template.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
    controller-gen.kubebuilder.io/version: v0.8.0
  name: adcsissuers.adcs.certmanager.csf.nokia.com
spec:
  conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: webhook-service
        namespace: system
        path: /convert
  group: adcs.certmanager.csf.nokia.com
  names:
    kind: AdcsIssuer
    listKind: AdcsIssuerList
    plural: adcsissuers
    singular: adcsissuer
  scope: Namespaced
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: AdcsIssuer is the Schema for the adcsissuers API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: AdcsIssuerSpec defines the desired state of AdcsIssuer
            properties:
              caBundle:
                description: CABundle is a PEM encoded TLS certifiate to use to verify
                  connections to the ADCS server.
                format: byte
                type: string
              credentialsRef:
                description: CredentialsRef is a reference to a Secret containing
                  the username and password for the ADCS server. The secret must contain
                  two keys, 'username' and 'password'.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              retryInterval:
                description: How often to retry in case of communication errors (in
                  time.ParseDuration() format) Default 1 hour.
                type: string
              statusCheckInterval:
                description: How often to check for request status in the server (in
                  time.ParseDuration() format) Default 6 hours.
                type: string
              templateName:
                description: Which ADCS Template should this issuer use Defaults to
                  the what is specified in main.go or as an cli option.
                type: string
              url:
                description: URL is the base URL for the ADCS instance
                type: string
            required:
            - credentialsRef
            - url
            type: object
          status:
            description: AdcsIssuerStatus defines the observed state of AdcsIssuer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
    controller-gen.kubebuilder.io/version: v0.8.0
  name: adcsrequests.adcs.certmanager.csf.nokia.com
spec:
  conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: webhook-service
        namespace: system
        path: /convert
  group: adcs.certmanager.csf.nokia.com
  names:
    kind: AdcsRequest
    listKind: AdcsRequestList
    plural: adcsrequests
    singular: adcsrequest
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.state
      name: State
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: AdcsRequest is the Schema for the adcsrequests API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: AdcsRequestSpec defines the desired state of AdcsRequest
            properties:
              csr:
                description: Certificate signing request bytes in PEM encoding. This
                  will be used when finalizing the request. This field must be set
                  on the request.
                format: byte
                type: string
              issuerRef:
                description: IssuerRef references a properly configured AdcsIssuer
                  which should be used to serve this AdcsRequest. If the Issuer does
                  not exist, processing will be retried. If the Issuer is not an 'ADCS'
                  Issuer, an error will be returned and the ADCSRequest will be marked
                  as failed.
                properties:
                  group:
                    description: Group of the resource being referred to.
                    type: string
                  kind:
                    description: Kind of the resource being referred to.
                    type: string
                  name:
                    description: Name of the resource being referred to.
                    type: string
                required:
                - name
                type: object
            required:
            - csr
            - issuerRef
            type: object
          status:
            description: AdcsRequestStatus defines the observed state of AdcsRequest
            properties:
              id:
                description: ID of the Request assigned by the ADCS. This will initially
                  be empty when the resource is first created. The ADCSRequest controller
                  will populate this field when the Request is accepted by ADCS. This
                  field will be immutable after it is initially set.
                type: string
              reason:
                description: Reason optionally provides more information about a why
                  the AdcsRequest is in the current state.
                type: string
              state:
                description: State contains the current state of this ADCSRequest
                  resource. States 'ready' and 'rejected' are 'final'
                enum:
                - pending
                - ready
                - errored
                - rejected
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
    controller-gen.kubebuilder.io/version: v0.8.0
  name: clusteradcsissuers.adcs.certmanager.csf.nokia.com
spec:
  conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: webhook-service
        namespace: system
        path: /convert
  group: adcs.certmanager.csf.nokia.com
  names:
    kind: ClusterAdcsIssuer
    listKind: ClusterAdcsIssuerList
    plural: clusteradcsissuers
    singular: clusteradcsissuer
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: ClusterAdcsIssuer is the Schema for the clusteradcsissuers API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: ClusterAdcsIssuerSpec defines the desired state of ClusterAdcsIssuer
            properties:
              caBundle:
                description: CABundle is a PEM encoded TLS certifiate to use to verify
                  connections to the ADCS server.
                format: byte
                type: string
              credentialsRef:
                description: CredentialsRef is a reference to a Secret containing
                  the username and password for the ADCS server. The secret must contain
                  two keys, 'username' and 'password'.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              retryInterval:
                description: How often to retry in case of communication errors (in
                  time.ParseDuration() format) Default 1 hour.
                type: string
              statusCheckInterval:
                description: How often to check for request status in the server (in
                  time.ParseDuration() format) Default 6 hours.
                type: string
              templateName:
                description: Which ADCS Template should this issuer use Defaults to
                  the what is specified in main.go or as an cli option.
                type: string
              url:
                description: URL is the base URL for the ADCS instance
                type: string
            required:
            - credentialsRef
            - url
            type: object
          status:
            description: ClusterAdcsIssuerStatus defines the observed state of ClusterAdcsIssuer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    control-plane: controller-manager
  name: cert-manager
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
    controller-gen.kubebuilder.io/version: v0.8.0
  name: adcsissuers.adcs.certmanager.csf.nokia.com
spec:
  conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: adcs-issuer-webhook-service
        namespace: cert-manager
        path: /convert
  group: adcs.certmanager.csf.nokia.com
  names:
    kind: AdcsIssuer
    listKind: AdcsIssuerList
    plural: adcsissuers
    singular: adcsissuer
  scope: Namespaced
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: AdcsIssuer is the Schema for the adcsissuers API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: AdcsIssuerSpec defines the desired state of AdcsIssuer
            properties:
              caBundle:
                description: CABundle is a PEM encoded TLS certifiate to use to verify
                  connections to the ADCS server.
                format: byte
                type: string
              credentialsRef:
                description: CredentialsRef is a reference to a Secret containing
                  the username and password for the ADCS server. The secret must contain
                  two keys, 'username' and 'password'.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              retryInterval:
                description: How often to retry in case of communication errors (in
                  time.ParseDuration() format) Default 1 hour.
                type: string
              statusCheckInterval:
                description: How often to check for request status in the server (in
                  time.ParseDuration() format) Default 6 hours.
                type: string
              templateName:
                description: Which ADCS Template should this issuer use Defaults to
                  the what is specified in main.go or as an cli option.
                type: string
              url:
                description: URL is the base URL for the ADCS instance
                type: string
            required:
            - credentialsRef
            - url
            type: object
          status:
            description: AdcsIssuerStatus defines the observed state of AdcsIssuer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
    controller-gen.kubebuilder.io/version: v0.8.0
  name: adcsrequests.adcs.certmanager.csf.nokia.com
spec:
  conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: adcs-issuer-webhook-service
        namespace: cert-manager
        path: /convert
  group: adcs.certmanager.csf.nokia.com
  names:
    kind: AdcsRequest
    listKind: AdcsRequestList
    plural: adcsrequests
    singular: adcsrequest
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.state
      name: State
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: AdcsRequest is the Schema for the adcsrequests API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: AdcsRequestSpec defines the desired state of AdcsRequest
            properties:
              csr:
                description: Certificate signing request bytes in PEM encoding. This
                  will be used when finalizing the request. This field must be set
                  on the request.
                format: byte
                type: string
              issuerRef:
                description: IssuerRef references a properly configured AdcsIssuer
                  which should be used to serve this AdcsRequest. If the Issuer does
                  not exist, processing will be retried. If the Issuer is not an 'ADCS'
                  Issuer, an error will be returned and the ADCSRequest will be marked
                  as failed.
                properties:
                  group:
                    description: Group of the resource being referred to.
                    type: string
                  kind:
                    description: Kind of the resource being referred to.
                    type: string
                  name:
                    description: Name of the resource being referred to.
                    type: string
                required:
                - name
                type: object
            required:
            - csr
            - issuerRef
            type: object
          status:
            description: AdcsRequestStatus defines the observed state of AdcsRequest
            properties:
              id:
                description: ID of the Request assigned by the ADCS. This will initially
                  be empty when the resource is first created. The ADCSRequest controller
                  will populate this field when the Request is accepted by ADCS. This
                  field will be immutable after it is initially set.
                type: string
              reason:
                description: Reason optionally provides more information about a why
                  the AdcsRequest is in the current state.
                type: string
              state:
                description: State contains the current state of this ADCSRequest
                  resource. States 'ready' and 'rejected' are 'final'
                enum:
                - pending
                - ready
                - errored
                - rejected
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
    controller-gen.kubebuilder.io/version: v0.8.0
  name: clusteradcsissuers.adcs.certmanager.csf.nokia.com
spec:
  conversion:
    strategy: Webhook
    webhookClientConfig:
      caBundle: Cg==
      service:
        name: adcs-issuer-webhook-service
        namespace: cert-manager
        path: /convert
  group: adcs.certmanager.csf.nokia.com
  names:
    kind: ClusterAdcsIssuer
    listKind: ClusterAdcsIssuerList
    plural: clusteradcsissuers
    singular: clusteradcsissuer
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: ClusterAdcsIssuer is the Schema for the clusteradcsissuers API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: ClusterAdcsIssuerSpec defines the desired state of ClusterAdcsIssuer
            properties:
              caBundle:
                description: CABundle is a PEM encoded TLS certifiate to use to verify
                  connections to the ADCS server.
                format: byte
                type: string
              credentialsRef:
                description: CredentialsRef is a reference to a Secret containing
                  the username and password for the ADCS server. The secret must contain
                  two keys, 'username' and 'password'.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              retryInterval:
                description: How often to retry in case of communication errors (in
                  time.ParseDuration() format) Default 1 hour.
                type: string
              statusCheckInterval:
                description: How often to check for request status in the server (in
                  time.ParseDuration() format) Default 6 hours.
                type: string
              templateName:
                description: Which ADCS Template should this issuer use Defaults to
                  the what is specified in main.go or as an cli option.
                type: string
              url:
                description: URL is the base URL for the ADCS instance
                type: string
            required:
            - credentialsRef
            - url
            type: object
          status:
            description: ClusterAdcsIssuerStatus defines the observed state of ClusterAdcsIssuer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: adcs-issuer-leader-election-role
  namespace: cert-manager
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - configmaps/status
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - update
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: adcs-issuer-cert-manager-controller-approve:adcs-certmanager-csf-nokia-com
rules:
- apiGroups:
  - cert-manager.io
  resourceNames:
  - adcsissuers.adcs.certmanager.csf.nokia.com/*
  - clusteradcsissuers.adcs.certmanager.csf.nokia.com/*
  resources:
  - signers
  verbs:
  - approve
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: adcs-issuer-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - adcs.certmanager.csf.nokia.com
  resources:
  - adcsissuers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - adcs.certmanager.csf.nokia.com
  resources:
  - adcsissuers/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - adcs.certmanager.csf.nokia.com
  resources:
  - adcsrequests
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - adcs.certmanager.csf.nokia.com
  resources:
  - adcsrequests/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - adcs.certmanager.csf.nokia.com
  resources:
  - clusteradcsissuers
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - adcs.certmanager.csf.nokia.com
  resources:
  - clusteradcsissuers/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - cert-manager.io
  resources:
  - certificaterequests
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - cert-manager.io
  resources:
  - certificaterequests/finalizers
  - certificaterequests/status
  - certificates/finalizers
  verbs:
  - get
  - patch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: adcs-issuer-proxy-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: adcs-issuer-leader-election-rolebinding
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: adcs-issuer-leader-election-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: adcs-issuer-cert-manager-controller-approve:adcs-certmanager-csf-nokia-com
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: adcs-issuer-cert-manager-controller-approve:adcs-certmanager-csf-nokia-com
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: adcs-issuer-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: adcs-issuer-manager-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: adcs-issuer-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: adcs-issuer-proxy-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: cert-manager
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/port: "8443"
    prometheus.io/scheme: https
    prometheus.io/scrape: "true"
  labels:
    control-plane: controller-manager
  name: adcs-issuer-controller-manager-metrics-service
  namespace: cert-manager
spec:
  ports:
  - name: https
    port: 8443
    targetPort: https
  selector:
    control-plane: controller-manager
---
apiVersion: v1
kind: Service
metadata:
  name: adcs-issuer-webhook-service
  namespace: cert-manager
spec:
  ports:
  - port: 443
    targetPort: 9443
  selector:
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    control-plane: controller-manager
  name: adcs-issuer-controller-manager
  namespace: cert-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      labels:
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --metrics-bind-address=127.0.0.1:8080
        - --health-probe-bind-address=:8081
        - --leader-elect
        - --cluster-resource-namespace=adcs-issuer-system
        command:
        - /manager
        image: controller:latest
        name: manager
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true
      - args:
        - --secure-listen-address=0.0.0.0:8443
        - --upstream=http://127.0.0.1:8080/
        - --logtostderr=true
        - --v=10
        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.4.0
        name: kube-rbac-proxy
        ports:
        - containerPort: 8443
          name: https
      terminationGracePeriodSeconds: 10
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: webhook-server-cert
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: adcs-issuer-serving-cert
  namespace: cert-manager
spec:
  commonName: adcs-issuer-webhook-service.cert-manager.svc
  dnsNames:
  - adcs-issuer-webhook-service.cert-manager.svc.cluster.local
  issuerRef:
    kind: ClusterIssuer
    name: selfsigned
  secretName: webhook-server-cert
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
  name: adcs-issuer-mutating-webhook-configuration
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: adcs-issuer-webhook-service
      namespace: cert-manager
      path: /mutate-adcs-certmanager-csf-nokia-com-v1-adcsissuer
  failurePolicy: Fail
  name: adcsissuer-mutation.adcs.certmanager.csf.nokia.com
  rules:
  - apiGroups:
    - adcs.certmanager.csf.nokia.com
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - adcsissuer
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: adcs-issuer-webhook-service
      namespace: cert-manager
      path: /mutate-batch-certmanager-csf-nokia-com-v1-clusteradcsissuer
  failurePolicy: Fail
  name: mclusteradcsissuer.kb.io
  rules:
  - apiGroups:
    - batch.certmanager.csf.nokia.com
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - clusteradcsissuers
  sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
  name: adcs-issuer-validating-webhook-configuration
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: adcs-issuer-webhook-service
      namespace: cert-manager
      path: /validate-adcs-certmanager-csf-nokia-com-v1-adcsissuer
  failurePolicy: Fail
  name: adcsissuer-validation.adcs.certmanager.csf.nokia.com
  rules:
  - apiGroups:
    - adcs.certmanager.csf.nokia.com
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - adcsissuer
  sideEffects: None
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: adcs-issuer-webhook-service
      namespace: cert-manager
      path: /validate-batch-certmanager-csf-nokia-com-v1-clusteradcsissuer
  failurePolicy: Fail
  name: vclusteradcsissuer.kb.io
  rules:
  - apiGroups:
    - batch.certmanager.csf.nokia.com
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - clusteradcsissuers
  sideEffects: None