apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apiextensions.k8s.io/v1beta1","kind":"CustomResourceDefinition","metadata":{"annotations":{"cert-manager.io/inject-ca-from-secret":"cert-manager/cert-manager-webhook-ca"},"labels":{"app":"cert-manager","app.kubernetes.io/instance":"cert-manager","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"cert-manager","helm.sh/chart":"cert-manager-v0.15.1"},"name":"certificaterequests.cert-manager.io"},"spec":{"additionalPrinterColumns":[{"JSONPath":".status.conditions[?(@.type==\"Ready\")].status","name":"Ready","type":"string"},{"JSONPath":".spec.issuerRef.name","name":"Issuer","priority":1,"type":"string"},{"JSONPath":".status.conditions[?(@.type==\"Ready\")].message","name":"Status","priority":1,"type":"string"},{"JSONPath":".metadata.creationTimestamp","description":"CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.","name":"Age","type":"date"}],"conversion":{"strategy":"Webhook","webhookClientConfig":{"service":{"name":"cert-manager-webhook","namespace":"cert-manager","path":"/convert"}}},"group":"cert-manager.io","names":{"kind":"CertificateRequest","listKind":"CertificateRequestList","plural":"certificaterequests","shortNames":["cr","crs"],"singular":"certificaterequest"},"preserveUnknownFields":false,"scope":"Namespaced","subresources":{"status":{}},"validation":{"openAPIV3Schema":{"description":"CertificateRequest is a type to represent a Certificate Signing Request","properties":{"apiVersion":{"description":"APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources","type":"string"},"kind":{"description":"Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds","type":"string"},"metadata":{"type":"object"},"spec":{"description":"CertificateRequestSpec defines the desired state of CertificateRequest","properties":{"csr":{"description":"Byte slice containing the PEM encoded CertificateSigningRequest","format":"byte","type":"string"},"duration":{"description":"Requested certificate default Duration","type":"string"},"isCA":{"description":"IsCA will mark the resulting certificate as valid for signing. This implies that the 'cert sign' usage is set","type":"boolean"},"issuerRef":{"description":"IssuerRef is a reference to the issuer for this CertificateRequest.  If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used.  If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.","properties":{"group":{"type":"string"},"kind":{"type":"string"},"name":{"type":"string"}},"required":["name"],"type":"object"},"usages":{"description":"Usages is the set of x509 actions that are enabled for a given key. Defaults are ('digital signature', 'key encipherment') if empty","items":{"description":"KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3      https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"","enum":["signing","digital signature","content commitment","key encipherment","key agreement","data encipherment","cert sign","crl sign","encipher only","decipher only","any","server auth","client auth","code signing","email protection","s/mime","ipsec end system","ipsec tunnel","ipsec user","timestamping","ocsp signing","microsoft sgc","netscape sgc"],"type":"string"},"type":"array"}},"required":["csr","issuerRef"],"type":"object"},"status":{"description":"CertificateStatus defines the observed state of CertificateRequest and resulting signed certificate.","properties":{"ca":{"description":"Byte slice containing the PEM encoded certificate authority of the signed certificate.","format":"byte","type":"string"},"certificate":{"description":"Byte slice containing a PEM encoded signed certificate resulting from the given certificate signing request.","format":"byte","type":"string"},"conditions":{"items":{"description":"CertificateRequestCondition contains condition information for a CertificateRequest.","properties":{"lastTransitionTime":{"description":"LastTransitionTime is the timestamp corresponding to the last status change of this condition.","format":"date-time","type":"string"},"message":{"description":"Message is a human readable description of the details of the last transition, complementing reason.","type":"string"},"reason":{"description":"Reason is a brief machine readable explanation for the condition's last transition.","type":"string"},"status":{"description":"Status of the condition, one of ('True', 'False', 'Unknown').","enum":["True","False","Unknown"],"type":"string"},"type":{"description":"Type of the condition, currently ('Ready', 'InvalidRequest').","type":"string"}},"required":["status","type"],"type":"object"},"type":"array"},"failureTime":{"description":"FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.","format":"date-time","type":"string"}},"type":"object"}},"type":"object"}},"versions":[{"name":"v1alpha2","served":true,"storage":true},{"name":"v1alpha3","served":true,"storage":false}]}}
  creationTimestamp: "2020-06-02T08:18:21Z"
  generation: 2
  labels:
    app: cert-manager
    app.kubernetes.io/instance: cert-manager
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager
    helm.sh/chart: cert-manager-v0.15.1
  name: certificaterequests.cert-manager.io
spec:
  conversion:
    strategy: Webhook
    webhook:
      clientConfig:
        caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJvakNDQVNpZ0F3SUJBZ0lRTzlHZlZFUXI1TW1uMkNDU3VXbXcyekFLQmdncWhrak9QUVFEQXpBaU1TQXcKSGdZRFZRUURFeGRqWlhKMExXMWhibUZuWlhJdGQyVmlhRzl2YXkxallUQWVGdzB5TURBMk1ESXdPREU1TWpKYQpGdzB5TVRBMk1ESXdPREU1TWpKYU1DSXhJREFlQmdOVkJBTVRGMk5sY25RdGJXRnVZV2RsY2kxM1pXSm9iMjlyCkxXTmhNSFl3RUFZSEtvWkl6ajBDQVFZRks0RUVBQ0lEWWdBRTVDTU4xQ1o0SXI4c2VKN0IxTlRTTEMveWZQR3AKOG9PYW81eTlaTjB0Y01YZWs0TFVqeGFGZitrdU9DYzc0eEFBeHpTMUJsVUh4KzZNdlQvb0IrRDVxeDMvSWhhRgpFTVdZYi9kNG1LU0RvZGtaUDMvUm54MWtNc0F2cUpOTTlLYkhveU13SVRBT0JnTlZIUThCQWY4RUJBTUNBcVF3CkR3WURWUjBUQVFIL0JBVXdBd0VCL3pBS0JnZ3Foa2pPUFFRREF3Tm9BREJsQWpBWGw2dEFOMlM4QlNrSDZrK0gKYm43QTBVZzlyVHA2dUs0VVhYRnU5OExDQmtlNTgzZzQ5WHpHNGkwZUlDRjZoNFlDTVFDNU5LK1hSc0dBWW1HOAorN28rbEp5aEtEaHBBYjg2SWZSS1lOa2QvU0JIZjJacmhKa0RVd0FPN0RRMCt6QlpKR2s9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
        service:
          name: cert-manager-webhook
          namespace: cert-manager
          path: /convert
          port: 443
      conversionReviewVersions:
      - v1beta1
  group: cert-manager.io
  names:
    kind: CertificateRequest
    listKind: CertificateRequestList
    plural: certificaterequests
    shortNames:
    - cr
    - crs
    singular: certificaterequest
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - jsonPath: .spec.issuerRef.name
      name: Issuer
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Status
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha2
    schema:
      openAPIV3Schema:
        description: CertificateRequest is a type to represent a Certificate Signing
          Request
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: CertificateRequestSpec defines the desired state of CertificateRequest
            properties:
              csr:
                description: Byte slice containing the PEM encoded CertificateSigningRequest
                format: byte
                type: string
              duration:
                description: Requested certificate default Duration
                type: string
              isCA:
                description: IsCA will mark the resulting certificate as valid for
                  signing. This implies that the 'cert sign' usage is set
                type: boolean
              issuerRef:
                description: IssuerRef is a reference to the issuer for this CertificateRequest.  If
                  the 'kind' field is not set, or set to 'Issuer', an Issuer resource
                  with the given name in the same namespace as the CertificateRequest
                  will be used.  If the 'kind' field is set to 'ClusterIssuer', a
                  ClusterIssuer with the provided name will be used. The 'name' field
                  in this stanza is required at all times. The group field refers
                  to the API group of the issuer which defaults to 'cert-manager.io'
                  if empty.
                properties:
                  group:
                    type: string
                  kind:
                    type: string
                  name:
                    type: string
                required:
                - name
                type: object
              usages:
                description: Usages is the set of x509 actions that are enabled for
                  a given key. Defaults are ('digital signature', 'key encipherment')
                  if empty
                items:
                  description: 'KeyUsage specifies valid usage contexts for keys.
                    See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
                    Valid KeyUsage values are as follows: "signing", "digital signature",
                    "content commitment", "key encipherment", "key agreement", "data
                    encipherment", "cert sign", "crl sign", "encipher only", "decipher
                    only", "any", "server auth", "client auth", "code signing", "email
                    protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
                    user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
                    sgc"'
                  enum:
                  - signing
                  - digital signature
                  - content commitment
                  - key encipherment
                  - key agreement
                  - data encipherment
                  - cert sign
                  - crl sign
                  - encipher only
                  - decipher only
                  - any
                  - server auth
                  - client auth
                  - code signing
                  - email protection
                  - s/mime
                  - ipsec end system
                  - ipsec tunnel
                  - ipsec user
                  - timestamping
                  - ocsp signing
                  - microsoft sgc
                  - netscape sgc
                  type: string
                type: array
            required:
            - csr
            - issuerRef
            type: object
          status:
            description: CertificateStatus defines the observed state of CertificateRequest
              and resulting signed certificate.
            properties:
              ca:
                description: Byte slice containing the PEM encoded certificate authority
                  of the signed certificate.
                format: byte
                type: string
              certificate:
                description: Byte slice containing a PEM encoded signed certificate
                  resulting from the given certificate signing request.
                format: byte
                type: string
              conditions:
                items:
                  description: CertificateRequestCondition contains condition information
                    for a CertificateRequest.
                  properties:
                    lastTransitionTime:
                      description: LastTransitionTime is the timestamp corresponding
                        to the last status change of this condition.
                      format: date-time
                      type: string
                    message:
                      description: Message is a human readable description of the
                        details of the last transition, complementing reason.
                      type: string
                    reason:
                      description: Reason is a brief machine readable explanation
                        for the condition's last transition.
                      type: string
                    status:
                      description: Status of the condition, one of ('True', 'False',
                        'Unknown').
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: Type of the condition, currently ('Ready', 'InvalidRequest').
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
              failureTime:
                description: FailureTime stores the time that this CertificateRequest
                  failed. This is used to influence garbage collection and back-off.
                format: date-time
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - jsonPath: .spec.issuerRef.name
      name: Issuer
      priority: 1
      type: string
    - jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Status
      priority: 1
      type: string
    - description: CreationTimestamp is a timestamp representing the server time when
        this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC.
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha3
    schema:
      openAPIV3Schema:
        description: CertificateRequest is a type to represent a Certificate Signing
          Request
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: CertificateRequestSpec defines the desired state of CertificateRequest
            properties:
              csr:
                description: Byte slice containing the PEM encoded CertificateSigningRequest
                format: byte
                type: string
              duration:
                description: Requested certificate default Duration
                type: string
              isCA:
                description: IsCA will mark the resulting certificate as valid for
                  signing. This implies that the 'cert sign' usage is set
                type: boolean
              issuerRef:
                description: IssuerRef is a reference to the issuer for this CertificateRequest.  If
                  the 'kind' field is not set, or set to 'Issuer', an Issuer resource
                  with the given name in the same namespace as the CertificateRequest
                  will be used.  If the 'kind' field is set to 'ClusterIssuer', a
                  ClusterIssuer with the provided name will be used. The 'name' field
                  in this stanza is required at all times. The group field refers
                  to the API group of the issuer which defaults to 'cert-manager.io'
                  if empty.
                properties:
                  group:
                    type: string
                  kind:
                    type: string
                  name:
                    type: string
                required:
                - name
                type: object
              usages:
                description: Usages is the set of x509 actions that are enabled for
                  a given key. Defaults are ('digital signature', 'key encipherment')
                  if empty
                items:
                  description: 'KeyUsage specifies valid usage contexts for keys.
                    See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
                    Valid KeyUsage values are as follows: "signing", "digital signature",
                    "content commitment", "key encipherment", "key agreement", "data
                    encipherment", "cert sign", "crl sign", "encipher only", "decipher
                    only", "any", "server auth", "client auth", "code signing", "email
                    protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
                    user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
                    sgc"'
                  enum:
                  - signing
                  - digital signature
                  - content commitment
                  - key encipherment
                  - key agreement
                  - data encipherment
                  - cert sign
                  - crl sign
                  - encipher only
                  - decipher only
                  - any
                  - server auth
                  - client auth
                  - code signing
                  - email protection
                  - s/mime
                  - ipsec end system
                  - ipsec tunnel
                  - ipsec user
                  - timestamping
                  - ocsp signing
                  - microsoft sgc
                  - netscape sgc
                  type: string
                type: array
            required:
            - csr
            - issuerRef
            type: object
          status:
            description: CertificateStatus defines the observed state of CertificateRequest
              and resulting signed certificate.
            properties:
              ca:
                description: Byte slice containing the PEM encoded certificate authority
                  of the signed certificate.
                format: byte
                type: string
              certificate:
                description: Byte slice containing a PEM encoded signed certificate
                  resulting from the given certificate signing request.
                format: byte
                type: string
              conditions:
                items:
                  description: CertificateRequestCondition contains condition information
                    for a CertificateRequest.
                  properties:
                    lastTransitionTime:
                      description: LastTransitionTime is the timestamp corresponding
                        to the last status change of this condition.
                      format: date-time
                      type: string
                    message:
                      description: Message is a human readable description of the
                        details of the last transition, complementing reason.
                      type: string
                    reason:
                      description: Reason is a brief machine readable explanation
                        for the condition's last transition.
                      type: string
                    status:
                      description: Status of the condition, one of ('True', 'False',
                        'Unknown').
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: Type of the condition, currently ('Ready', 'InvalidRequest').
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
              failureTime:
                description: FailureTime stores the time that this CertificateRequest
                  failed. This is used to influence garbage collection and back-off.
                format: date-time
                type: string
            type: object
        type: object
    served: true
    storage: false
    subresources:
      status: {}
