---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager-webhook-cloudns
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
# Grant cert-manager permission to validate using our apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-webhook-cloudns:domain-solver
  labels:
    app: cert-manager-webhook-cloudns
rules:
  - apiGroups:
      - acme.ixon.cloud
    resources:
      - "*"
    verbs:
      - "create"
---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-webhook-cloudns:flowcontrol-solver
  labels:
    app: cert-manager-webhook-cloudns
    chart: cert-manager-webhook-cloudns-1.1.1
    release: cert-manager-webhook-cloudns
    heritage: Helm
rules:
  - apiGroups:
      - "flowcontrol.apiserver.k8s.io"
    resources:
      - "prioritylevelconfigurations"
      - "flowschemas"
    verbs:
      - "list"
      - "watch"
---
# Source: cert-manager-webhook-cloudns/templates/secret-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-webhook-cloudns:cloudns-api-secret-access
  labels:
    app: cert-manager-webhook-cloudns
rules:
  - apiGroups: [""]
    resources:
      - secrets
    resourceNames:
      - cert-manager-webhook-cloudns-api-secret
    verbs:
      - "get"
---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
# apiserver gets the auth-delegator role to delegate auth decisions to
# the core apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-cloudns:auth-delegator
  labels:
    app: cert-manager-webhook-cloudns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: cert-manager-webhook-cloudns
    namespace: cert-manager
---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-cloudns:domain-solver
  labels:
    app: cert-manager-webhook-cloudns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook-cloudns:domain-solver
subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: cert-manager
    namespace: cert-manager
---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-cloudns:flowcontrol-solver
  labels:
    app: cert-manager-webhook-cloudns
    chart: cert-manager-webhook-cloudns-1.1.1
    release: cert-manager-webhook-cloudns
    heritage: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook-cloudns:flowcontrol-solver
subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: cert-manager-webhook-cloudns
    namespace: "cert-manager"
---
# Source: cert-manager-webhook-cloudns/templates/secret-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-cloudns:api-secret-access
  labels:
    app: cert-manager-webhook-cloudns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook-cloudns:api-secret-access
subjects:
  - apiGroup: ""
    kind: ServiceAccount
    namespace: default
    name: cert-manager-webhook-cloudns
---
# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
# Grant the webhook permission to read the ConfigMap containing the Kubernetes
# apiserver's requestheader-ca-certificate.
# This ConfigMap is automatically created by the Kubernetes apiserver.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager-webhook-cloudns:webhook-authentication-reader
  namespace: kube-system
  labels:
    app: cert-manager-webhook-cloudns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: cert-manager-webhook-cloudns
    namespace: cert-manager
---
# Source: cert-manager-webhook-cloudns/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: cert-manager-webhook-cloudns
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
spec:
  type: ClusterIP
  ports:
    - port: 443
      targetPort: https
      protocol: TCP
      name: https
  selector:
    app: cert-manager-webhook-cloudns
---
# Source: cert-manager-webhook-cloudns/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cert-manager-webhook-cloudns
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
spec:
  replicas: 1
  selector:
    matchLabels:
      app: cert-manager-webhook-cloudns
  template:
    metadata:
      labels:
        app: cert-manager-webhook-cloudns
    spec:
      serviceAccountName: cert-manager-webhook-cloudns
      containers:
        - name: cert-manager-webhook-cloudns
          image: "mschirrmeister/cert-manager-webhook-cloudns:latest-alpine"
          imagePullPolicy: IfNotPresent
          args:
            - --tls-cert-file=/certs/tls.crt
            - --tls-private-key-file=/certs/tls.key
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: GROUP_NAME
              value: "acme.ixon.cloud"
            - name: CLOUDNS_AUTH_ID_FILE
              value: "/creds/auth_id"
            - name: CLOUDNS_AUTH_PASSWORD_FILE
              value: "/creds/auth_password"
            - name: CLOUDNS_AUTH_ID_TYPE
              value: auth-id
          ports:
            - name: https
              containerPort: 443
              protocol: TCP
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
          readinessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
          volumeMounts:
            - name: certs
              mountPath: /certs
              readOnly: true
            - name: creds
              mountPath: /creds
              readOnly: true
          resources: {}
      volumes:
        - name: certs
          secret:
            secretName: cert-manager-webhook-cloudns-webhook-tls
        - name: creds
          secret:
            secretName: cert-manager-webhook-cloudns-api-secret
---
# Source: cert-manager-webhook-cloudns/templates/apiservice.yaml
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.acme.ixon.cloud
  labels:
    app: cert-manager-webhook-cloudns
  annotations:
    cert-manager.io/inject-ca-from: "cert-manager/cert-manager-webhook-cloudns-webhook-tls"
spec:
  group: acme.ixon.cloud
  groupPriorityMinimum: 1000
  versionPriority: 15
  service:
    name: cert-manager-webhook-cloudns
    namespace: cert-manager
  version: v1alpha1
---
# Source: cert-manager-webhook-cloudns/templates/pki.yaml
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: cert-manager-webhook-cloudns-ca
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
spec:
  secretName: cert-manager-webhook-cloudns-ca
  duration: 43800h # 5y
  issuerRef:
    name: cert-manager-webhook-cloudns-selfsign
  commonName: "ca.cert-manager-webhook-cloudns.cert-manager"
  isCA: true
---
# Source: cert-manager-webhook-cloudns/templates/pki.yaml
# Finally, generate a serving certificate for the webhook to use
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: cert-manager-webhook-cloudns-webhook-tls
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
spec:
  secretName: cert-manager-webhook-cloudns-webhook-tls
  duration: 8760h # 1y
  issuerRef:
    name: cert-manager-webhook-cloudns-ca
  dnsNames:
    - cert-manager-webhook-cloudns
    - cert-manager-webhook-cloudns.cert-manager
    - cert-manager-webhook-cloudns.cert-manager.svc
---
# Source: cert-manager-webhook-cloudns/templates/pki.yaml
# Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: cert-manager-webhook-cloudns-selfsign
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
spec:
  selfSigned: {}
---
# Source: cert-manager-webhook-cloudns/templates/pki.yaml
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: cert-manager-webhook-cloudns-ca
  namespace: "cert-manager"
  labels:
    app: cert-manager-webhook-cloudns
spec:
  ca:
    secretName: cert-manager-webhook-cloudns-ca