---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.2.9
  name: issuers.cert.gardener.cloud
spec:
  group: cert.gardener.cloud
  names:
    kind: Issuer
    listKind: IssuerList
    plural: issuers
    shortNames:
      - issuer
    singular: issuer
  scope: Namespaced
  versions:
    - additionalPrinterColumns:
        - description: ACME Server
          jsonPath: .spec.acme.server
          name: SERVER
          type: string
        - description: ACME Registration email
          jsonPath: .spec.acme.email
          name: EMAIL
          type: string
        - description: Status of registration
          jsonPath: .status.state
          name: STATUS
          type: string
        - description: Issuer type
          jsonPath: .status.type
          name: TYPE
          type: string
        - description: object creation timestamp
          jsonPath: .metadata.creationTimestamp
          name: AGE
          type: date
        - description: included domains
          jsonPath: .spec.acme.domains.include
          name: INCLUDED_DOMAINS
          priority: 2000
          type: string
      name: v1alpha1
      schema:
        openAPIV3Schema:
          description: Issuer is the issuer CR.
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: IssuerSpec is the spec of the issuer.
              properties:
                acme:
                  description: ACME is the ACME protocol specific spec.
                  properties:
                    autoRegistration:
                      description: AutoRegistration is the flag if automatic registration
                        should be applied if needed.
                      type: boolean
                    domains:
                      description: Domains optionally specifies domains allowed or forbidden
                        for certificate requests
                      properties:
                        exclude:
                          description: Exclude are domain names for which certificate
                            requests are forbidden (including any subdomains)
                          items:
                            type: string
                          type: array
                        include:
                          description: Include are domain names for which certificate
                            requests are allowed (including any subdomains)
                          items:
                            type: string
                          type: array
                      type: object
                    email:
                      description: Email is the email address to use for user registration.
                      type: string
                    externalAccountBinding:
                      description: ACMEExternalAccountBinding is a reference to a CA
                        external account of the ACME server.
                      properties:
                        keyID:
                          description: keyID is the ID of the CA key that the External
                            Account is bound to.
                          type: string
                        keySecretRef:
                          description: keySecretRef is the secret ref to the Secret
                            which holds the symmetric MAC key of the External Account
                            Binding with data key 'hmacKey'. The secret key stored in
                            the Secret **must** be un-padded, base64 URL encoded data.
                          properties:
                            name:
                              description: Name is unique within a namespace to reference
                                a secret resource.
                              type: string
                            namespace:
                              description: Namespace defines the space within which
                                the secret name must be unique.
                              type: string
                          type: object
                      required:
                        - keyID
                        - keySecretRef
                      type: object
                    privateKeySecretRef:
                      description: PrivateKeySecretRef is the secret ref to the ACME
                        private key.
                      properties:
                        name:
                          description: Name is unique within a namespace to reference
                            a secret resource.
                          type: string
                        namespace:
                          description: Namespace defines the space within which the
                            secret name must be unique.
                          type: string
                      type: object
                    server:
                      description: Server is the URL of the ACME server.
                      type: string
                    skipDNSChallengeValidation:
                      description: SkipDNSChallengeValidation marks that this issuer
                        does not validate DNS challenges. In this case no DNS entries/records
                        are created for a DNS Challenge and DNS propagation is not checked.
                      type: boolean
                  required:
                    - email
                    - server
                  type: object
                ca:
                  description: CA is the CA specific spec.
                  properties:
                    privateKeySecretRef:
                      description: PrivateKeySecretRef is the secret ref to the CA secret.
                      properties:
                        name:
                          description: Name is unique within a namespace to reference
                            a secret resource.
                          type: string
                        namespace:
                          description: Namespace defines the space within which the
                            secret name must be unique.
                          type: string
                      type: object
                  type: object
                requestsPerDayQuota:
                  description: RequestsPerDayQuota is the maximum number of certificate
                    requests per days allowed for this issuer
                  type: integer
              type: object
            status:
              description: IssuerStatus is the status of the issuer.
              properties:
                acme:
                  description: ACME is the ACME specific status.
                  type: object
                  x-kubernetes-preserve-unknown-fields: true
                ca:
                  description: CA is the CA specific status.
                  type: object
                  x-kubernetes-preserve-unknown-fields: true
                message:
                  description: Message is the status or error message.
                  type: string
                observedGeneration:
                  description: ObservedGeneration is the observed generation of the
                    spec.
                  format: int64
                  type: integer
                requestsPerDayQuota:
                  description: RequestsPerDayQuota is the actual maximum number of certificate
                    requests per days allowed for this issuer
                  type: integer
                state:
                  description: State is either empty, 'Pending', 'Error', or 'Ready'.
                  type: string
                type:
                  description: Type is the issuer type. Currently only 'acme' and 'ca'
                    are supported.
                  type: string
              required:
                - state
              type: object
          required:
            - spec
          type: object
      served: true
      storage: true
      subresources:
        status: {}