -128,10 +620,10 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    + clientSecretSecretRef:
    + type: object
    required:
    - name
    - type: object
    - clientSecretSecretRef:
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -141,10 +633,10 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    + clientTokenSecretRef:
    + type: object
    required:
    - name
    - type: object
    - clientTokenSecretRef:
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -154,24 +646,62 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    serviceConsumerDomain:
    type: string
    - required:
    - - accessTokenSecretRef
    - - clientSecretSecretRef
    - - clientTokenSecretRef
    - - serviceConsumerDomain
    - type: object
    azuredns:
    description: ACMEIssuerDNS01ProviderAzureDNS is a structure
    containing the configuration for Azure DNS
    + type: object
    + required:
    + - clientID
    + - clientSecretSecretRef
    + - resourceGroupName
    + - subscriptionID
    + - tenantID
    properties:
    clientID:
    type: string
    clientSecretSecretRef:
    + type: object
    + required:
    + - name
    + properties:
    + key:
    + description: The key of the secret to select from. Must
    + be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind, uid?'
    + type: string
    + environment:
    + type: string
    + enum:
    + - AzurePublicCloud
    + - AzureChinaCloud
    + - AzureGermanCloud
    + - AzureUSGovernmentCloud
    + hostedZoneName:
    + type: string
    + resourceGroupName:
    + type: string
    + subscriptionID:
    + type: string
    + tenantID:
    + type: string
    + clouddns:
    + description: ACMEIssuerDNS01ProviderCloudDNS is a structure
    + containing the DNS configuration for Google Cloud DNS
    + type: object
    + required:
    + - project
    + properties:
    + project:
    + type: string
    + serviceAccountSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -181,38 +711,30 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    + cloudflare:
    + description: ACMEIssuerDNS01ProviderCloudflare is a structure
    + containing the DNS configuration for Cloudflare
    + type: object
    + required:
    + - email
    + properties:
    + apiKeySecretRef:
    + type: object
    required:
    - name
    + properties:
    + key:
    + description: The key of the secret to select from. Must
    + be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind, uid?'
    + type: string
    + apiTokenSecretRef:
    type: object
    - environment:
    - enum:
    - - AzurePublicCloud
    - - AzureChinaCloud
    - - AzureGermanCloud
    - - AzureUSGovernmentCloud
    - type: string
    - hostedZoneName:
    - type: string
    - resourceGroupName:
    - type: string
    - subscriptionID:
    - type: string
    - tenantID:
    - type: string
    - required:
    - - clientID
    - - clientSecretSecretRef
    - - resourceGroupName
    - - subscriptionID
    - - tenantID
    - type: object
    - clouddns:
    - description: ACMEIssuerDNS01ProviderCloudDNS is a structure
    - containing the DNS configuration for Google Cloud DNS
    - properties:
    - project:
    - type: string
    - serviceAccountSecretRef:
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -222,18 +744,26 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    + email:
    + type: string
    + cnameStrategy:
    + description: CNAMEStrategy configures how the DNS01 provider
    + should handle CNAME records when found in DNS zones.
    + type: string
    + enum:
    + - None
    + - Follow
    + digitalocean:
    + description: ACMEIssuerDNS01ProviderDigitalOcean is a structure
    + containing the DNS configuration for DigitalOcean Domains
    + type: object
    + required:
    + - tokenSecretRef
    + properties:
    + tokenSecretRef:
    + type: object
    required:
    - name
    - type: object
    - required:
    - - project
    - - serviceAccountSecretRef
    - type: object
    - cloudflare:
    - description: ACMEIssuerDNS01ProviderCloudflare is a structure
    - containing the DNS configuration for Cloudflare
    - properties:
    - apiKeySecretRef:
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -243,45 +773,12 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - email:
    - type: string
    - required:
    - - apiKeySecretRef
    - - email
    - type: object
    - cnameStrategy:
    - description: CNAMEStrategy configures how the DNS01 provider
    - should handle CNAME records when found in DNS zones.
    - enum:
    - - None
    - - Follow
    - type: string
    - digitalocean:
    - description: ACMEIssuerDNS01ProviderDigitalOcean is a structure
    - containing the DNS configuration for DigitalOcean Domains
    - properties:
    - tokenSecretRef:
    - properties:
    - key:
    - description: The key of the secret to select from. Must
    - be a valid secret key.
    - type: string
    - name:
    - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    - TODO: Add other useful fields. apiVersion, kind, uid?'
    - type: string
    - required:
    - - name
    - type: object
    - required:
    - - tokenSecretRef
    - type: object
    rfc2136:
    description: ACMEIssuerDNS01ProviderRFC2136 is a structure containing
    the configuration for RFC2136 DNS
    + type: object
    + required:
    + - nameserver
    properties:
    nameserver:
    description: 'The IP address of the DNS supporting RFC2136.
    @@ -301,6 +798,9 @@
    tsigSecretSecretRef:
    description: The name of the secret containing the TSIG
    value. If ``tsigKeyName`` is defined, this field is required.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -310,15 +810,12 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - nameserver
    - type: object
    route53:
    description: ACMEIssuerDNS01ProviderRoute53 is a structure containing
    the Route 53 configuration for AWS
    + type: object
    + required:
    + - region
    properties:
    accessKeyID:
    description: 'The AccessKeyID is used for authentication.
    @@ -344,6 +841,9 @@
    description: The SecretAccessKey is used for authentication.
    If not set we fall-back to using env vars, shared credentials
    file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -353,16 +853,14 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - region
    - type: object
    webhook:
    description: ACMEIssuerDNS01ProviderWebhook specifies configuration
    for a webhook DNS01 provider, including where to POST ChallengePayload
    resources.
    + type: object
    + required:
    + - groupName
    + - solverName
    properties:
    config:
    description: Additional configuration that should be passed
    @@ -385,11 +883,6 @@
    the webhook provider implementation. This will typically
    be the name of the provider, e.g. 'cloudflare'.
    type: string
    - required:
    - - groupName
    - - solverName
    - type: object
    - type: object
    http01:
    description: ACMEChallengeSolverHTTP01 contains configuration detailing
    how to solve HTTP01 challenges within a Kubernetes cluster. Typically
    @@ -397,6 +890,7 @@
    that configure ingress controllers to direct traffic to 'solver
    pods', which are responsible for responding to the ACME server's
    HTTP requests.
    + type: object
    properties:
    ingress:
    description: The ingress based HTTP01 challenge solver will
    @@ -404,6 +898,7 @@
    in order to route requests for '/.well-known/acme-challenge/XYZ'
    to 'challenge solver' pods that are provisioned by cert-manager
    for each Challenge to be completed.
    + type: object
    properties:
    class:
    description: The ingress class to use when creating Ingress
    @@ -421,6 +916,7 @@
    podTemplate:
    description: Optional pod template used to configure the
    ACME challenge solver pods used for HTTP01 challenges
    + type: object
    properties:
    metadata:
    description: ObjectMeta overrides for the pod used to
    @@ -429,19 +925,35 @@
    with in-built values, the values here will override
    the in-built values.
    type: object
    + properties:
    + annotations:
    + description: Annotations that should be added to
    + the create ACME HTTP01 solver pods.
    + type: object
    + additionalProperties:
    + type: string
    + labels:
    + description: Labels that should be added to the
    + created ACME HTTP01 solver pods.
    + type: object
    + additionalProperties:
    + type: string
    spec:
    description: PodSpec defines overrides for the HTTP01
    challenge solver pod. Only the 'nodeSelector', 'affinity'
    and 'tolerations' fields are supported currently.
    All other fields will be ignored.
    + type: object
    properties:
    affinity:
    description: If specified, the pod's scheduling
    constraints
    + type: object
    properties:
    nodeAffinity:
    description: Describes node affinity scheduling
    rules for the pod.
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer to
    @@ -459,74 +971,38 @@
    sum if the node matches the corresponding
    matchExpressions; the node(s) with the
    highest sum are the most preferred.
    + type: array
    items:
    description: An empty preferred scheduling
    term matches all objects with implicit
    weight 0 (i.e. it's a no-op). A null
    preferred scheduling term matches no
    objects (i.e. is also a no-op).
    + type: object
    + required:
    + - preference
    + - weight
    properties:
    preference:
    description: A node selector term,
    associated with the corresponding
    weight.
    + type: object
    properties:
    matchExpressions:
    description: A list of node selector
    requirements by node's labels.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    that contains values, a key,
    and an operator that relates
    the key and values.
    - properties:
    - key:
    - description: The label key
    - that the selector applies
    - to.
    - type: string
    - operator:
    - description: Represents
    - a key's relationship to
    - a set of values. Valid
    - operators are In, NotIn,
    - Exists, DoesNotExist.
    - Gt, and Lt.
    - type: string
    - values:
    - description: An array of
    - string values. If the
    - operator is In or NotIn,
    - the values array must
    - be non-empty. If the operator
    - is Exists or DoesNotExist,
    - the values array must
    - be empty. If the operator
    - is Gt or Lt, the values
    - array must have a single
    - element, which will be
    - interpreted as an integer.
    - This array is replaced
    - during a strategic merge
    - patch.
    - items:
    - type: string
    - type: array
    + type: object
    required:
    - key
    - operator
    - type: object
    - type: array
    - matchFields:
    - description: A list of node selector
    - requirements by node's fields.
    - items:
    - description: A node selector
    - requirement is a selector
    - that contains values, a key,
    - and an operator that relates
    - the key and values.
    properties:
    key:
    description: The label key
    @@ -557,56 +1033,23 @@
    This array is replaced
    during a strategic merge
    patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    + matchFields:
    + description: A list of node selector
    + requirements by node's fields.
    type: array
    - type: object
    - weight:
    - description: Weight associated with
    - matching the corresponding nodeSelectorTerm,
    - in the range 1-100.
    - format: int32
    - type: integer
    - required:
    - - preference
    - - weight
    - type: object
    - type: array
    - requiredDuringSchedulingIgnoredDuringExecution:
    - description: If the affinity requirements
    - specified by this field are not met at
    - scheduling time, the pod will not be scheduled
    - onto the node. If the affinity requirements
    - specified by this field cease to be met
    - at some point during pod execution (e.g.
    - due to an update), the system may or may
    - not try to eventually evict the pod from
    - its node.
    - properties:
    - nodeSelectorTerms:
    - description: Required. A list of node
    - selector terms. The terms are ORed.
    - items:
    - description: A null or empty node
    - selector term matches no objects.
    - The requirements of them are ANDed.
    - The TopologySelectorTerm type implements
    - a subset of the NodeSelectorTerm.
    - properties:
    - matchExpressions:
    - description: A list of node selector
    - requirements by node's labels.
    items:
    description: A node selector
    requirement is a selector
    that contains values, a key,
    and an operator that relates
    the key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label key
    @@ -637,23 +1080,55 @@
    This array is replaced
    during a strategic merge
    patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    + weight:
    + description: Weight associated with
    + matching the corresponding nodeSelectorTerm,
    + in the range 1-100.
    + type: integer
    + format: int32
    + requiredDuringSchedulingIgnoredDuringExecution:
    + description: If the affinity requirements
    + specified by this field are not met at
    + scheduling time, the pod will not be scheduled
    + onto the node. If the affinity requirements
    + specified by this field cease to be met
    + at some point during pod execution (e.g.
    + due to an update), the system may or may
    + not try to eventually evict the pod from
    + its node.
    + type: object
    + required:
    + - nodeSelectorTerms
    + properties:
    + nodeSelectorTerms:
    + description: Required. A list of node
    + selector terms. The terms are ORed.
    + type: array
    + items:
    + description: A null or empty node
    + selector term matches no objects.
    + The requirements of them are ANDed.
    + The TopologySelectorTerm type implements
    + a subset of the NodeSelectorTerm.
    + type: object
    + properties:
    + matchExpressions:
    + description: A list of node selector
    + requirements by node's labels.
    type: array
    - matchFields:
    - description: A list of node selector
    - requirements by node's fields.
    items:
    description: A node selector
    requirement is a selector
    that contains values, a key,
    and an operator that relates
    the key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label key
    @@ -684,24 +1159,61 @@
    This array is replaced
    during a strategic merge
    patch.
    + type: array
    items:
    type: string
    - type: array
    + matchFields:
    + description: A list of node selector
    + requirements by node's fields.
    + type: array
    + items:
    + description: A node selector
    + requirement is a selector
    + that contains values, a key,
    + and an operator that relates
    + the key and values.
    + type: object
    required:
    - key
    - operator
    - type: object
    - type: array
    - type: object
    - type: array
    - required:
    - - nodeSelectorTerms
    - type: object
    - type: object
    + properties:
    + key:
    + description: The label key
    + that the selector applies
    + to.
    + type: string
    + operator:
    + description: Represents
    + a key's relationship to
    + a set of values. Valid
    + operators are In, NotIn,
    + Exists, DoesNotExist.
    + Gt, and Lt.
    + type: string
    + values:
    + description: An array of
    + string values. If the
    + operator is In or NotIn,
    + the values array must
    + be non-empty. If the operator
    + is Exists or DoesNotExist,
    + the values array must
    + be empty. If the operator
    + is Gt or Lt, the values
    + array must have a single
    + element, which will be
    + interpreted as an integer.
    + This array is replaced
    + during a strategic merge
    + patch.
    + type: array
    + items:
    + type: string
    podAffinity:
    description: Describes pod affinity scheduling
    rules (e.g. co-locate this pod in the same
    node, zone, etc. as some other pod(s)).
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer to
    @@ -720,27 +1232,37 @@
    the corresponding podAffinityTerm; the
    node(s) with the highest sum are the most
    preferred.
    + type: array
    items:
    description: The weights of all of the
    matched WeightedPodAffinityTerm fields
    are added per-node to find the most
    preferred node(s)
    + type: object
    + required:
    + - podAffinityTerm
    + - weight
    properties:
    podAffinityTerm:
    description: Required. A pod affinity
    term, associated with the corresponding
    weight.
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over
    a set of resources, in this
    case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    @@ -748,6 +1270,10 @@
    a key, and an operator
    that relates the key and
    values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is
    @@ -778,17 +1304,10 @@
    is replaced during
    a strategic merge
    patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels is
    a map of {key,value} pairs.
    A single {key,value} in
    @@ -800,16 +1319,17 @@
    only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against);
    null or empty list means "this
    pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should be
    co-located (affinity) or not
    @@ -824,20 +1344,12 @@
    is running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    weight:
    description: weight associated with
    matching the corresponding podAffinityTerm,
    in the range 1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - podAffinityTerm
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the affinity requirements
    specified by this field are not met at
    @@ -852,6 +1364,7 @@
    corresponding to each podAffinityTerm
    are intersected, i.e. all terms must be
    satisfied.
    + type: array
    items:
    description: Defines a set of pods (namely
    those matching the labelSelector relative
    @@ -863,22 +1376,31 @@
    key <topologyKey> matches that of any
    node on which a pod of the set of pods
    is running
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over a
    set of resources, in this case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    that contains values, a key,
    and an operator that relates
    the key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is the
    @@ -903,17 +1425,10 @@
    array must be empty. This
    array is replaced during
    a strategic merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels is a
    map of {key,value} pairs. A
    single {key,value} in the matchLabels
    @@ -924,16 +1439,17 @@
    contains only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against); null
    or empty list means "this pod's
    namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should be co-located
    (affinity) or not co-located (anti-affinity)
    @@ -946,15 +1462,11 @@
    selected pods is running. Empty
    topologyKey is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    - type: array
    - type: object
    podAntiAffinity:
    description: Describes pod anti-affinity scheduling
    rules (e.g. avoid putting this pod in the
    same node, zone, etc. as some other pod(s)).
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer to
    @@ -973,27 +1485,37 @@
    has pods which matches the corresponding
    podAffinityTerm; the node(s) with the
    highest sum are the most preferred.
    + type: array
    items:
    description: The weights of all of the
    matched WeightedPodAffinityTerm fields
    are added per-node to find the most
    preferred node(s)
    + type: object
    + required:
    + - podAffinityTerm
    + - weight
    properties:
    podAffinityTerm:
    description: Required. A pod affinity
    term, associated with the corresponding
    weight.
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over
    a set of resources, in this
    case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    @@ -1001,6 +1523,10 @@
    a key, and an operator
    that relates the key and
    values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is
    @@ -1031,17 +1557,10 @@
    is replaced during
    a strategic merge
    patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels is
    a map of {key,value} pairs.
    A single {key,value} in
    @@ -1053,16 +1572,17 @@
    only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against);
    null or empty list means "this
    pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should be
    co-located (affinity) or not
    @@ -1077,20 +1597,12 @@
    is running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    weight:
    description: weight associated with
    matching the corresponding podAffinityTerm,
    in the range 1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - podAffinityTerm
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the anti-affinity requirements
    specified by this field are not met at
    @@ -1105,6 +1617,7 @@
    corresponding to each podAffinityTerm
    are intersected, i.e. all terms must be
    satisfied.
    + type: array
    items:
    description: Defines a set of pods (namely
    those matching the labelSelector relative
    @@ -1116,22 +1629,31 @@
    key <topologyKey> matches that of any
    node on which a pod of the set of pods
    is running
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over a
    set of resources, in this case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    that contains values, a key,
    and an operator that relates
    the key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is the
    @@ -1156,17 +1678,10 @@
    array must be empty. This
    array is replaced during
    a strategic merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels is a
    map of {key,value} pairs. A
    single {key,value} in the matchLabels
    @@ -1177,16 +1692,17 @@
    contains only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against); null
    or empty list means "this pod's
    namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should be co-located
    (affinity) or not co-located (anti-affinity)
    @@ -1199,27 +1715,23 @@
    selected pods is running. Empty
    topologyKey is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    - type: array
    - type: object
    - type: object
    nodeSelector:
    - additionalProperties:
    - type: string
    description: 'NodeSelector is a selector which must
    be true for the pod to fit on a node. Selector
    which must match a node''s labels for the pod
    to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
    type: object
    + additionalProperties:
    + type: string
    tolerations:
    description: If specified, the pod's tolerations.
    + type: array
    items:
    description: The pod this Toleration is attached
    to tolerates any taint that matches the triple
    <key,value,effect> using the matching operator
    <operator>.
    + type: object
    properties:
    effect:
    description: Effect indicates the taint effect
    @@ -1251,27 +1763,22 @@
    the taint forever (do not evict). Zero and
    negative values will be treated as 0 (evict
    immediately) by the system.
    + type: integer
    format: int64
    - type: integer
    value:
    description: Value is the taint value the
    toleration matches to. If the operator is
    Exists, the value should be empty, otherwise
    just a regular string.
    type: string
    - type: object
    - type: array
    - type: object
    - type: object
    serviceType:
    description: Optional service type for Kubernetes solver
    service
    type: string
    - type: object
    - type: object
    selector:
    description: Selector selects a set of DNSNames on the Certificate
    resource that should be solved using this challenge solver.
    + type: object
    properties:
    dnsNames:
    description: List of DNSNames that this solver will be used
    @@ -1281,9 +1788,9 @@
    the most matching labels in matchLabels will be selected.
    If neither has more matches, the solver defined earlier in
    the list will be selected.
    + type: array
    items:
    type: string
    - type: array
    dnsZones:
    description: List of DNSZones that this solver will be used
    to solve. The most specific DNS zone match specified here
    @@ -1294,17 +1801,15 @@
    the most matching labels in matchLabels will be selected.
    If neither has more matches, the solver defined earlier in
    the list will be selected.
    + type: array
    items:
    type: string
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: A label selector that is used to refine the set
    of certificate's that this challenge solver will apply to.
    type: object
    - type: object
    - type: object
    + additionalProperties:
    + type: string
    token:
    description: Token is the ACME challenge token for this challenge.
    type: string
    @@ -1321,16 +1826,8 @@
    description: Wildcard will be true if this challenge is for a wildcard
    identifier, for example '*.example.com'
    type: boolean
    - required:
    - - authzURL
    - - dnsName
    - - issuerRef
    - - key
    - - token
    - - type
    - - url
    + status:
    type: object
    - status:
    properties:
    presented:
    description: Presented will be set to true if the challenge values for
    @@ -1354,6 +1851,7 @@
    state:
    description: State contains the current 'state' of the challenge. If
    not set, the state of the challenge is unknown.
    + type: string
    enum:
    - valid
    - ready
    @@ -1362,249 +1860,21 @@
    - invalid
    - expired
    - errored
    - type: string
    - type: object
    - required:
    - - metadata
    - type: object
    version: v1alpha2
    versions:
    - name: v1alpha2
    served: true
    storage: true
    -status:
    - acceptedNames:
    - kind: ""
    - plural: ""
    - conditions: []
    - storedVersions: []
    ----
    -
    ---
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    - creationTimestamp: null
    - name: orders.acme.cert-manager.io
    -spec:
    - additionalPrinterColumns:
    - - JSONPath: .status.state
    - name: State
    - type: string
    - - JSONPath: .spec.issuerRef.name
    - name: Issuer
    - priority: 1
    - type: string
    - - JSONPath: .status.reason
    - name: Reason
    - priority: 1
    - type: string
    - - JSONPath: .metadata.creationTimestamp
    - description: CreationTimestamp is a timestamp representing the server time when
    - this object was created. It is not guaranteed to be set in happens-before order
    - across separate operations. Clients may not set this value. It is represented
    - in RFC3339 form and is in UTC.
    - name: Age
    - type: date
    - group: acme.cert-manager.io
    - names:
    - kind: Order
    - listKind: OrderList
    - plural: orders
    - singular: order
    - scope: Namespaced
    - subresources:
    - status: {}
    - validation:
    - openAPIV3Schema:
    - description: Order is a type to represent an Order with an ACME server
    - properties:
    - apiVersion:
    - description: 'APIVersion defines the versioned schema of this representation
    - of an object. Servers should convert recognized schemas to the latest
    - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    - type: string
    - kind:
    - description: 'Kind is a string value representing the REST resource this
    - object represents. Servers may infer this from the endpoint the client
    - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    - type: string
    - metadata:
    - type: object
    - spec:
    - properties:
    - commonName:
    - description: CommonName is the common name as specified on the DER encoded
    - CSR. If CommonName is not specified, the first DNSName specified will
    - be used as the CommonName. At least one of CommonName or a DNSNames
    - must be set. This field must match the corresponding field on the
    - DER encoded CSR.
    - type: string
    - csr:
    - description: Certificate signing request bytes in DER encoding. This
    - will be used when finalizing the order. This field must be set on
    - the order.
    - format: byte
    - type: string
    - dnsNames:
    - description: DNSNames is a list of DNS names that should be included
    - as part of the Order validation process. If CommonName is not specified,
    - the first DNSName specified will be used as the CommonName. At least
    - one of CommonName or a DNSNames must be set. This field must match
    - the corresponding field on the DER encoded CSR.
    - items:
    - type: string
    - type: array
    - issuerRef:
    - description: IssuerRef references a properly configured ACME-type Issuer
    - which should be used to create this Order. If the Issuer does not
    - exist, processing will be retried. If the Issuer is not an 'ACME'
    - Issuer, an error will be returned and the Order will be marked as
    - failed.
    - properties:
    - group:
    - type: string
    - kind:
    - type: string
    - name:
    - type: string
    - required:
    - - name
    - type: object
    - required:
    - - csr
    - - issuerRef
    - type: object
    - status:
    - properties:
    - authorizations:
    - description: Authorizations contains data returned from the ACME server
    - on what authoriations must be completed in order to validate the DNS
    - names specified on the Order.
    - items:
    - description: ACMEAuthorization contains data returned from the ACME
    - server on an authorization that must be completed in order validate
    - a DNS name on an ACME Order resource.
    - properties:
    - challenges:
    - description: Challenges specifies the challenge types offered
    - by the ACME server. One of these challenge types will be selected
    - when validating the DNS name and an appropriate Challenge resource
    - will be created to perform the ACME challenge process.
    - items:
    - description: Challenge specifies a challenge offered by the
    - ACME server for an Order. An appropriate Challenge resource
    - can be created to perform the ACME challenge process.
    - properties:
    - token:
    - description: Token is the token that must be presented for
    - this challenge. This is used to compute the 'key' that
    - must also be presented.
    - type: string
    - type:
    - description: Type is the type of challenge being offered,
    - e.g. http-01, dns-01
    - type: string
    - url:
    - description: URL is the URL of this challenge. It can be
    - used to retrieve additional metadata about the Challenge
    - from the ACME server.
    - type: string
    - required:
    - - token
    - - type
    - - url
    - type: object
    - type: array
    - identifier:
    - description: Identifier is the DNS name to be validated as part
    - of this authorization
    - type: string
    - url:
    - description: URL is the URL of the Authorization that must be
    - completed
    - type: string
    - wildcard:
    - description: Wildcard will be true if this authorization is for
    - a wildcard DNS name. If this is true, the identifier will be
    - the *non-wildcard* version of the DNS name. For example, if
    - '*.example.com' is the DNS name being validated, this field
    - will be 'true' and the 'identifier' field will be 'example.com'.
    - type: boolean
    - required:
    - - url
    - type: object
    - type: array
    - certificate:
    - description: Certificate is a copy of the PEM encoded certificate for
    - this Order. This field will be populated after the order has been
    - successfully finalized with the ACME server, and the order has transitioned
    - to the 'valid' state.
    - format: byte
    - type: string
    - failureTime:
    - description: FailureTime stores the time that this order failed. This
    - is used to influence garbage collection and back-off.
    - format: date-time
    - type: string
    - finalizeURL:
    - description: FinalizeURL of the Order. This is used to obtain certificates
    - for this order once it has been completed.
    - type: string
    - reason:
    - description: Reason optionally provides more information about a why
    - the order is in the current state.
    - type: string
    - state:
    - description: State contains the current state of this Order resource.
    - States 'success' and 'expired' are 'final'
    - enum:
    - - valid
    - - ready
    - - pending
    - - processing
    - - invalid
    - - expired
    - - errored
    - type: string
    - url:
    - description: URL of the Order. This will initially be empty when the
    - resource is first created. The Order controller will populate this
    - field when the Order is first processed. This field will be immutable
    - after it is initially set.
    - type: string
    - type: object
    - required:
    - - metadata
    - type: object
    - version: v1alpha2
    - versions:
    - - name: v1alpha2
    - served: true
    - storage: true
    -status:
    - acceptedNames:
    - kind: ""
    - plural: ""
    - conditions: []
    - storedVersions: []
    ----
    -
    ----
    -apiVersion: apiextensions.k8s.io/v1beta1
    -kind: CustomResourceDefinition
    -metadata:
    - creationTimestamp: null
    - name: certificaterequests.cert-manager.io
    + name: clusterissuers.cert-manager.io
    spec:
    additionalPrinterColumns:
    - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
    - - JSONPath: .spec.issuerRef.name
    - name: Issuer
    - priority: 1
    - type: string
    - JSONPath: .status.conditions[?(@.type=="Ready")].message
    name: Status
    priority: 1
    @@ -1617,423 +1887,7 @@
    name: Age
    type: date
    group: cert-manager.io
    - names:
    - kind: CertificateRequest
    - listKind: CertificateRequestList
    - plural: certificaterequests
    - shortNames:
    - - cr
    - - crs
    - singular: certificaterequest
    - scope: Namespaced
    - subresources:
    - status: {}
    - validation:
    - openAPIV3Schema:
    - description: CertificateRequest is a type to represent a Certificate Signing
    - Request
    - properties:
    - apiVersion:
    - description: 'APIVersion defines the versioned schema of this representation
    - of an object. Servers should convert recognized schemas to the latest
    - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    - type: string
    - kind:
    - description: 'Kind is a string value representing the REST resource this
    - object represents. Servers may infer this from the endpoint the client
    - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    - type: string
    - metadata:
    - type: object
    - spec:
    - description: CertificateRequestSpec defines the desired state of CertificateRequest
    - properties:
    - csr:
    - description: Byte slice containing the PEM encoded CertificateSigningRequest
    - format: byte
    - type: string
    - duration:
    - description: Requested certificate default Duration
    - type: string
    - isCA:
    - description: IsCA will mark the resulting certificate as valid for signing.
    - This implies that the 'cert sign' usage is set
    - type: boolean
    - issuerRef:
    - description: IssuerRef is a reference to the issuer for this CertificateRequest. If
    - the 'kind' field is not set, or set to 'Issuer', an Issuer resource
    - with the given name in the same namespace as the CertificateRequest
    - will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
    - with the provided name will be used. The 'name' field in this stanza
    - is required at all times. The group field refers to the API group
    - of the issuer which defaults to 'cert-manager.io' if empty.
    - properties:
    - group:
    - type: string
    - kind:
    - type: string
    - name:
    - type: string
    - required:
    - - name
    - type: object
    - usages:
    - description: Usages is the set of x509 actions that are enabled for
    - a given key. Defaults are ('digital signature', 'key encipherment')
    - if empty
    - items:
    - description: 'KeyUsage specifies valid usage contexts for keys. See:
    - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12'
    - enum:
    - - signing
    - - digital signature
    - - content commitment
    - - key encipherment
    - - key agreement
    - - data encipherment
    - - cert sign
    - - crl sign
    - - encipher only
    - - decipher only
    - - any
    - - server auth
    - - client auth
    - - code signing
    - - email protection
    - - s/mime
    - - ipsec end system
    - - ipsec tunnel
    - - ipsec user
    - - timestamping
    - - ocsp signing
    - - microsoft sgc
    - - netscape sgc
    - type: string
    - type: array
    - required:
    - - issuerRef
    - type: object
    - status:
    - description: CertificateStatus defines the observed state of CertificateRequest
    - and resulting signed certificate.
    - properties:
    - ca:
    - description: Byte slice containing the PEM encoded certificate authority
    - of the signed certificate.
    - format: byte
    - type: string
    - certificate:
    - description: Byte slice containing a PEM encoded signed certificate
    - resulting from the given certificate signing request.
    - format: byte
    - type: string
    - conditions:
    - items:
    - description: CertificateRequestCondition contains condition information
    - for a CertificateRequest.
    - properties:
    - lastTransitionTime:
    - description: LastTransitionTime is the timestamp corresponding
    - to the last status change of this condition.
    - format: date-time
    - type: string
    - message:
    - description: Message is a human readable description of the details
    - of the last transition, complementing reason.
    - type: string
    - reason:
    - description: Reason is a brief machine readable explanation for
    - the condition's last transition.
    - type: string
    - status:
    - description: Status of the condition, one of ('True', 'False',
    - 'Unknown').
    - enum:
    - - "True"
    - - "False"
    - - Unknown
    - type: string
    - type:
    - description: Type of the condition, currently ('Ready').
    - type: string
    - required:
    - - status
    - - type
    - type: object
    - type: array
    - failureTime:
    - description: FailureTime stores the time that this CertificateRequest
    - failed. This is used to influence garbage collection and back-off.
    - format: date-time
    - type: string
    - type: object
    - type: object
    - version: v1alpha2
    - versions:
    - - name: v1alpha2
    - served: true
    - storage: true
    -status:
    - acceptedNames:
    - kind: ""
    - plural: ""
    - conditions: []
    - storedVersions: []
    ----
    -
    ----
    -apiVersion: apiextensions.k8s.io/v1beta1
    -kind: CustomResourceDefinition
    -metadata:
    - creationTimestamp: null
    - name: certificates.cert-manager.io
    -spec:
    - additionalPrinterColumns:
    - - JSONPath: .status.conditions[?(@.type=="Ready")].status
    - name: Ready
    - type: string
    - - JSONPath: .spec.secretName
    - name: Secret
    - type: string
    - - JSONPath: .spec.issuerRef.name
    - name: Issuer
    - priority: 1
    - type: string
    - - JSONPath: .status.conditions[?(@.type=="Ready")].message
    - name: Status
    - priority: 1
    - type: string
    - - JSONPath: .metadata.creationTimestamp
    - description: CreationTimestamp is a timestamp representing the server time when
    - this object was created. It is not guaranteed to be set in happens-before order
    - across separate operations. Clients may not set this value. It is represented
    - in RFC3339 form and is in UTC.
    - name: Age
    - type: date
    - group: cert-manager.io
    - names:
    - kind: Certificate
    - listKind: CertificateList
    - plural: certificates
    - shortNames:
    - - cert
    - - certs
    - singular: certificate
    - scope: Namespaced
    - subresources:
    - status: {}
    - validation:
    - openAPIV3Schema:
    - description: Certificate is a type to represent a Certificate from ACME
    - properties:
    - apiVersion:
    - description: 'APIVersion defines the versioned schema of this representation
    - of an object. Servers should convert recognized schemas to the latest
    - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    - type: string
    - kind:
    - description: 'Kind is a string value representing the REST resource this
    - object represents. Servers may infer this from the endpoint the client
    - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    - type: string
    - metadata:
    - type: object
    - spec:
    - description: CertificateSpec defines the desired state of Certificate. A
    - valid Certificate requires at least one of a CommonName, DNSName, or URISAN
    - to be valid.
    - properties:
    - commonName:
    - description: CommonName is a common name to be used on the Certificate.
    - The CommonName should have a length of 64 characters or fewer to avoid
    - generating invalid CSRs.
    - type: string
    - dnsNames:
    - description: DNSNames is a list of subject alt names to be used on the
    - Certificate.
    - items:
    - type: string
    - type: array
    - duration:
    - description: Certificate default Duration
    - type: string
    - ipAddresses:
    - description: IPAddresses is a list of IP addresses to be used on the
    - Certificate
    - items:
    - type: string
    - type: array
    - isCA:
    - description: IsCA will mark this Certificate as valid for signing. This
    - implies that the 'cert sign' usage is set
    - type: boolean
    - issuerRef:
    - description: IssuerRef is a reference to the issuer for this certificate.
    - If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
    - with the given name in the same namespace as the Certificate will
    - be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
    - with the provided name will be used. The 'name' field in this stanza
    - is required at all times.
    - properties:
    - group:
    - type: string
    - kind:
    - type: string
    - name:
    - type: string
    - required:
    - - name
    - type: object
    - keyAlgorithm:
    - description: KeyAlgorithm is the private key algorithm of the corresponding
    - private key for this certificate. If provided, allowed values are
    - either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize is
    - not provided, key size of 256 will be used for "ecdsa" key algorithm
    - and key size of 2048 will be used for "rsa" key algorithm.
    - enum:
    - - rsa
    - - ecdsa
    - type: string
    - keyEncoding:
    - description: KeyEncoding is the private key cryptography standards (PKCS)
    - for this certificate's private key to be encoded in. If provided,
    - allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
    - respectively. If KeyEncoding is not specified, then PKCS#1 will be
    - used by default.
    - enum:
    - - pkcs1
    - - pkcs8
    - type: string
    - keySize:
    - description: KeySize is the key bit size of the corresponding private
    - key for this certificate. If provided, value must be between 2048
    - and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
    - and value must be one of (256, 384, 521) when KeyAlgorithm is set
    - to "ecdsa".
    - type: integer
    - organization:
    - description: Organization is the organization to be used on the Certificate
    - items:
    - type: string
    - type: array
    - renewBefore:
    - description: Certificate renew before expiration duration
    - type: string
    - secretName:
    - description: SecretName is the name of the secret resource to store
    - this secret in
    - type: string
    - uriSANs:
    - description: URISANs is a list of URI Subject Alternative Names to be
    - set on this Certificate.
    - items:
    - type: string
    - type: array
    - usages:
    - description: Usages is the set of x509 actions that are enabled for
    - a given key. Defaults are ('digital signature', 'key encipherment')
    - if empty
    - items:
    - description: 'KeyUsage specifies valid usage contexts for keys. See:
    - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12'
    - enum:
    - - signing
    - - digital signature
    - - content commitment
    - - key encipherment
    - - key agreement
    - - data encipherment
    - - cert sign
    - - crl sign
    - - encipher only
    - - decipher only
    - - any
    - - server auth
    - - client auth
    - - code signing
    - - email protection
    - - s/mime
    - - ipsec end system
    - - ipsec tunnel
    - - ipsec user
    - - timestamping
    - - ocsp signing
    - - microsoft sgc
    - - netscape sgc
    - type: string
    - type: array
    - required:
    - - issuerRef
    - - secretName
    - type: object
    - status:
    - description: CertificateStatus defines the observed state of Certificate
    - properties:
    - conditions:
    - items:
    - description: CertificateCondition contains condition information for
    - an Certificate.
    - properties:
    - lastTransitionTime:
    - description: LastTransitionTime is the timestamp corresponding
    - to the last status change of this condition.
    - format: date-time
    - type: string
    - message:
    - description: Message is a human readable description of the details
    - of the last transition, complementing reason.
    - type: string
    - reason:
    - description: Reason is a brief machine readable explanation for
    - the condition's last transition.
    - type: string
    - status:
    - description: Status of the condition, one of ('True', 'False',
    - 'Unknown').
    - enum:
    - - "True"
    - - "False"
    - - Unknown
    - type: string
    - type:
    - description: Type of the condition, currently ('Ready').
    - type: string
    - required:
    - - status
    - - type
    - type: object
    - type: array
    - lastFailureTime:
    - format: date-time
    - type: string
    - notAfter:
    - description: The expiration time of the certificate stored in the secret
    - named by this resource in spec.secretName.
    - format: date-time
    - type: string
    - type: object
    - type: object
    - version: v1alpha2
    - versions:
    - - name: v1alpha2
    - served: true
    - storage: true
    -status:
    - acceptedNames:
    - kind: ""
    - plural: ""
    - conditions: []
    - storedVersions: []
    ----
    -
    ----
    -apiVersion: apiextensions.k8s.io/v1beta1
    -kind: CustomResourceDefinition
    -metadata:
    - creationTimestamp: null
    - name: clusterissuers.cert-manager.io
    -spec:
    - group: cert-manager.io
    + preserveUnknownFields: false
    names:
    kind: ClusterIssuer
    listKind: ClusterIssuerList
    @@ -2044,6 +1898,7 @@
    status: {}
    validation:
    openAPIV3Schema:
    + type: object
    properties:
    apiVersion:
    description: 'APIVersion defines the versioned schema of this representation
    @@ -2060,16 +1915,66 @@
    spec:
    description: IssuerSpec is the specification of an Issuer. This includes
    any configuration required for the issuer.
    + type: object
    properties:
    acme:
    description: ACMEIssuer contains the specification for an ACME issuer
    + type: object
    + required:
    + - privateKeySecretRef
    + - server
    properties:
    email:
    description: Email is the email for this account
    type: string
    + externalAccountBinding:
    + description: ExternalAcccountBinding is a reference to a CA external
    + account of the ACME server.
    + type: object
    + required:
    + - keyAlgorithm
    + - keyID
    + - keySecretRef
    + properties:
    + keyAlgorithm:
    + description: keyAlgorithm is the MAC key algorithm that the
    + key is used for. Valid values are "HS256", "HS384" and "HS512".
    + type: string
    + enum:
    + - HS256
    + - HS384
    + - HS512
    + keyID:
    + description: keyID is the ID of the CA key that the External
    + Account is bound to.
    + type: string
    + keySecretRef:
    + description: keySecretRef is a Secret Key Selector referencing
    + a data item in a Kubernetes Secret which holds the symmetric
    + MAC key of the External Account Binding. The `key` is the
    + index string that is paired with the key data in the Secret
    + and should not be confused with the key data itself, or indeed
    + with the External Account Binding keyID above. The secret
    + key stored in the Secret **must** be un-padded, base64 URL
    + encoded data.
    + type: object
    + required:
    + - name
    + properties:
    + key:
    + description: The key of the secret to select from. Must
    + be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind, uid?'
    + type: string
    privateKeySecretRef:
    description: PrivateKey is the name of a secret containing the private
    key for this user account.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must be a
    @@ -2079,9 +1984,6 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    server:
    description: Server is the ACME server URL
    type: string
    @@ -2091,15 +1993,25 @@
    solvers:
    description: Solvers is a list of challenge solvers that will be
    used to solve ACME challenges for the matching domains.
    + type: array
    items:
    + type: object
    properties:
    dns01:
    + type: object
    properties:
    acmedns:
    description: ACMEIssuerDNS01ProviderAcmeDNS is a structure
    containing the configuration for ACME-DNS servers
    + type: object
    + required:
    + - accountSecretRef
    + - host
    properties:
    accountSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2111,21 +2023,23 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    host:
    type: string
    - required:
    - - accountSecretRef
    - - host
    - type: object
    akamai:
    description: ACMEIssuerDNS01ProviderAkamai is a structure
    containing the DNS configuration for Akamai DNS—Zone
    Record Management API
    + type: object
    + required:
    + - accessTokenSecretRef
    + - clientSecretSecretRef
    + - clientTokenSecretRef
    + - serviceConsumerDomain
    properties:
    accessTokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2137,25 +2051,10 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    + clientSecretSecretRef:
    + type: object
    required:
    - name
    - type: object
    - clientSecretSecretRef:
    - properties:
    - key:
    - description: The key of the secret to select from.
    - Must be a valid secret key.
    - type: string
    - name:
    - description: 'Name of the referent. More info:
    - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    - TODO: Add other useful fields. apiVersion, kind,
    - uid?'
    - type: string
    - required:
    - - name
    - type: object
    - clientTokenSecretRef:
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2167,24 +2066,40 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    + clientTokenSecretRef:
    + type: object
    required:
    - name
    - type: object
    + properties:
    + key:
    + description: The key of the secret to select from.
    + Must be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info:
    + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind,
    + uid?'
    + type: string
    serviceConsumerDomain:
    type: string
    - required:
    - - accessTokenSecretRef
    - - clientSecretSecretRef
    - - clientTokenSecretRef
    - - serviceConsumerDomain
    - type: object
    azuredns:
    description: ACMEIssuerDNS01ProviderAzureDNS is a structure
    containing the configuration for Azure DNS
    + type: object
    + required:
    + - clientID
    + - clientSecretSecretRef
    + - resourceGroupName
    + - subscriptionID
    + - tenantID
    properties:
    clientID:
    type: string
    clientSecretSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2196,16 +2111,13 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    environment:
    + type: string
    enum:
    - AzurePublicCloud
    - AzureChinaCloud
    - AzureGermanCloud
    - AzureUSGovernmentCloud
    - type: string
    hostedZoneName:
    type: string
    resourceGroupName:
    @@ -2214,20 +2126,19 @@
    type: string
    tenantID:
    type: string
    - required:
    - - clientID
    - - clientSecretSecretRef
    - - resourceGroupName
    - - subscriptionID
    - - tenantID
    - type: object
    clouddns:
    description: ACMEIssuerDNS01ProviderCloudDNS is a structure
    containing the DNS configuration for Google Cloud DNS
    + type: object
    + required:
    + - project
    properties:
    project:
    type: string
    serviceAccountSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2239,18 +2150,32 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - project
    - - serviceAccountSecretRef
    - type: object
    cloudflare:
    description: ACMEIssuerDNS01ProviderCloudflare is a structure
    containing the DNS configuration for Cloudflare
    + type: object
    + required:
    + - email
    properties:
    apiKeySecretRef:
    + type: object
    + required:
    + - name
    + properties:
    + key:
    + description: The key of the secret to select from.
    + Must be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info:
    + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind,
    + uid?'
    + type: string
    + apiTokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2262,28 +2187,27 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    email:
    type: string
    - required:
    - - apiKeySecretRef
    - - email
    - type: object
    cnameStrategy:
    description: CNAMEStrategy configures how the DNS01 provider
    should handle CNAME records when found in DNS zones.
    + type: string
    enum:
    - None
    - Follow
    - type: string
    digitalocean:
    description: ACMEIssuerDNS01ProviderDigitalOcean is a
    structure containing the DNS configuration for DigitalOcean
    Domains
    + type: object
    + required:
    + - tokenSecretRef
    properties:
    tokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2295,15 +2219,12 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - tokenSecretRef
    - type: object
    rfc2136:
    description: ACMEIssuerDNS01ProviderRFC2136 is a structure
    containing the configuration for RFC2136 DNS
    + type: object
    + required:
    + - nameserver
    properties:
    nameserver:
    description: 'The IP address of the DNS supporting
    @@ -2326,6 +2247,9 @@
    description: The name of the secret containing the
    TSIG value. If ``tsigKeyName`` is defined, this
    field is required.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2337,15 +2261,12 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - nameserver
    - type: object
    route53:
    description: ACMEIssuerDNS01ProviderRoute53 is a structure
    containing the Route 53 configuration for AWS
    + type: object
    + required:
    + - region
    properties:
    accessKeyID:
    description: 'The AccessKeyID is used for authentication.
    @@ -2372,6 +2293,9 @@
    description: The SecretAccessKey is used for authentication.
    If not set we fall-back to using env vars, shared
    credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -2383,16 +2307,14 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - region
    - type: object
    webhook:
    description: ACMEIssuerDNS01ProviderWebhook specifies
    configuration for a webhook DNS01 provider, including
    where to POST ChallengePayload resources.
    + type: object
    + required:
    + - groupName
    + - solverName
    properties:
    config:
    description: Additional configuration that should
    @@ -2416,11 +2338,6 @@
    in the webhook provider implementation. This will
    typically be the name of the provider, e.g. 'cloudflare'.
    type: string
    - required:
    - - groupName
    - - solverName
    - type: object
    - type: object
    http01:
    description: ACMEChallengeSolverHTTP01 contains configuration
    detailing how to solve HTTP01 challenges within a Kubernetes
    @@ -2428,6 +2345,7 @@
    'routes' of some description that configure ingress controllers
    to direct traffic to 'solver pods', which are responsible
    for responding to the ACME server's HTTP requests.
    + type: object
    properties:
    ingress:
    description: The ingress based HTTP01 challenge solver
    @@ -2435,6 +2353,7 @@
    resources in order to route requests for '/.well-known/acme-challenge/XYZ'
    to 'challenge solver' pods that are provisioned by cert-manager
    for each Challenge to be completed.
    + type: object
    properties:
    class:
    description: The ingress class to use when creating
    @@ -2453,6 +2372,7 @@
    podTemplate:
    description: Optional pod template used to configure
    the ACME challenge solver pods used for HTTP01 challenges
    + type: object
    properties:
    metadata:
    description: ObjectMeta overrides for the pod
    @@ -2461,19 +2381,35 @@
    or annotations overlap with in-built values,
    the values here will override the in-built values.
    type: object
    + properties:
    + annotations:
    + description: Annotations that should be added
    + to the create ACME HTTP01 solver pods.
    + type: object
    + additionalProperties:
    + type: string
    + labels:
    + description: Labels that should be added to
    + the created ACME HTTP01 solver pods.
    + type: object
    + additionalProperties:
    + type: string
    spec:
    description: PodSpec defines overrides for the
    HTTP01 challenge solver pod. Only the 'nodeSelector',
    'affinity' and 'tolerations' fields are supported
    currently. All other fields will be ignored.
    + type: object
    properties:
    affinity:
    description: If specified, the pod's scheduling
    constraints
    + type: object
    properties:
    nodeAffinity:
    description: Describes node affinity scheduling
    rules for the pod.
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer
    @@ -2494,6 +2430,7 @@
    corresponding matchExpressions;
    the node(s) with the highest sum
    are the most preferred.
    + type: array
    items:
    description: An empty preferred
    scheduling term matches all objects
    @@ -2501,16 +2438,22 @@
    a no-op). A null preferred scheduling
    term matches no objects (i.e.
    is also a no-op).
    + type: object
    + required:
    + - preference
    + - weight
    properties:
    preference:
    description: A node selector
    term, associated with the
    corresponding weight.
    + type: object
    properties:
    matchExpressions:
    description: A list of node
    selector requirements
    by node's labels.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -2518,6 +2461,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -2553,18 +2500,14 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchFields:
    description: A list of node
    selector requirements
    by node's fields.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -2572,6 +2515,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -2607,27 +2554,16 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    - type: object
    weight:
    description: Weight associated
    with matching the corresponding
    nodeSelectorTerm, in the range
    1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - preference
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the affinity requirements
    specified by this field are not
    @@ -2639,11 +2575,15 @@
    (e.g. due to an update), the system
    may or may not try to eventually
    evict the pod from its node.
    + type: object
    + required:
    + - nodeSelectorTerms
    properties:
    nodeSelectorTerms:
    description: Required. A list
    of node selector terms. The
    terms are ORed.
    + type: array
    items:
    description: A null or empty
    node selector term matches
    @@ -2651,11 +2591,13 @@
    of them are ANDed. The TopologySelectorTerm
    type implements a subset of
    the NodeSelectorTerm.
    + type: object
    properties:
    matchExpressions:
    description: A list of node
    selector requirements
    by node's labels.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -2663,6 +2605,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -2698,18 +2644,14 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchFields:
    description: A list of node
    selector requirements
    by node's fields.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -2717,6 +2659,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -2752,25 +2698,15 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    - type: object
    - type: array
    - required:
    - - nodeSelectorTerms
    - type: object
    - type: object
    podAffinity:
    description: Describes pod affinity scheduling
    rules (e.g. co-locate this pod in the
    same node, zone, etc. as some other
    pod(s)).
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer
    @@ -2791,21 +2727,30 @@
    which matches the corresponding
    podAffinityTerm; the node(s) with
    the highest sum are the most preferred.
    + type: array
    items:
    description: The weights of all
    of the matched WeightedPodAffinityTerm
    fields are added per-node to find
    the most preferred node(s)
    + type: object
    + required:
    + - podAffinityTerm
    + - weight
    properties:
    podAffinityTerm:
    description: Required. A pod
    affinity term, associated
    with the corresponding weight.
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query
    over a set of resources,
    in this case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    @@ -2813,6 +2758,7 @@
    selector requirements.
    The requirements are
    ANDed.
    + type: array
    items:
    description: A label
    selector requirement
    @@ -2821,6 +2767,10 @@
    a key, and an operator
    that relates the
    key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key
    @@ -2856,17 +2806,10 @@
    replaced during
    a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -2880,7 +2823,8 @@
    "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces
    specifies which namespaces
    @@ -2888,9 +2832,9 @@
    to (matches against);
    null or empty list means
    "this pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity)
    @@ -2907,21 +2851,13 @@
    is running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    weight:
    description: weight associated
    with matching the corresponding
    podAffinityTerm, in the range
    1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - podAffinityTerm
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the affinity requirements
    specified by this field are not
    @@ -2937,6 +2873,7 @@
    the lists of nodes corresponding
    to each podAffinityTerm are intersected,
    i.e. all terms must be satisfied.
    + type: array
    items:
    description: Defines a set of pods
    (namely those matching the labelSelector
    @@ -2948,17 +2885,22 @@
    of the label with key <topologyKey>
    matches that of any node on which
    a pod of the set of pods is running
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over
    a set of resources, in this
    case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    @@ -2966,6 +2908,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is
    @@ -2996,17 +2942,10 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -3019,16 +2958,17 @@
    only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against);
    null or empty list means "this
    pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity) or
    @@ -3044,16 +2984,12 @@
    running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    - type: array
    - type: object
    podAntiAffinity:
    description: Describes pod anti-affinity
    scheduling rules (e.g. avoid putting
    this pod in the same node, zone, etc.
    as some other pod(s)).
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer
    @@ -3074,21 +3010,30 @@
    has pods which matches the corresponding
    podAffinityTerm; the node(s) with
    the highest sum are the most preferred.
    + type: array
    items:
    description: The weights of all
    of the matched WeightedPodAffinityTerm
    fields are added per-node to find
    the most preferred node(s)
    + type: object
    + required:
    + - podAffinityTerm
    + - weight
    properties:
    podAffinityTerm:
    description: Required. A pod
    affinity term, associated
    with the corresponding weight.
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query
    over a set of resources,
    in this case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    @@ -3096,6 +3041,7 @@
    selector requirements.
    The requirements are
    ANDed.
    + type: array
    items:
    description: A label
    selector requirement
    @@ -3104,6 +3050,10 @@
    a key, and an operator
    that relates the
    key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key
    @@ -3139,17 +3089,10 @@
    replaced during
    a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -3163,7 +3106,8 @@
    "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces
    specifies which namespaces
    @@ -3171,9 +3115,9 @@
    to (matches against);
    null or empty list means
    "this pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity)
    @@ -3190,21 +3134,13 @@
    is running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    weight:
    description: weight associated
    with matching the corresponding
    podAffinityTerm, in the range
    1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - podAffinityTerm
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the anti-affinity
    requirements specified by this field
    @@ -3220,6 +3156,7 @@
    elements, the lists of nodes corresponding
    to each podAffinityTerm are intersected,
    i.e. all terms must be satisfied.
    + type: array
    items:
    description: Defines a set of pods
    (namely those matching the labelSelector
    @@ -3231,17 +3168,22 @@
    of the label with key <topologyKey>
    matches that of any node on which
    a pod of the set of pods is running
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over
    a set of resources, in this
    case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    @@ -3249,6 +3191,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is
    @@ -3279,17 +3225,10 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -3302,16 +3241,17 @@
    only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against);
    null or empty list means "this
    pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity) or
    @@ -3327,28 +3267,24 @@
    running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    - type: array
    - type: object
    - type: object
    nodeSelector:
    - additionalProperties:
    - type: string
    description: 'NodeSelector is a selector which
    must be true for the pod to fit on a node.
    Selector which must match a node''s labels
    for the pod to be scheduled on that node.
    More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
    type: object
    + additionalProperties:
    + type: string
    tolerations:
    description: If specified, the pod's tolerations.
    + type: array
    items:
    description: The pod this Toleration is
    attached to tolerates any taint that matches
    the triple <key,value,effect> using the
    matching operator <operator>.
    + type: object
    properties:
    effect:
    description: Effect indicates the taint
    @@ -3383,8 +3319,8 @@
    (do not evict). Zero and negative
    values will be treated as 0 (evict
    immediately) by the system.
    + type: integer
    format: int64
    - type: integer
    value:
    description: Value is the taint value
    the toleration matches to. If the
    @@ -3392,19 +3328,14 @@
    be empty, otherwise just a regular
    string.
    type: string
    - type: object
    - type: array
    - type: object
    - type: object
    serviceType:
    description: Optional service type for Kubernetes
    solver service
    type: string
    - type: object
    - type: object
    selector:
    description: Selector selects a set of DNSNames on the Certificate
    resource that should be solved using this challenge solver.
    + type: object
    properties:
    dnsNames:
    description: List of DNSNames that this solver will be
    @@ -3414,9 +3345,9 @@
    value, the solver with the most matching labels in matchLabels
    will be selected. If neither has more matches, the solver
    defined earlier in the list will be selected.
    + type: array
    items:
    type: string
    - type: array
    dnsZones:
    description: List of DNSZones that this solver will be
    used to solve. The most specific DNS zone match specified
    @@ -3427,41 +3358,45 @@
    the solver with the most matching labels in matchLabels
    will be selected. If neither has more matches, the solver
    defined earlier in the list will be selected.
    + type: array
    items:
    type: string
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: A label selector that is used to refine the
    set of certificate's that this challenge solver will
    apply to.
    type: object
    - type: object
    - type: object
    - type: array
    + additionalProperties:
    + type: string
    + ca:
    + type: object
    required:
    - - privateKeySecretRef
    - - server
    - type: object
    - ca:
    + - secretName
    properties:
    secretName:
    description: SecretName is the name of the secret used to sign Certificates
    issued by this Issuer.
    type: string
    - required:
    - - secretName
    - type: object
    selfSigned:
    type: object
    vault:
    + type: object
    + required:
    + - auth
    + - path
    + - server
    properties:
    auth:
    description: Vault authentication
    + type: object
    properties:
    appRole:
    description: This Secret contains a AppRole and Secret
    + type: object
    + required:
    + - path
    + - roleId
    + - secretRef
    properties:
    path:
    description: Where the authentication path is mounted in
    @@ -3470,6 +3405,9 @@
    roleId:
    type: string
    secretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -3479,24 +3417,20 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - path
    - - roleId
    - - secretRef
    - type: object
    kubernetes:
    description: This contains a Role and Secret with a ServiceAccount
    token to authenticate with vault.
    + type: object
    + required:
    + - role
    + - secretRef
    properties:
    mountPath:
    - description: The value here will be used as part of the
    - path used when authenticating with vault, for example
    - if you set a value of "foo", the path used will be `/v1/auth/foo/login`.
    - If unspecified, the default value "kubernetes" will be
    - used.
    + description: The Vault mountPath here is the mount path
    + to use when authenticating with Vault. For example, setting
    + a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login`
    + to authenticate with Vault. If unspecified, the default
    + value "/v1/auth/kubernetes" will be used.
    type: string
    role:
    description: A required field containing the Vault Role
    @@ -3507,6 +3441,9 @@
    description: The required Secret field containing a Kubernetes
    ServiceAccount JWT used for authenticating with Vault.
    Use of 'ambient credentials' is not supported.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -3516,15 +3453,11 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - role
    - - secretRef
    - type: object
    tokenSecretRef:
    description: This Secret contains the Vault token key
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -3534,39 +3467,40 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - type: object
    caBundle:
    description: Base64 encoded CA bundle to validate Vault server certificate.
    Only used if the Server URL is using HTTPS protocol. This parameter
    is ignored for plain HTTP protocol connection. If not set the
    system root certificates are used to validate the TLS connection.
    + type: string
    format: byte
    - type: string
    path:
    description: Vault URL path to the certificate role
    type: string
    server:
    description: Server is the vault connection address
    type: string
    - required:
    - - auth
    - - path
    - - server
    - type: object
    venafi:
    description: VenafiIssuer describes issuer configuration details for
    Venafi Cloud.
    + type: object
    + required:
    + - zone
    properties:
    cloud:
    description: Cloud specifies the Venafi cloud configuration settings.
    Only one of TPP or Cloud may be specified.
    + type: object
    + required:
    + - apiTokenSecretRef
    + - url
    properties:
    apiTokenSecretRef:
    description: APITokenSecretRef is a secret key selector for
    the Venafi Cloud API token.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -3576,19 +3510,16 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    url:
    description: URL is the base URL for Venafi Cloud
    type: string
    - required:
    - - apiTokenSecretRef
    - - url
    - type: object
    tpp:
    description: TPP specifies Trust Protection Platform configuration
    settings. Only one of TPP or Cloud may be specified.
    + type: object
    + required:
    + - credentialsRef
    + - url
    properties:
    caBundle:
    description: CABundle is a PEM encoded TLS certifiate to use
    @@ -3597,40 +3528,34 @@
    must be verifiable using the provided root. If not specified,
    the connection will be verified using the cert-manager system
    root certificates.
    + type: string
    format: byte
    - type: string
    credentialsRef:
    description: CredentialsRef is a reference to a Secret containing
    the username and password for the TPP server. The secret must
    contain two keys, 'username' and 'password'.
    + type: object
    + required:
    + - name
    properties:
    name:
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    url:
    description: URL is the base URL for the Venafi TPP instance
    type: string
    - required:
    - - credentialsRef
    - - url
    - type: object
    zone:
    description: Zone is the Venafi Policy Zone to use for this issuer.
    All requests made to the Venafi platform will be restricted by
    the named zone policy. This field is required.
    type: string
    - required:
    - - zone
    - type: object
    - type: object
    status:
    description: IssuerStatus contains status information about an Issuer
    + type: object
    properties:
    acme:
    + type: object
    properties:
    lastRegisteredEmail:
    description: LastRegisteredEmail is the email associated with the
    @@ -3641,17 +3566,21 @@
    description: URI is the unique account identifier, which can also
    be used to retrieve account details from the CA
    type: string
    - type: object
    conditions:
    + type: array
    items:
    description: IssuerCondition contains condition information for an
    Issuer.
    + type: object
    + required:
    + - status
    + - type
    properties:
    lastTransitionTime:
    description: LastTransitionTime is the timestamp corresponding
    to the last status change of this condition.
    + type: string
    format: date-time
    - type: string
    message:
    description: Message is a human readable description of the details
    of the last transition, complementing reason.
    @@ -3663,42 +3592,42 @@
    status:
    description: Status of the condition, one of ('True', 'False',
    'Unknown').
    + type: string
    enum:
    - "True"
    - "False"
    - Unknown
    - type: string
    type:
    description: Type of the condition, currently ('Ready').
    type: string
    - required:
    - - status
    - - type
    - type: object
    - type: array
    - type: object
    - type: object
    version: v1alpha2
    versions:
    - name: v1alpha2
    served: true
    storage: true
    -status:
    - acceptedNames:
    - kind: ""
    - plural: ""
    - conditions: []
    - storedVersions: []
    ----
    -
    ---
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    - creationTimestamp: null
    name: issuers.cert-manager.io
    spec:
    + additionalPrinterColumns:
    + - JSONPath: .status.conditions[?(@.type=="Ready")].status
    + name: Ready
    + type: string
    + - JSONPath: .status.conditions[?(@.type=="Ready")].message
    + name: Status
    + priority: 1
    + type: string
    + - JSONPath: .metadata.creationTimestamp
    + description: CreationTimestamp is a timestamp representing the server time when
    + this object was created. It is not guaranteed to be set in happens-before order
    + across separate operations. Clients may not set this value. It is represented
    + in RFC3339 form and is in UTC.
    + name: Age
    + type: date
    group: cert-manager.io
    + preserveUnknownFields: false
    names:
    kind: Issuer
    listKind: IssuerList
    @@ -3709,6 +3638,7 @@
    status: {}
    validation:
    openAPIV3Schema:
    + type: object
    properties:
    apiVersion:
    description: 'APIVersion defines the versioned schema of this representation
    @@ -3725,16 +3655,66 @@
    spec:
    description: IssuerSpec is the specification of an Issuer. This includes
    any configuration required for the issuer.
    + type: object
    properties:
    acme:
    description: ACMEIssuer contains the specification for an ACME issuer
    + type: object
    + required:
    + - privateKeySecretRef
    + - server
    properties:
    email:
    description: Email is the email for this account
    type: string
    + externalAccountBinding:
    + description: ExternalAcccountBinding is a reference to a CA external
    + account of the ACME server.
    + type: object
    + required:
    + - keyAlgorithm
    + - keyID
    + - keySecretRef
    + properties:
    + keyAlgorithm:
    + description: keyAlgorithm is the MAC key algorithm that the
    + key is used for. Valid values are "HS256", "HS384" and "HS512".
    + type: string
    + enum:
    + - HS256
    + - HS384
    + - HS512
    + keyID:
    + description: keyID is the ID of the CA key that the External
    + Account is bound to.
    + type: string
    + keySecretRef:
    + description: keySecretRef is a Secret Key Selector referencing
    + a data item in a Kubernetes Secret which holds the symmetric
    + MAC key of the External Account Binding. The `key` is the
    + index string that is paired with the key data in the Secret
    + and should not be confused with the key data itself, or indeed
    + with the External Account Binding keyID above. The secret
    + key stored in the Secret **must** be un-padded, base64 URL
    + encoded data.
    + type: object
    + required:
    + - name
    + properties:
    + key:
    + description: The key of the secret to select from. Must
    + be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind, uid?'
    + type: string
    privateKeySecretRef:
    description: PrivateKey is the name of a secret containing the private
    key for this user account.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must be a
    @@ -3744,9 +3724,6 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    server:
    description: Server is the ACME server URL
    type: string
    @@ -3756,15 +3733,25 @@
    solvers:
    description: Solvers is a list of challenge solvers that will be
    used to solve ACME challenges for the matching domains.
    + type: array
    items:
    + type: object
    properties:
    dns01:
    + type: object
    properties:
    acmedns:
    description: ACMEIssuerDNS01ProviderAcmeDNS is a structure
    containing the configuration for ACME-DNS servers
    + type: object
    + required:
    + - accountSecretRef
    + - host
    properties:
    accountSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3776,21 +3763,23 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    host:
    type: string
    - required:
    - - accountSecretRef
    - - host
    - type: object
    akamai:
    description: ACMEIssuerDNS01ProviderAkamai is a structure
    containing the DNS configuration for Akamai DNS—Zone
    Record Management API
    + type: object
    + required:
    + - accessTokenSecretRef
    + - clientSecretSecretRef
    + - clientTokenSecretRef
    + - serviceConsumerDomain
    properties:
    accessTokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3802,25 +3791,10 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    + clientSecretSecretRef:
    + type: object
    required:
    - name
    - type: object
    - clientSecretSecretRef:
    - properties:
    - key:
    - description: The key of the secret to select from.
    - Must be a valid secret key.
    - type: string
    - name:
    - description: 'Name of the referent. More info:
    - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    - TODO: Add other useful fields. apiVersion, kind,
    - uid?'
    - type: string
    - required:
    - - name
    - type: object
    - clientTokenSecretRef:
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3832,24 +3806,40 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    + clientTokenSecretRef:
    + type: object
    required:
    - name
    - type: object
    + properties:
    + key:
    + description: The key of the secret to select from.
    + Must be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info:
    + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind,
    + uid?'
    + type: string
    serviceConsumerDomain:
    type: string
    - required:
    - - accessTokenSecretRef
    - - clientSecretSecretRef
    - - clientTokenSecretRef
    - - serviceConsumerDomain
    - type: object
    azuredns:
    description: ACMEIssuerDNS01ProviderAzureDNS is a structure
    containing the configuration for Azure DNS
    + type: object
    + required:
    + - clientID
    + - clientSecretSecretRef
    + - resourceGroupName
    + - subscriptionID
    + - tenantID
    properties:
    clientID:
    type: string
    clientSecretSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3861,16 +3851,13 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    environment:
    + type: string
    enum:
    - AzurePublicCloud
    - AzureChinaCloud
    - AzureGermanCloud
    - AzureUSGovernmentCloud
    - type: string
    hostedZoneName:
    type: string
    resourceGroupName:
    @@ -3879,20 +3866,19 @@
    type: string
    tenantID:
    type: string
    - required:
    - - clientID
    - - clientSecretSecretRef
    - - resourceGroupName
    - - subscriptionID
    - - tenantID
    - type: object
    clouddns:
    description: ACMEIssuerDNS01ProviderCloudDNS is a structure
    containing the DNS configuration for Google Cloud DNS
    + type: object
    + required:
    + - project
    properties:
    project:
    type: string
    serviceAccountSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3904,18 +3890,32 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - project
    - - serviceAccountSecretRef
    - type: object
    cloudflare:
    description: ACMEIssuerDNS01ProviderCloudflare is a structure
    containing the DNS configuration for Cloudflare
    + type: object
    + required:
    + - email
    properties:
    apiKeySecretRef:
    + type: object
    + required:
    + - name
    + properties:
    + key:
    + description: The key of the secret to select from.
    + Must be a valid secret key.
    + type: string
    + name:
    + description: 'Name of the referent. More info:
    + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    + TODO: Add other useful fields. apiVersion, kind,
    + uid?'
    + type: string
    + apiTokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3927,28 +3927,27 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    email:
    type: string
    - required:
    - - apiKeySecretRef
    - - email
    - type: object
    cnameStrategy:
    description: CNAMEStrategy configures how the DNS01 provider
    should handle CNAME records when found in DNS zones.
    + type: string
    enum:
    - None
    - Follow
    - type: string
    digitalocean:
    description: ACMEIssuerDNS01ProviderDigitalOcean is a
    structure containing the DNS configuration for DigitalOcean
    Domains
    + type: object
    + required:
    + - tokenSecretRef
    properties:
    tokenSecretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -3960,15 +3959,12 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - tokenSecretRef
    - type: object
    rfc2136:
    description: ACMEIssuerDNS01ProviderRFC2136 is a structure
    containing the configuration for RFC2136 DNS
    + type: object
    + required:
    + - nameserver
    properties:
    nameserver:
    description: 'The IP address of the DNS supporting
    @@ -3991,6 +3987,9 @@
    description: The name of the secret containing the
    TSIG value. If ``tsigKeyName`` is defined, this
    field is required.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -4002,15 +4001,12 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - nameserver
    - type: object
    route53:
    description: ACMEIssuerDNS01ProviderRoute53 is a structure
    containing the Route 53 configuration for AWS
    + type: object
    + required:
    + - region
    properties:
    accessKeyID:
    description: 'The AccessKeyID is used for authentication.
    @@ -4037,6 +4033,9 @@
    description: The SecretAccessKey is used for authentication.
    If not set we fall-back to using env vars, shared
    credentials file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from.
    @@ -4048,16 +4047,14 @@
    TODO: Add other useful fields. apiVersion, kind,
    uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - region
    - type: object
    webhook:
    description: ACMEIssuerDNS01ProviderWebhook specifies
    configuration for a webhook DNS01 provider, including
    where to POST ChallengePayload resources.
    + type: object
    + required:
    + - groupName
    + - solverName
    properties:
    config:
    description: Additional configuration that should
    @@ -4081,11 +4078,6 @@
    in the webhook provider implementation. This will
    typically be the name of the provider, e.g. 'cloudflare'.
    type: string
    - required:
    - - groupName
    - - solverName
    - type: object
    - type: object
    http01:
    description: ACMEChallengeSolverHTTP01 contains configuration
    detailing how to solve HTTP01 challenges within a Kubernetes
    @@ -4093,6 +4085,7 @@
    'routes' of some description that configure ingress controllers
    to direct traffic to 'solver pods', which are responsible
    for responding to the ACME server's HTTP requests.
    + type: object
    properties:
    ingress:
    description: The ingress based HTTP01 challenge solver
    @@ -4100,6 +4093,7 @@
    resources in order to route requests for '/.well-known/acme-challenge/XYZ'
    to 'challenge solver' pods that are provisioned by cert-manager
    for each Challenge to be completed.
    + type: object
    properties:
    class:
    description: The ingress class to use when creating
    @@ -4118,6 +4112,7 @@
    podTemplate:
    description: Optional pod template used to configure
    the ACME challenge solver pods used for HTTP01 challenges
    + type: object
    properties:
    metadata:
    description: ObjectMeta overrides for the pod
    @@ -4126,19 +4121,35 @@
    or annotations overlap with in-built values,
    the values here will override the in-built values.
    type: object
    + properties:
    + annotations:
    + description: Annotations that should be added
    + to the create ACME HTTP01 solver pods.
    + type: object
    + additionalProperties:
    + type: string
    + labels:
    + description: Labels that should be added to
    + the created ACME HTTP01 solver pods.
    + type: object
    + additionalProperties:
    + type: string
    spec:
    description: PodSpec defines overrides for the
    HTTP01 challenge solver pod. Only the 'nodeSelector',
    'affinity' and 'tolerations' fields are supported
    currently. All other fields will be ignored.
    + type: object
    properties:
    affinity:
    description: If specified, the pod's scheduling
    constraints
    + type: object
    properties:
    nodeAffinity:
    description: Describes node affinity scheduling
    rules for the pod.
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer
    @@ -4159,6 +4170,7 @@
    corresponding matchExpressions;
    the node(s) with the highest sum
    are the most preferred.
    + type: array
    items:
    description: An empty preferred
    scheduling term matches all objects
    @@ -4166,16 +4178,22 @@
    a no-op). A null preferred scheduling
    term matches no objects (i.e.
    is also a no-op).
    + type: object
    + required:
    + - preference
    + - weight
    properties:
    preference:
    description: A node selector
    term, associated with the
    corresponding weight.
    + type: object
    properties:
    matchExpressions:
    description: A list of node
    selector requirements
    by node's labels.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -4183,6 +4201,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -4218,18 +4240,14 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchFields:
    description: A list of node
    selector requirements
    by node's fields.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -4237,6 +4255,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -4272,27 +4294,16 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    - type: object
    weight:
    description: Weight associated
    with matching the corresponding
    nodeSelectorTerm, in the range
    1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - preference
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the affinity requirements
    specified by this field are not
    @@ -4304,11 +4315,15 @@
    (e.g. due to an update), the system
    may or may not try to eventually
    evict the pod from its node.
    + type: object
    + required:
    + - nodeSelectorTerms
    properties:
    nodeSelectorTerms:
    description: Required. A list
    of node selector terms. The
    terms are ORed.
    + type: array
    items:
    description: A null or empty
    node selector term matches
    @@ -4316,11 +4331,13 @@
    of them are ANDed. The TopologySelectorTerm
    type implements a subset of
    the NodeSelectorTerm.
    + type: object
    properties:
    matchExpressions:
    description: A list of node
    selector requirements
    by node's labels.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -4328,6 +4345,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -4363,18 +4384,14 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchFields:
    description: A list of node
    selector requirements
    by node's fields.
    + type: array
    items:
    description: A node selector
    requirement is a selector
    @@ -4382,6 +4399,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: The label
    @@ -4417,25 +4438,15 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    - type: object
    - type: array
    - required:
    - - nodeSelectorTerms
    - type: object
    - type: object
    podAffinity:
    description: Describes pod affinity scheduling
    rules (e.g. co-locate this pod in the
    same node, zone, etc. as some other
    pod(s)).
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer
    @@ -4456,21 +4467,30 @@
    which matches the corresponding
    podAffinityTerm; the node(s) with
    the highest sum are the most preferred.
    + type: array
    items:
    description: The weights of all
    of the matched WeightedPodAffinityTerm
    fields are added per-node to find
    the most preferred node(s)
    + type: object
    + required:
    + - podAffinityTerm
    + - weight
    properties:
    podAffinityTerm:
    description: Required. A pod
    affinity term, associated
    with the corresponding weight.
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query
    over a set of resources,
    in this case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    @@ -4478,6 +4498,7 @@
    selector requirements.
    The requirements are
    ANDed.
    + type: array
    items:
    description: A label
    selector requirement
    @@ -4486,6 +4507,10 @@
    a key, and an operator
    that relates the
    key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key
    @@ -4521,17 +4546,10 @@
    replaced during
    a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -4545,7 +4563,8 @@
    "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces
    specifies which namespaces
    @@ -4553,9 +4572,9 @@
    to (matches against);
    null or empty list means
    "this pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity)
    @@ -4572,21 +4591,13 @@
    is running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    weight:
    description: weight associated
    with matching the corresponding
    podAffinityTerm, in the range
    1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - podAffinityTerm
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the affinity requirements
    specified by this field are not
    @@ -4602,6 +4613,7 @@
    the lists of nodes corresponding
    to each podAffinityTerm are intersected,
    i.e. all terms must be satisfied.
    + type: array
    items:
    description: Defines a set of pods
    (namely those matching the labelSelector
    @@ -4613,17 +4625,22 @@
    of the label with key <topologyKey>
    matches that of any node on which
    a pod of the set of pods is running
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over
    a set of resources, in this
    case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    @@ -4631,6 +4648,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is
    @@ -4661,17 +4682,10 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -4684,16 +4698,17 @@
    only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against);
    null or empty list means "this
    pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity) or
    @@ -4709,16 +4724,12 @@
    running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    - type: array
    - type: object
    podAntiAffinity:
    description: Describes pod anti-affinity
    scheduling rules (e.g. avoid putting
    this pod in the same node, zone, etc.
    as some other pod(s)).
    + type: object
    properties:
    preferredDuringSchedulingIgnoredDuringExecution:
    description: The scheduler will prefer
    @@ -4739,21 +4750,30 @@
    has pods which matches the corresponding
    podAffinityTerm; the node(s) with
    the highest sum are the most preferred.
    + type: array
    items:
    description: The weights of all
    of the matched WeightedPodAffinityTerm
    fields are added per-node to find
    the most preferred node(s)
    + type: object
    + required:
    + - podAffinityTerm
    + - weight
    properties:
    podAffinityTerm:
    description: Required. A pod
    affinity term, associated
    with the corresponding weight.
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query
    over a set of resources,
    in this case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    @@ -4761,6 +4781,7 @@
    selector requirements.
    The requirements are
    ANDed.
    + type: array
    items:
    description: A label
    selector requirement
    @@ -4769,6 +4790,10 @@
    a key, and an operator
    that relates the
    key and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key
    @@ -4804,17 +4829,10 @@
    replaced during
    a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -4828,7 +4846,8 @@
    "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces
    specifies which namespaces
    @@ -4836,9 +4855,9 @@
    to (matches against);
    null or empty list means
    "this pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity)
    @@ -4855,21 +4874,13 @@
    is running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    weight:
    description: weight associated
    with matching the corresponding
    podAffinityTerm, in the range
    1-100.
    + type: integer
    format: int32
    - type: integer
    - required:
    - - podAffinityTerm
    - - weight
    - type: object
    - type: array
    requiredDuringSchedulingIgnoredDuringExecution:
    description: If the anti-affinity
    requirements specified by this field
    @@ -4885,6 +4896,7 @@
    elements, the lists of nodes corresponding
    to each podAffinityTerm are intersected,
    i.e. all terms must be satisfied.
    + type: array
    items:
    description: Defines a set of pods
    (namely those matching the labelSelector
    @@ -4896,17 +4908,22 @@
    of the label with key <topologyKey>
    matches that of any node on which
    a pod of the set of pods is running
    + type: object
    + required:
    + - topologyKey
    properties:
    labelSelector:
    description: A label query over
    a set of resources, in this
    case pods.
    + type: object
    properties:
    matchExpressions:
    description: matchExpressions
    is a list of label selector
    requirements. The requirements
    are ANDed.
    + type: array
    items:
    description: A label selector
    requirement is a selector
    @@ -4914,6 +4931,10 @@
    a key, and an operator
    that relates the key
    and values.
    + type: object
    + required:
    + - key
    + - operator
    properties:
    key:
    description: key is
    @@ -4944,17 +4965,10 @@
    array is replaced
    during a strategic
    merge patch.
    + type: array
    items:
    type: string
    - type: array
    - required:
    - - key
    - - operator
    - type: object
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: matchLabels
    is a map of {key,value}
    pairs. A single {key,value}
    @@ -4967,16 +4981,17 @@
    only "value". The requirements
    are ANDed.
    type: object
    - type: object
    + additionalProperties:
    + type: string
    namespaces:
    description: namespaces specifies
    which namespaces the labelSelector
    applies to (matches against);
    null or empty list means "this
    pod's namespace"
    + type: array
    items:
    type: string
    - type: array
    topologyKey:
    description: This pod should
    be co-located (affinity) or
    @@ -4992,28 +5007,24 @@
    running. Empty topologyKey
    is not allowed.
    type: string
    - required:
    - - topologyKey
    - type: object
    - type: array
    - type: object
    - type: object
    nodeSelector:
    - additionalProperties:
    - type: string
    description: 'NodeSelector is a selector which
    must be true for the pod to fit on a node.
    Selector which must match a node''s labels
    for the pod to be scheduled on that node.
    More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/'
    type: object
    + additionalProperties:
    + type: string
    tolerations:
    description: If specified, the pod's tolerations.
    + type: array
    items:
    description: The pod this Toleration is
    attached to tolerates any taint that matches
    the triple <key,value,effect> using the
    matching operator <operator>.
    + type: object
    properties:
    effect:
    description: Effect indicates the taint
    @@ -5048,8 +5059,8 @@
    (do not evict). Zero and negative
    values will be treated as 0 (evict
    immediately) by the system.
    + type: integer
    format: int64
    - type: integer
    value:
    description: Value is the taint value
    the toleration matches to. If the
    @@ -5057,19 +5068,14 @@
    be empty, otherwise just a regular
    string.
    type: string
    - type: object
    - type: array
    - type: object
    - type: object
    serviceType:
    description: Optional service type for Kubernetes
    solver service
    type: string
    - type: object
    - type: object
    selector:
    description: Selector selects a set of DNSNames on the Certificate
    resource that should be solved using this challenge solver.
    + type: object
    properties:
    dnsNames:
    description: List of DNSNames that this solver will be
    @@ -5079,9 +5085,9 @@
    value, the solver with the most matching labels in matchLabels
    will be selected. If neither has more matches, the solver
    defined earlier in the list will be selected.
    + type: array
    items:
    type: string
    - type: array
    dnsZones:
    description: List of DNSZones that this solver will be
    used to solve. The most specific DNS zone match specified
    @@ -5092,41 +5098,45 @@
    the solver with the most matching labels in matchLabels
    will be selected. If neither has more matches, the solver
    defined earlier in the list will be selected.
    + type: array
    items:
    type: string
    - type: array
    matchLabels:
    - additionalProperties:
    - type: string
    description: A label selector that is used to refine the
    set of certificate's that this challenge solver will
    apply to.
    type: object
    - type: object
    - type: object
    - type: array
    + additionalProperties:
    + type: string
    + ca:
    + type: object
    required:
    - - privateKeySecretRef
    - - server
    - type: object
    - ca:
    + - secretName
    properties:
    secretName:
    description: SecretName is the name of the secret used to sign Certificates
    issued by this Issuer.
    type: string
    - required:
    - - secretName
    - type: object
    selfSigned:
    type: object
    vault:
    + type: object
    + required:
    + - auth
    + - path
    + - server
    properties:
    auth:
    description: Vault authentication
    + type: object
    properties:
    appRole:
    description: This Secret contains a AppRole and Secret
    + type: object
    + required:
    + - path
    + - roleId
    + - secretRef
    properties:
    path:
    description: Where the authentication path is mounted in
    @@ -5135,6 +5145,9 @@
    roleId:
    type: string
    secretRef:
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -5144,24 +5157,20 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - path
    - - roleId
    - - secretRef
    - type: object
    kubernetes:
    description: This contains a Role and Secret with a ServiceAccount
    token to authenticate with vault.
    + type: object
    + required:
    + - role
    + - secretRef
    properties:
    mountPath:
    - description: The value here will be used as part of the
    - path used when authenticating with vault, for example
    - if you set a value of "foo", the path used will be `/v1/auth/foo/login`.
    - If unspecified, the default value "kubernetes" will be
    - used.
    + description: The Vault mountPath here is the mount path
    + to use when authenticating with Vault. For example, setting
    + a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login`
    + to authenticate with Vault. If unspecified, the default
    + value "/v1/auth/kubernetes" will be used.
    type: string
    role:
    description: A required field containing the Vault Role
    @@ -5172,6 +5181,9 @@
    description: The required Secret field containing a Kubernetes
    ServiceAccount JWT used for authenticating with Vault.
    Use of 'ambient credentials' is not supported.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -5181,15 +5193,11 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - required:
    - - role
    - - secretRef
    - type: object
    tokenSecretRef:
    description: This Secret contains the Vault token key
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -5199,39 +5207,40 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    - type: object
    caBundle:
    description: Base64 encoded CA bundle to validate Vault server certificate.
    Only used if the Server URL is using HTTPS protocol. This parameter
    is ignored for plain HTTP protocol connection. If not set the
    system root certificates are used to validate the TLS connection.
    + type: string
    format: byte
    - type: string
    path:
    description: Vault URL path to the certificate role
    type: string
    server:
    description: Server is the vault connection address
    type: string
    - required:
    - - auth
    - - path
    - - server
    - type: object
    venafi:
    description: VenafiIssuer describes issuer configuration details for
    Venafi Cloud.
    + type: object
    + required:
    + - zone
    properties:
    cloud:
    description: Cloud specifies the Venafi cloud configuration settings.
    Only one of TPP or Cloud may be specified.
    + type: object
    + required:
    + - apiTokenSecretRef
    + - url
    properties:
    apiTokenSecretRef:
    description: APITokenSecretRef is a secret key selector for
    the Venafi Cloud API token.
    + type: object
    + required:
    + - name
    properties:
    key:
    description: The key of the secret to select from. Must
    @@ -5241,19 +5250,16 @@
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    url:
    description: URL is the base URL for Venafi Cloud
    type: string
    - required:
    - - apiTokenSecretRef
    - - url
    - type: object
    tpp:
    description: TPP specifies Trust Protection Platform configuration
    settings. Only one of TPP or Cloud may be specified.
    + type: object
    + required:
    + - credentialsRef
    + - url
    properties:
    caBundle:
    description: CABundle is a PEM encoded TLS certifiate to use
    @@ -5262,40 +5268,34 @@
    must be verifiable using the provided root. If not specified,
    the connection will be verified using the cert-manager system
    root certificates.
    + type: string
    format: byte
    - type: string
    credentialsRef:
    description: CredentialsRef is a reference to a Secret containing
    the username and password for the TPP server. The secret must
    contain two keys, 'username' and 'password'.
    + type: object
    + required:
    + - name
    properties:
    name:
    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    TODO: Add other useful fields. apiVersion, kind, uid?'
    type: string
    - required:
    - - name
    - type: object
    url:
    description: URL is the base URL for the Venafi TPP instance
    type: string
    - required:
    - - credentialsRef
    - - url
    - type: object
    zone:
    description: Zone is the Venafi Policy Zone to use for this issuer.
    All requests made to the Venafi platform will be restricted by
    the named zone policy. This field is required.
    type: string
    - required:
    - - zone
    - type: object
    - type: object
    status:
    description: IssuerStatus contains status information about an Issuer
    + type: object
    properties:
    acme:
    + type: object
    properties:
    lastRegisteredEmail:
    description: LastRegisteredEmail is the email associated with the
    @@ -5306,17 +5306,21 @@
    description: URI is the unique account identifier, which can also
    be used to retrieve account details from the CA
    type: string
    - type: object
    conditions:
    + type: array
    items:
    description: IssuerCondition contains condition information for an
    Issuer.
    + type: object
    + required:
    + - status
    + - type
    properties:
    lastTransitionTime:
    description: LastTransitionTime is the timestamp corresponding
    to the last status change of this condition.
    + type: string
    format: date-time
    - type: string
    message:
    description: Message is a human readable description of the details
    of the last transition, complementing reason.
    @@ -5328,41 +5332,229 @@
    status:
    description: Status of the condition, one of ('True', 'False',
    'Unknown').
    + type: string
    enum:
    - "True"
    - "False"
    - Unknown
    - type: string
    type:
    description: Type of the condition, currently ('Ready').
    type: string
    - required:
    - - status
    - - type
    - type: object
    - type: array
    - type: object
    - type: object
    version: v1alpha2
    versions:
    - name: v1alpha2
    served: true
    storage: true
    -status:
    - acceptedNames:
    - kind: ""
    - plural: ""
    - conditions: []
    - storedVersions: []
    +---
    +apiVersion: apiextensions.k8s.io/v1beta1
    +kind: CustomResourceDefinition
    +metadata:
    + name: orders.acme.cert-manager.io
    +spec:
    + additionalPrinterColumns:
    + - JSONPath: .status.state
    + name: State
    + type: string
    + - JSONPath: .spec.issuerRef.name
    + name: Issuer
    + priority: 1
    + type: string
    + - JSONPath: .status.reason
    + name: Reason
    + priority: 1
    + type: string
    + - JSONPath: .metadata.creationTimestamp
    + description: CreationTimestamp is a timestamp representing the server time when
    + this object was created. It is not guaranteed to be set in happens-before order
    + across separate operations. Clients may not set this value. It is represented
    + in RFC3339 form and is in UTC.
    + name: Age
    + type: date
    + group: acme.cert-manager.io
    + preserveUnknownFields: false
    + names:
    + kind: Order
    + listKind: OrderList
    + plural: orders
    + singular: order
    + scope: Namespaced
    + subresources:
    + status: {}
    + validation:
    + openAPIV3Schema:
    + description: Order is a type to represent an Order with an ACME server
    + type: object
    + required:
    + - metadata
    + properties:
    + apiVersion:
    + description: 'APIVersion defines the versioned schema of this representation
    + of an object. Servers should convert recognized schemas to the latest
    + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
    + type: string
    + kind:
    + description: 'Kind is a string value representing the REST resource this
    + object represents. Servers may infer this from the endpoint the client
    + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
    + type: string
    + metadata:
    + type: object
    + spec:
    + type: object
    + required:
    + - csr
    + - issuerRef
    + properties:
    + commonName:
    + description: CommonName is the common name as specified on the DER encoded
    + CSR. If CommonName is not specified, the first DNSName specified will
    + be used as the CommonName. At least one of CommonName or a DNSNames
    + must be set. This field must match the corresponding field on the
    + DER encoded CSR.
    + type: string
    + csr:
    + description: Certificate signing request bytes in DER encoding. This
    + will be used when finalizing the order. This field must be set on
    + the order.
    + type: string
    + format: byte
    + dnsNames:
    + description: DNSNames is a list of DNS names that should be included
    + as part of the Order validation process. If CommonName is not specified,
    + the first DNSName specified will be used as the CommonName. At least
    + one of CommonName or a DNSNames must be set. This field must match
    + the corresponding field on the DER encoded CSR.
    + type: array
    + items:
    + type: string
    + issuerRef:
    + description: IssuerRef references a properly configured ACME-type Issuer
    + which should be used to create this Order. If the Issuer does not
    + exist, processing will be retried. If the Issuer is not an 'ACME'
    + Issuer, an error will be returned and the Order will be marked as
    + failed.
    + type: object
    + required:
    + - name
    + properties:
    + group:
    + type: string
    + kind:
    + type: string
    + name:
    + type: string
    + status:
    + type: object
    + properties:
    + authorizations:
    + description: Authorizations contains data returned from the ACME server
    + on what authoriations must be completed in order to validate the DNS
    + names specified on the Order.
    + type: array
    + items:
    + description: ACMEAuthorization contains data returned from the ACME
    + server on an authorization that must be completed in order validate
    + a DNS name on an ACME Order resource.
    + type: object
    + required:
    + - url
    + properties:
    + challenges:
    + description: Challenges specifies the challenge types offered
    + by the ACME server. One of these challenge types will be selected
    + when validating the DNS name and an appropriate Challenge resource
    + will be created to perform the ACME challenge process.
    + type: array
    + items:
    + description: Challenge specifies a challenge offered by the
    + ACME server for an Order. An appropriate Challenge resource
    + can be created to perform the ACME challenge process.
    + type: object
    + required:
    + - token
    + - type
    + - url
    + properties:
    + token:
    + description: Token is the token that must be presented for
    + this challenge. This is used to compute the 'key' that
    + must also be presented.
    + type: string
    + type:
    + description: Type is the type of challenge being offered,
    + e.g. http-01, dns-01
    + type: string
    + url:
    + description: URL is the URL of this challenge. It can be
    + used to retrieve additional metadata about the Challenge
    + from the ACME server.
    + type: string
    + identifier:
    + description: Identifier is the DNS name to be validated as part
    + of this authorization
    + type: string
    + url:
    + description: URL is the URL of the Authorization that must be
    + completed
    + type: string
    + wildcard:
    + description: Wildcard will be true if this authorization is for
    + a wildcard DNS name. If this is true, the identifier will be
    + the *non-wildcard* version of the DNS name. For example, if
    + '*.example.com' is the DNS name being validated, this field
    + will be 'true' and the 'identifier' field will be 'example.com'.
    + type: boolean
    + certificate:
    + description: Certificate is a copy of the PEM encoded certificate for
    + this Order. This field will be populated after the order has been
    + successfully finalized with the ACME server, and the order has transitioned
    + to the 'valid' state.
    + type: string
    + format: byte
    + failureTime:
    + description: FailureTime stores the time that this order failed. This
    + is used to influence garbage collection and back-off.
    + type: string
    + format: date-time
    + finalizeURL:
    + description: FinalizeURL of the Order. This is used to obtain certificates
    + for this order once it has been completed.
    + type: string
    + reason:
    + description: Reason optionally provides more information about a why
    + the order is in the current state.
    + type: string
    + state:
    + description: State contains the current state of this Order resource.
    + States 'success' and 'expired' are 'final'
    + type: string
    + enum:
    + - valid
    + - ready
    + - pending
    + - processing
    + - invalid
    + - expired
    + - errored
    + url:
    + description: URL of the Order. This will initially be empty when the
    + resource is first created. The Order controller will populate this
    + field when the Order is first processed. This field will be immutable
    + after it is initially set.
    + type: string
    + version: v1alpha2
    + versions:
    + - name: v1alpha2
    + served: true
    + storage: true
    +---
    ---
    apiVersion: v1
    kind: Namespace
    metadata:
    name: cert-manager
    -
    ---
    ----
    -# Source: cert-manager/charts/cainjector/templates/serviceaccount.yaml
    +# Source: cert-manager/templates/cainjector-serviceaccount.yaml
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    @@ -5371,9 +5563,9 @@
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    ---
    # Source: cert-manager/templates/serviceaccount.yaml
    @@ -5386,9 +5578,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    ---
    # Source: cert-manager/templates/webhook-serviceaccount.yaml
    @@ -5400,11 +5592,11 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    ---
    -# Source: cert-manager/charts/cainjector/templates/rbac.yaml
    +# Source: cert-manager/templates/cainjector-rbac.yaml
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRole
    metadata:
    @@ -5412,9 +5604,9 @@
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups: ["cert-manager.io"]
    resources: ["certificates"]
    @@ -5442,9 +5634,9 @@
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5464,9 +5656,9 @@
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    # Used for leader election by the controller
    # TODO: refine the permission to *just* the leader election configmap
    @@ -5486,16 +5678,15 @@
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: cert-manager-cainjector:leaderelection
    subjects:
    - - apiGroup: ""
    - kind: ServiceAccount
    + - kind: ServiceAccount
    name: cert-manager-cainjector
    namespace: cert-manager
    ---
    @@ -5511,9 +5702,9 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5537,9 +5728,9 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    @@ -5559,9 +5750,9 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups:
    - admission.cert-manager.io
    @@ -5582,9 +5773,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    # Used for leader election by the controller
    # TODO: refine the permission to *just* the leader election configmap
    @@ -5604,9 +5795,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    @@ -5627,9 +5818,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups: ["cert-manager.io"]
    resources: ["issuers", "issuers/status"]
    @@ -5654,9 +5845,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups: ["cert-manager.io"]
    resources: ["clusterissuers", "clusterissuers/status"]
    @@ -5681,9 +5872,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups: ["cert-manager.io"]
    resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
    @@ -5695,7 +5886,7 @@
    # admission controller enabled:
    # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
    - apiGroups: ["cert-manager.io"]
    - resources: ["certificates/finalizers"]
    + resources: ["certificates/finalizers", "certificaterequests/finalizers"]
    verbs: ["update"]
    - apiGroups: ["acme.cert-manager.io"]
    resources: ["orders"]
    @@ -5717,9 +5908,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups: ["acme.cert-manager.io"]
    resources: ["orders", "orders/status"]
    @@ -5756,9 +5947,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    # Use to update challenge resource status
    - apiGroups: ["acme.cert-manager.io"]
    @@ -5808,9 +5999,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rules:
    - apiGroups: ["cert-manager.io"]
    resources: ["certificates", "certificaterequests"]
    @@ -5836,34 +6027,13 @@
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
    - name: cert-manager-leaderelection
    - labels:
    - app: cert-manager
    - app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    - app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    -roleRef:
    - apiGroup: rbac.authorization.k8s.io
    - kind: ClusterRole
    - name: cert-manager-leaderelection
    -subjects:
    - - name: cert-manager
    - namespace: "cert-manager"
    - kind: ServiceAccount
    -
    ----
    -
    -apiVersion: rbac.authorization.k8s.io/v1beta1
    -kind: ClusterRoleBinding
    -metadata:
    name: cert-manager-controller-issuers
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5882,9 +6052,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5903,9 +6073,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5924,9 +6094,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5945,9 +6115,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5966,9 +6136,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    @@ -5987,9 +6157,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rbac.authorization.k8s.io/aggregate-to-view: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    @@ -6007,9 +6177,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rules:
    @@ -6028,9 +6198,9 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    spec:
    type: ClusterIP
    ports:
    @@ -6039,7 +6209,7 @@
    targetPort: 9402
    selector:
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    ---
    # Source: cert-manager/templates/webhook-service.yaml
    @@ -6051,22 +6221,22 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    spec:
    type: ClusterIP
    ports:
    - name: https
    port: 443
    - targetPort: 6443
    + targetPort: 10250
    selector:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    ---
    -# Source: cert-manager/charts/cainjector/templates/deployment.yaml
    +# Source: cert-manager/templates/cainjector-deployment.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    @@ -6075,31 +6245,31 @@
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    spec:
    replicas: 1
    selector:
    matchLabels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    template:
    metadata:
    labels:
    app: cainjector
    app.kubernetes.io/name: cainjector
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cainjector-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    annotations:
    spec:
    serviceAccountName: cert-manager-cainjector
    containers:
    - - name: cainjector
    - image: "quay.io/jetstack/cert-manager-cainjector:v0.11.0"
    + - name: cert-manager
    + image: "quay.io/jetstack/cert-manager-cainjector:v0.13.0"
    imagePullPolicy: IfNotPresent
    args:
    - --v=2
    @@ -6123,25 +6293,25 @@
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    spec:
    replicas: 1
    selector:
    matchLabels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    template:
    metadata:
    labels:
    app: cert-manager
    app.kubernetes.io/name: cert-manager
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    annotations:
    prometheus.io/path: "/metrics"
    prometheus.io/scrape: 'true'
    @@ -6150,7 +6320,7 @@
    serviceAccountName: cert-manager
    containers:
    - name: cert-manager
    - image: "quay.io/jetstack/cert-manager-controller:v0.11.0"
    + image: "quay.io/jetstack/cert-manager-controller:v0.13.0"
    imagePullPolicy: IfNotPresent
    args:
    - --v=2
    @@ -6162,6 +6332,7 @@
    - --webhook-dns-names=cert-manager-webhook,cert-manager-webhook.cert-manager,cert-manager-webhook.cert-manager.svc
    ports:
    - containerPort: 9402
    + protocol: TCP
    env:
    - name: POD_NAMESPACE
    valueFrom:
    @@ -6183,37 +6354,47 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    spec:
    replicas: 1
    selector:
    matchLabels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    template:
    metadata:
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    annotations:
    spec:
    serviceAccountName: cert-manager-webhook
    containers:
    - name: cert-manager
    - image: "quay.io/jetstack/cert-manager-webhook:v0.11.0"
    + image: "quay.io/jetstack/cert-manager-webhook:v0.13.0"
    imagePullPolicy: IfNotPresent
    args:
    - --v=2
    - - --secure-port=6443
    + - --secure-port=10250
    - --tls-cert-file=/certs/tls.crt
    - --tls-private-key-file=/certs/tls.key
    + livenessProbe:
    + httpGet:
    + path: /livez
    + port: 6080
    + scheme: HTTP
    + readinessProbe:
    + httpGet:
    + path: /healthz
    + port: 6080
    + scheme: HTTP
    env:
    - name: POD_NAMESPACE
    valueFrom:
    @@ -6230,28 +6411,6 @@
    secret:
    secretName: cert-manager-webhook-tls
    ---
    -# Source: cert-manager/templates/webhook-apiservice.yaml
    -apiVersion: apiregistration.k8s.io/v1beta1
    -kind: APIService
    -metadata:
    - name: v1beta1.webhook.cert-manager.io
    - labels:
    - app: webhook
    - app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    - app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    - annotations:
    - cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-tls"
    -spec:
    - group: webhook.cert-manager.io
    - groupPriorityMinimum: 1000
    - versionPriority: 15
    - service:
    - name: cert-manager-webhook
    - namespace: "cert-manager"
    - version: v1beta1
    ----
    # Source: cert-manager/templates/webhook-mutating-webhook.yaml
    apiVersion: admissionregistration.k8s.io/v1beta1
    kind: MutatingWebhookConfiguration
    @@ -6260,44 +6419,41 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    annotations:
    - cert-manager.io/inject-apiserver-ca: "true"
    + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-tls"
    webhooks:
    - name: webhook.cert-manager.io
    rules:
    - apiGroups:
    - "cert-manager.io"
    + - "acme.cert-manager.io"
    apiVersions:
    - v1alpha2
    operations:
    - CREATE
    - UPDATE
    resources:
    - - certificates
    - - issuers
    - - clusterissuers
    - - orders
    - - challenges
    - - certificaterequests
    + - "*/*"
    failurePolicy: Fail
    + sideEffects: None
    clientConfig:
    service:
    - name: kubernetes
    - namespace: default
    - path: /apis/webhook.cert-manager.io/v1beta1/mutations
    + name: cert-manager-webhook
    + namespace: "cert-manager"
    + path: /mutate
    ---
    -# Source: cert-manager/charts/cainjector/templates/psp-clusterrole.yaml
    +# Source: cert-manager/templates/cainjector-psp-clusterrole.yaml
    ---
    -# Source: cert-manager/charts/cainjector/templates/psp-clusterrolebinding.yaml
    +# Source: cert-manager/templates/cainjector-psp-clusterrolebinding.yaml
    ---
    -# Source: cert-manager/charts/cainjector/templates/psp.yaml
    +# Source: cert-manager/templates/cainjector-psp.yaml
    ---
    @@ -6317,6 +6473,18 @@
    ---
    +# Source: cert-manager/templates/webhook-psp-clusterrole.yaml
    +
    +
    +---
    +# Source: cert-manager/templates/webhook-psp-clusterrolebinding.yaml
    +
    +
    +---
    +# Source: cert-manager/templates/webhook-psp.yaml
    +
    +
    +---
    # Source: cert-manager/templates/webhook-validating-webhook.yaml
    apiVersion: admissionregistration.k8s.io/v1beta1
    kind: ValidatingWebhookConfiguration
    @@ -6325,11 +6493,11 @@
    labels:
    app: webhook
    app.kubernetes.io/name: webhook
    - app.kubernetes.io/instance: cert-manager
    + app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Tiller
    - helm.sh/chart: cert-manager-v0.11.0
    + helm.sh/chart: cert-manager-v0.13.0
    annotations:
    - cert-manager.io/inject-apiserver-ca: "true"
    + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-tls"
    webhooks:
    - name: webhook.cert-manager.io
    namespaceSelector:
    @@ -6345,20 +6513,18 @@
    rules:
    - apiGroups:
    - "cert-manager.io"
    + - "acme.cert-manager.io"
    apiVersions:
    - v1alpha2
    operations:
    - CREATE
    - UPDATE
    resources:
    - - certificates
    - - issuers
    - - clusterissuers
    - - certificaterequests
    + - "*/*"
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
    service:
    - name: kubernetes
    - namespace: default
    - path: /apis/webhook.cert-manager.io/v1beta1/validations
    + name: cert-manager-webhook
    + namespace: "cert-manager"
    + path: /mutate