Upgrade Jetstack Cert-Manager v1.0.4 (#6937)

roles/download/defaults/main.yml

@@ -507,7 +507,7 @@ ingress_ambassador_image_repo: "{{ quay_image_repo }}/datawire/ambassador-operat
 ingress_ambassador_image_tag: "v1.2.9"
 alb_ingress_image_repo: "{{ docker_image_repo }}/amazon/aws-alb-ingress-controller"
 alb_ingress_image_tag: "v1.1.9"
-cert_manager_version: "v0.16.1"
+cert_manager_version: "v1.0.4"
 cert_manager_controller_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-controller"
 cert_manager_controller_image_tag: "{{ cert_manager_version }}"
 cert_manager_cainjector_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-cainjector"

roles/kubernetes-apps/ingress_controller/cert_manager/templates/clusterrole-cert-manager.yml.j2

@@ -16,278 +16,483 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: cert-manager-cainjector
   labels:
     app: cainjector
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: cainjector
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  name: cert-manager-cainjector
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["certificates"]
+  - cert-manager.io
-    verbs: ["get", "list", "watch"]
+  resources:
-  - apiGroups: [""]
+  - certificates
-    resources: ["secrets"]
+  verbs:
-    verbs: ["get", "list", "watch"]
+  - get
-  - apiGroups: [""]
+  - list
-    resources: ["events"]
+  - watch
-    verbs: ["get", "create", "update", "patch"]
+- apiGroups:
-  - apiGroups: ["admissionregistration.k8s.io"]
+  - ""
-    resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
+  resources:
-    verbs: ["get", "list", "watch", "update"]
+  - secrets
-  - apiGroups: ["apiregistration.k8s.io"]
+  verbs:
-    resources: ["apiservices"]
+  - get
-    verbs: ["get", "list", "watch", "update"]
+  - list
-  - apiGroups: ["apiextensions.k8s.io"]
+  - watch
-    resources: ["customresourcedefinitions"]
+- apiGroups:
-    verbs: ["get", "list", "watch", "update"]
+  - ""
-  - apiGroups: ["auditregistration.k8s.io"]
+  resources:
-    resources: ["auditsinks"]
+  - events
-    verbs: ["get", "list", "watch", "update"]
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  - mutatingwebhookconfigurations
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resources:
+  - apiservices
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - auditregistration.k8s.io
+  resources:
+  - auditsinks
+  verbs:
+  - get
+  - list
+  - watch
+  - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
   name: cert-manager-controller-issuers
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["issuers", "issuers/status"]
+  - cert-manager.io
-    verbs: ["update"]
+  resources:
-  - apiGroups: ["cert-manager.io"]
+  - issuers
-    resources: ["issuers"]
+  - issuers/status
-    verbs: ["get", "list", "watch"]
+  verbs:
-  - apiGroups: [""]
+  - update
-    resources: ["secrets"]
+- apiGroups:
-    verbs: ["get", "list", "watch", "create", "update", "delete"]
+  - cert-manager.io
-  - apiGroups: [""]
+  resources:
-    resources: ["events"]
+  - issuers
-    verbs: ["create", "patch"]
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
   name: cert-manager-controller-clusterissuers
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["clusterissuers", "clusterissuers/status"]
+  - cert-manager.io
-    verbs: ["update"]
+  resources:
-  - apiGroups: ["cert-manager.io"]
+  - clusterissuers
-    resources: ["clusterissuers"]
+  - clusterissuers/status
-    verbs: ["get", "list", "watch"]
+  verbs:
-  - apiGroups: [""]
+  - update
-    resources: ["secrets"]
+- apiGroups:
-    verbs: ["get", "list", "watch", "create", "update", "delete"]
+  - cert-manager.io
-  - apiGroups: [""]
+  resources:
-    resources: ["events"]
+  - clusterissuers
-    verbs: ["create", "patch"]
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
   name: cert-manager-controller-certificates
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
+  - cert-manager.io
-    verbs: ["update"]
+  resources:
-  - apiGroups: ["cert-manager.io"]
+  - certificates
-    resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
+  - certificates/status
-    verbs: ["get", "list", "watch"]
+  - certificaterequests
-  # We require these rules to support users with the OwnerReferencesPermissionEnforcement
+  - certificaterequests/status
-  # admission controller enabled:
+  verbs:
-  # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
+  - update
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["certificates/finalizers", "certificaterequests/finalizers"]
+  - cert-manager.io
-    verbs: ["update"]
+  resources:
-  - apiGroups: ["acme.cert-manager.io"]
+  - certificates
-    resources: ["orders"]
+  - certificaterequests
-    verbs: ["create", "delete", "get", "list", "watch"]
+  - clusterissuers
-  - apiGroups: [""]
+  - issuers
-    resources: ["secrets"]
+  verbs:
-    verbs: ["get", "list", "watch", "create", "update", "delete"]
+  - get
-  - apiGroups: [""]
+  - list
-    resources: ["events"]
+  - watch
-    verbs: ["create", "patch"]
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - certificates/finalizers
+  - certificaterequests/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - orders
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
   name: cert-manager-controller-orders
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
 rules:
-  - apiGroups: ["acme.cert-manager.io"]
+- apiGroups:
-    resources: ["orders", "orders/status"]
+  - acme.cert-manager.io
-    verbs: ["update"]
+  resources:
-  - apiGroups: ["acme.cert-manager.io"]
+  - orders
-    resources: ["orders", "challenges"]
+  - orders/status
-    verbs: ["get", "list", "watch"]
+  verbs:
-  - apiGroups: ["cert-manager.io"]
+  - update
-    resources: ["clusterissuers", "issuers"]
+- apiGroups:
-    verbs: ["get", "list", "watch"]
+  - acme.cert-manager.io
-  - apiGroups: ["acme.cert-manager.io"]
+  resources:
-    resources: ["challenges"]
+  - orders
-    verbs: ["create", "delete"]
+  - challenges
-  # We require these rules to support users with the OwnerReferencesPermissionEnforcement
+  verbs:
-  # admission controller enabled:
+  - get
-  # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
+  - list
-  - apiGroups: ["acme.cert-manager.io"]
+  - watch
-    resources: ["orders/finalizers"]
+- apiGroups:
-    verbs: ["update"]
+  - cert-manager.io
-  - apiGroups: [""]
+  resources:
-    resources: ["secrets"]
+  - clusterissuers
-    verbs: ["get", "list", "watch"]
+  - issuers
-  - apiGroups: [""]
+  verbs:
-    resources: ["events"]
+  - get
-    verbs: ["create", "patch"]
+  - list
+  - watch
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - challenges
+  verbs:
+  - create
+  - delete
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - orders/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
   name: cert-manager-controller-challenges
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
 rules:
-  # Use to update challenge resource status
+- apiGroups:
-  - apiGroups: ["acme.cert-manager.io"]
+  - acme.cert-manager.io
-    resources: ["challenges", "challenges/status"]
+  resources:
-    verbs: ["update"]
+  - challenges
-  # Used to watch challenge resources
+  - challenges/status
-  - apiGroups: ["acme.cert-manager.io"]
+  verbs:
-    resources: ["challenges"]
+  - update
-    verbs: ["get", "list", "watch"]
+- apiGroups:
-  # Used to watch challenges, issuer and clusterissuer resources
+  - acme.cert-manager.io
-  - apiGroups: ["cert-manager.io"]
+  resources:
-    resources: ["issuers", "clusterissuers"]
+  - challenges
-    verbs: ["get", "list", "watch"]
+  verbs:
-  # Need to be able to retrieve ACME account private key to complete challenges
+  - get
-  - apiGroups: [""]
+  - list
-    resources: ["secrets"]
+  - watch
-    verbs: ["get", "list", "watch"]
+- apiGroups:
-  # Used to create events
+  - cert-manager.io
-  - apiGroups: [""]
+  resources:
-    resources: ["events"]
+  - issuers
-    verbs: ["create", "patch"]
+  - clusterissuers
-  # HTTP01 rules
+  verbs:
-  - apiGroups: [""]
+  - get
-    resources: ["pods", "services"]
+  - list
-    verbs: ["get", "list", "watch", "create", "delete"]
+  - watch
-  - apiGroups: ["extensions"]
+- apiGroups:
-    resources: ["ingresses"]
+  - ""
-    verbs: ["get", "list", "watch", "create", "delete", "update"]
+  resources:
-  # We require the ability to specify a custom hostname when we are creating
+  - secrets
-  # new ingress resources.
+  verbs:
-  # See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148
+  - get
-  - apiGroups: ["route.openshift.io"]
+  - list
-    resources: ["routes/custom-host"]
+  - watch
-    verbs: ["create"]
+- apiGroups:
-  # We require these rules to support users with the OwnerReferencesPermissionEnforcement
+  - ""
-  # admission controller enabled:
+  resources:
-  # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
+  - events
-  - apiGroups: ["acme.cert-manager.io"]
+  verbs:
-    resources: ["challenges/finalizers"]
+  - create
-    verbs: ["update"]
+  - patch
-  # DNS01 rules (duplicated above)
+- apiGroups:
-  - apiGroups: [""]
+  - ""
-    resources: ["secrets"]
+  resources:
-    verbs: ["get", "list", "watch"]
+  - pods
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - update
+- apiGroups:
+  - route.openshift.io
+  resources:
+  - routes/custom-host
+  verbs:
+  - create
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - challenges/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
   name: cert-manager-controller-ingress-shim
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["certificates", "certificaterequests"]
+  - cert-manager.io
-    verbs: ["create", "update", "delete"]
+  resources:
-  - apiGroups: ["cert-manager.io"]
+  - certificates
-    resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
+  - certificaterequests
-    verbs: ["get", "list", "watch"]
+  verbs:
-  - apiGroups: ["extensions"]
+  - create
-    resources: ["ingresses"]
+  - update
-    verbs: ["get", "list", "watch"]
+  - delete
-  # We require these rules to support users with the OwnerReferencesPermissionEnforcement
+- apiGroups:
-  # admission controller enabled:
+  - cert-manager.io
-  # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
+  resources:
-  - apiGroups: ["extensions"]
+  - certificates
-    resources: ["ingresses/finalizers"]
+  - certificaterequests
-    verbs: ["update"]
+  - issuers
-  - apiGroups: [""]
+  - clusterissuers
-    resources: ["events"]
+  verbs:
-    verbs: ["create", "patch"]
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: cert-manager-view
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: cert-manager-view
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["certificates", "certificaterequests", "issuers"]
+  - cert-manager.io
-    verbs: ["get", "list", "watch"]
+  resources:
+  - certificates
+  - certificaterequests
+  - issuers
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: cert-manager-edit
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    app.kubernetes.io/name: cert-manager
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: cert-manager-edit
 rules:
-  - apiGroups: ["cert-manager.io"]
+- apiGroups:
-    resources: ["certificates", "certificaterequests", "issuers"]
+  - cert-manager.io
-    verbs: ["create", "delete", "deletecollection", "patch", "update"]
+  resources:
+  - certificates
+  - certificaterequests
+  - issuers
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - patch
+  - update

roles/kubernetes-apps/ingress_controller/cert_manager/templates/clusterrolebinding-cert-manager.yml.j2

@@ -16,139 +16,125 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-cainjector
   labels:
     app: cainjector
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: cainjector
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  name: cert-manager-cainjector
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-cainjector
 subjects:
-  - name: cert-manager-cainjector
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager-cainjector
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-controller-issuers
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager-controller-issuers
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-controller-issuers
 subjects:
-  - name: cert-manager
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-controller-clusterissuers
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager-controller-clusterissuers
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-controller-clusterissuers
 subjects:
-  - name: cert-manager
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-controller-certificates
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager-controller-certificates
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-controller-certificates
 subjects:
-  - name: cert-manager
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-controller-orders
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager-controller-orders
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-controller-orders
 subjects:
-  - name: cert-manager
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-controller-challenges
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager-controller-challenges
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-controller-challenges
 subjects:
-  - name: cert-manager
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: cert-manager-controller-ingress-shim
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager-controller-ingress-shim
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-controller-ingress-shim
 subjects:
-  - name: cert-manager
+- kind: ServiceAccount
-    namespace: {{ cert_manager_namespace }}
+  name: cert-manager
-    kind: ServiceAccount
+  namespace: {{ cert_manager_namespace }}

roles/kubernetes-apps/ingress_controller/cert_manager/templates/crd-order.yml.j2

@@ -13,67 +13,59 @@
 # limitations under the License.
 
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
-  name: orders.acme.cert-manager.io
   annotations:
     cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cert-manager
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+  name: orders.acme.cert-manager.io
 spec:
-  additionalPrinterColumns:
-  - JSONPath: .status.state
-    name: State
-    type: string
-  - JSONPath: .spec.issuerRef.name
-    name: Issuer
-    priority: 1
-    type: string
-  - JSONPath: .status.reason
-    name: Reason
-    priority: 1
-    type: string
-  - JSONPath: .metadata.creationTimestamp
-    description: CreationTimestamp is a timestamp representing the server time when
-      this object was created. It is not guaranteed to be set in happens-before order
-      across separate operations. Clients may not set this value. It is represented
-      in RFC3339 form and is in UTC.
-    name: Age
-    type: date
-  group: acme.cert-manager.io
-  preserveUnknownFields: false
   conversion:
-    # a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources.
     strategy: Webhook
-    # webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server.
+    webhook:
-    webhookClientConfig:
+      clientConfig:
-      service:
+        service:
-        namespace: '{{ cert_manager_namespace }}'
+          name: cert-manager-webhook
-        name: 'cert-manager-webhook'
+          namespace: {{ cert_manager_namespace }}
-        path: /convert
+          path: /convert
+      conversionReviewVersions:
+      - v1
+      - v1beta1
+  group: acme.cert-manager.io
   names:
     kind: Order
     listKind: OrderList
     plural: orders
     singular: order
   scope: Namespaced
-  subresources:
-    status: {}
   versions:
-  - name: v1alpha2
+  - additionalPrinterColumns:
-    served: true
+    - jsonPath: .status.state
-    storage: true
+      name: State
-    "schema":
+      type: string
-      "openAPIV3Schema":
+    - jsonPath: .spec.issuerRef.name
+      name: Issuer
+      priority: 1
+      type: string
+    - jsonPath: .status.reason
+      name: Reason
+      priority: 1
+      type: string
+    - description: CreationTimestamp is a timestamp representing the server time when
+        this object was created. It is not guaranteed to be set in happens-before
+        order across separate operations. Clients may not set this value. It is represented
+        in RFC3339 form and is in UTC.
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha2
+    schema:
+      openAPIV3Schema:
         description: Order is a type to represent an Order with an ACME server
-        type: object
-        required:
-        - metadata
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -88,11 +80,6 @@ spec:
           metadata:
             type: object
           spec:
-            type: object
-            required:
-            - csr
-            - dnsNames
-            - issuerRef
             properties:
               commonName:
                 description: CommonName is the common name as specified on the DER
@@ -104,24 +91,21 @@ spec:
                 description: Certificate signing request bytes in DER encoding. This
                   will be used when finalizing the order. This field must be set on
                   the order.
-                type: string
                 format: byte
+                type: string
               dnsNames:
                 description: DNSNames is a list of DNS names that should be included
                   as part of the Order validation process. This field must match the
                   corresponding field on the DER encoded CSR.
-                type: array
                 items:
                   type: string
+                type: array
               issuerRef:
                 description: IssuerRef references a properly configured ACME-type
                   Issuer which should be used to create this Order. If the Issuer
                   does not exist, processing will be retried. If the Issuer is not
                   an 'ACME' Issuer, an error will be returned and the Order will be
                   marked as failed.
-                type: object
-                required:
-                - name
                 properties:
                   group:
                     description: Group of the resource being referred to.
@@ -132,37 +116,34 @@ spec:
                   name:
                     description: Name of the resource being referred to.
                     type: string
-          status:
+                required:
+                - name
+                type: object
+            required:
+            - csr
+            - dnsNames
+            - issuerRef
             type: object
+          status:
             properties:
               authorizations:
                 description: Authorizations contains data returned from the ACME server
                   on what authorizations must be completed in order to validate the
                   DNS names specified on the Order.
-                type: array
                 items:
                   description: ACMEAuthorization contains data returned from the ACME
                     server on an authorization that must be completed in order validate
                     a DNS name on an ACME Order resource.
-                  type: object
-                  required:
-                  - url
                   properties:
                     challenges:
                       description: Challenges specifies the challenge types offered
                         by the ACME server. One of these challenge types will be selected
                         when validating the DNS name and an appropriate Challenge
                         resource will be created to perform the ACME challenge process.
-                      type: array
                       items:
                         description: Challenge specifies a challenge offered by the
                           ACME server for an Order. An appropriate Challenge resource
                           can be created to perform the ACME challenge process.
-                        type: object
-                        required:
-                        - token
-                        - type
-                        - url
                         properties:
                           token:
                             description: Token is the token that must be presented
@@ -181,6 +162,12 @@ spec:
                               be used to retrieve additional metadata about the Challenge
                               from the ACME server.
                             type: string
+                        required:
+                        - token
+                        - type
+                        - url
+                        type: object
+                      type: array
                     identifier:
                       description: Identifier is the DNS name to be validated as part
                         of this authorization
@@ -194,7 +181,6 @@ spec:
                         (such as Let's Encrypt's production endpoint). If not set
                         and 'identifier' is set, the state is assumed to be pending
                         and a Challenge will be created.
-                      type: string
                       enum:
                       - valid
                       - ready
@@ -203,6 +189,7 @@ spec:
                       - invalid
                       - expired
                       - errored
+                      type: string
                     url:
                       description: URL is the URL of the Authorization that must be
                         completed
@@ -214,18 +201,22 @@ spec:
                         if '*.example.com' is the DNS name being validated, this field
                         will be 'true' and the 'identifier' field will be 'example.com'.
                       type: boolean
+                  required:
+                  - url
+                  type: object
+                type: array
               certificate:
                 description: Certificate is a copy of the PEM encoded certificate
                   for this Order. This field will be populated after the order has
                   been successfully finalized with the ACME server, and the order
                   has transitioned to the 'valid' state.
-                type: string
                 format: byte
+                type: string
               failureTime:
                 description: FailureTime stores the time that this order failed. This
                   is used to influence garbage collection and back-off.
-                type: string
                 format: date-time
+                type: string
               finalizeURL:
                 description: FinalizeURL of the Order. This is used to obtain certificates
                   for this order once it has been completed.
@@ -237,7 +228,6 @@ spec:
               state:
                 description: State contains the current state of this Order resource.
                   States 'success' and 'expired' are 'final'
-                type: string
                 enum:
                 - valid
                 - ready
@@ -246,21 +236,44 @@ spec:
                 - invalid
                 - expired
                 - errored
+                type: string
               url:
                 description: URL of the Order. This will initially be empty when the
                   resource is first created. The Order controller will populate this
                   field when the Order is first processed. This field will be immutable
                   after it is initially set.
                 type: string
-  - name: v1alpha3
+            type: object
-    served: true
-    storage: false
-    "schema":
-      "openAPIV3Schema":
-        description: Order is a type to represent an Order with an ACME server
-        type: object
         required:
         - metadata
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.issuerRef.name
+      name: Issuer
+      priority: 1
+      type: string
+    - jsonPath: .status.reason
+      name: Reason
+      priority: 1
+      type: string
+    - description: CreationTimestamp is a timestamp representing the server time when
+        this object was created. It is not guaranteed to be set in happens-before
+        order across separate operations. Clients may not set this value. It is represented
+        in RFC3339 form and is in UTC.
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha3
+    schema:
+      openAPIV3Schema:
+        description: Order is a type to represent an Order with an ACME server
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -275,11 +288,6 @@ spec:
           metadata:
             type: object
           spec:
-            type: object
-            required:
-            - csr
-            - dnsNames
-            - issuerRef
             properties:
               commonName:
                 description: CommonName is the common name as specified on the DER
@@ -291,24 +299,21 @@ spec:
                 description: Certificate signing request bytes in DER encoding. This
                   will be used when finalizing the order. This field must be set on
                   the order.
-                type: string
                 format: byte
+                type: string
               dnsNames:
                 description: DNSNames is a list of DNS names that should be included
                   as part of the Order validation process. This field must match the
                   corresponding field on the DER encoded CSR.
-                type: array
                 items:
                   type: string
+                type: array
               issuerRef:
                 description: IssuerRef references a properly configured ACME-type
                   Issuer which should be used to create this Order. If the Issuer
                   does not exist, processing will be retried. If the Issuer is not
                   an 'ACME' Issuer, an error will be returned and the Order will be
                   marked as failed.
-                type: object
-                required:
-                - name
                 properties:
                   group:
                     description: Group of the resource being referred to.
@@ -319,37 +324,34 @@ spec:
                   name:
                     description: Name of the resource being referred to.
                     type: string
-          status:
+                required:
+                - name
+                type: object
+            required:
+            - csr
+            - dnsNames
+            - issuerRef
             type: object
+          status:
             properties:
               authorizations:
                 description: Authorizations contains data returned from the ACME server
                   on what authorizations must be completed in order to validate the
                   DNS names specified on the Order.
-                type: array
                 items:
                   description: ACMEAuthorization contains data returned from the ACME
                     server on an authorization that must be completed in order validate
                     a DNS name on an ACME Order resource.
-                  type: object
-                  required:
-                  - url
                   properties:
                     challenges:
                       description: Challenges specifies the challenge types offered
                         by the ACME server. One of these challenge types will be selected
                         when validating the DNS name and an appropriate Challenge
                         resource will be created to perform the ACME challenge process.
-                      type: array
                       items:
                         description: Challenge specifies a challenge offered by the
                           ACME server for an Order. An appropriate Challenge resource
                           can be created to perform the ACME challenge process.
-                        type: object
-                        required:
-                        - token
-                        - type
-                        - url
                         properties:
                           token:
                             description: Token is the token that must be presented
@@ -368,6 +370,12 @@ spec:
                               be used to retrieve additional metadata about the Challenge
                               from the ACME server.
                             type: string
+                        required:
+                        - token
+                        - type
+                        - url
+                        type: object
+                      type: array
                     identifier:
                       description: Identifier is the DNS name to be validated as part
                         of this authorization
@@ -381,7 +389,6 @@ spec:
                         (such as Let's Encrypt's production endpoint). If not set
                         and 'identifier' is set, the state is assumed to be pending
                         and a Challenge will be created.
-                      type: string
                       enum:
                       - valid
                       - ready
@@ -390,6 +397,7 @@ spec:
                       - invalid
                       - expired
                       - errored
+                      type: string
                     url:
                       description: URL is the URL of the Authorization that must be
                         completed
@@ -401,18 +409,22 @@ spec:
                         if '*.example.com' is the DNS name being validated, this field
                         will be 'true' and the 'identifier' field will be 'example.com'.
                       type: boolean
+                  required:
+                  - url
+                  type: object
+                type: array
               certificate:
                 description: Certificate is a copy of the PEM encoded certificate
                   for this Order. This field will be populated after the order has
                   been successfully finalized with the ACME server, and the order
                   has transitioned to the 'valid' state.
-                type: string
                 format: byte
+                type: string
               failureTime:
                 description: FailureTime stores the time that this order failed. This
                   is used to influence garbage collection and back-off.
-                type: string
                 format: date-time
+                type: string
               finalizeURL:
                 description: FinalizeURL of the Order. This is used to obtain certificates
                   for this order once it has been completed.
@@ -424,7 +436,6 @@ spec:
               state:
                 description: State contains the current state of this Order resource.
                   States 'success' and 'expired' are 'final'
-                type: string
                 enum:
                 - valid
                 - ready
@@ -433,22 +444,44 @@ spec:
                 - invalid
                 - expired
                 - errored
+                type: string
               url:
                 description: URL of the Order. This will initially be empty when the
                   resource is first created. The Order controller will populate this
                   field when the Order is first processed. This field will be immutable
                   after it is initially set.
                 type: string
-  - name: v1beta1
+            type: object
-    served: true
-    storage: false
-    "schema":
-      "openAPIV3Schema":
-        description: Order is a type to represent an Order with an ACME server
-        type: object
         required:
         - metadata
-        - spec
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.issuerRef.name
+      name: Issuer
+      priority: 1
+      type: string
+    - jsonPath: .status.reason
+      name: Reason
+      priority: 1
+      type: string
+    - description: CreationTimestamp is a timestamp representing the server time when
+        this object was created. It is not guaranteed to be set in happens-before
+        order across separate operations. Clients may not set this value. It is represented
+        in RFC3339 form and is in UTC.
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Order is a type to represent an Order with an ACME server
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -463,11 +496,6 @@ spec:
           metadata:
             type: object
           spec:
-            type: object
-            required:
-            - dnsNames
-            - issuerRef
-            - request
             properties:
               commonName:
                 description: CommonName is the common name as specified on the DER
@@ -479,18 +507,15 @@ spec:
                 description: DNSNames is a list of DNS names that should be included
                   as part of the Order validation process. This field must match the
                   corresponding field on the DER encoded CSR.
-                type: array
                 items:
                   type: string
+                type: array
               issuerRef:
                 description: IssuerRef references a properly configured ACME-type
                   Issuer which should be used to create this Order. If the Issuer
                   does not exist, processing will be retried. If the Issuer is not
                   an 'ACME' Issuer, an error will be returned and the Order will be
                   marked as failed.
-                type: object
-                required:
-                - name
                 properties:
                   group:
                     description: Group of the resource being referred to.
@@ -501,43 +526,40 @@ spec:
                   name:
                     description: Name of the resource being referred to.
                     type: string
+                required:
+                - name
+                type: object
               request:
                 description: Certificate signing request bytes in DER encoding. This
                   will be used when finalizing the order. This field must be set on
                   the order.
-                type: string
                 format: byte
-          status:
+                type: string
+            required:
+            - dnsNames
+            - issuerRef
+            - request
             type: object
+          status:
             properties:
               authorizations:
                 description: Authorizations contains data returned from the ACME server
                   on what authorizations must be completed in order to validate the
                   DNS names specified on the Order.
-                type: array
                 items:
                   description: ACMEAuthorization contains data returned from the ACME
                     server on an authorization that must be completed in order validate
                     a DNS name on an ACME Order resource.
-                  type: object
-                  required:
-                  - url
                   properties:
                     challenges:
                       description: Challenges specifies the challenge types offered
                         by the ACME server. One of these challenge types will be selected
                         when validating the DNS name and an appropriate Challenge
                         resource will be created to perform the ACME challenge process.
-                      type: array
                       items:
                         description: Challenge specifies a challenge offered by the
                           ACME server for an Order. An appropriate Challenge resource
                           can be created to perform the ACME challenge process.
-                        type: object
-                        required:
-                        - token
-                        - type
-                        - url
                         properties:
                           token:
                             description: Token is the token that must be presented
@@ -556,6 +578,12 @@ spec:
                               be used to retrieve additional metadata about the Challenge
                               from the ACME server.
                             type: string
+                        required:
+                        - token
+                        - type
+                        - url
+                        type: object
+                      type: array
                     identifier:
                       description: Identifier is the DNS name to be validated as part
                         of this authorization
@@ -569,7 +597,6 @@ spec:
                         (such as Let's Encrypt's production endpoint). If not set
                         and 'identifier' is set, the state is assumed to be pending
                         and a Challenge will be created.
-                      type: string
                       enum:
                       - valid
                       - ready
@@ -578,6 +605,7 @@ spec:
                       - invalid
                       - expired
                       - errored
+                      type: string
                     url:
                       description: URL is the URL of the Authorization that must be
                         completed
@@ -589,18 +617,22 @@ spec:
                         if '*.example.com' is the DNS name being validated, this field
                         will be 'true' and the 'identifier' field will be 'example.com'.
                       type: boolean
+                  required:
+                  - url
+                  type: object
+                type: array
               certificate:
                 description: Certificate is a copy of the PEM encoded certificate
                   for this Order. This field will be populated after the order has
                   been successfully finalized with the ACME server, and the order
                   has transitioned to the 'valid' state.
-                type: string
                 format: byte
+                type: string
               failureTime:
                 description: FailureTime stores the time that this order failed. This
                   is used to influence garbage collection and back-off.
-                type: string
                 format: date-time
+                type: string
               finalizeURL:
                 description: FinalizeURL of the Order. This is used to obtain certificates
                   for this order once it has been completed.
@@ -612,7 +644,6 @@ spec:
               state:
                 description: State contains the current state of this Order resource.
                   States 'success' and 'expired' are 'final'
-                type: string
                 enum:
                 - valid
                 - ready
@@ -621,9 +652,234 @@ spec:
                 - invalid
                 - expired
                 - errored
+                type: string
               url:
                 description: URL of the Order. This will initially be empty when the
                   resource is first created. The Order controller will populate this
                   field when the Order is first processed. This field will be immutable
                   after it is initially set.
                 type: string
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.issuerRef.name
+      name: Issuer
+      priority: 1
+      type: string
+    - jsonPath: .status.reason
+      name: Reason
+      priority: 1
+      type: string
+    - description: CreationTimestamp is a timestamp representing the server time when
+        this object was created. It is not guaranteed to be set in happens-before
+        order across separate operations. Clients may not set this value. It is represented
+        in RFC3339 form and is in UTC.
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: Order is a type to represent an Order with an ACME server
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              commonName:
+                description: CommonName is the common name as specified on the DER
+                  encoded CSR. If specified, this value must also be present in `dnsNames`.
+                  This field must match the corresponding field on the DER encoded
+                  CSR.
+                type: string
+              dnsNames:
+                description: DNSNames is a list of DNS names that should be included
+                  as part of the Order validation process. This field must match the
+                  corresponding field on the DER encoded CSR.
+                items:
+                  type: string
+                type: array
+              issuerRef:
+                description: IssuerRef references a properly configured ACME-type
+                  Issuer which should be used to create this Order. If the Issuer
+                  does not exist, processing will be retried. If the Issuer is not
+                  an 'ACME' Issuer, an error will be returned and the Order will be
+                  marked as failed.
+                properties:
+                  group:
+                    description: Group of the resource being referred to.
+                    type: string
+                  kind:
+                    description: Kind of the resource being referred to.
+                    type: string
+                  name:
+                    description: Name of the resource being referred to.
+                    type: string
+                required:
+                - name
+                type: object
+              request:
+                description: Certificate signing request bytes in DER encoding. This
+                  will be used when finalizing the order. This field must be set on
+                  the order.
+                format: byte
+                type: string
+            required:
+            - dnsNames
+            - issuerRef
+            - request
+            type: object
+          status:
+            properties:
+              authorizations:
+                description: Authorizations contains data returned from the ACME server
+                  on what authorizations must be completed in order to validate the
+                  DNS names specified on the Order.
+                items:
+                  description: ACMEAuthorization contains data returned from the ACME
+                    server on an authorization that must be completed in order validate
+                    a DNS name on an ACME Order resource.
+                  properties:
+                    challenges:
+                      description: Challenges specifies the challenge types offered
+                        by the ACME server. One of these challenge types will be selected
+                        when validating the DNS name and an appropriate Challenge
+                        resource will be created to perform the ACME challenge process.
+                      items:
+                        description: Challenge specifies a challenge offered by the
+                          ACME server for an Order. An appropriate Challenge resource
+                          can be created to perform the ACME challenge process.
+                        properties:
+                          token:
+                            description: Token is the token that must be presented
+                              for this challenge. This is used to compute the 'key'
+                              that must also be presented.
+                            type: string
+                          type:
+                            description: Type is the type of challenge being offered,
+                              e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is
+                              the raw value retrieved from the ACME server. Only 'http-01'
+                              and 'dns-01' are supported by cert-manager, other values
+                              will be ignored.
+                            type: string
+                          url:
+                            description: URL is the URL of this challenge. It can
+                              be used to retrieve additional metadata about the Challenge
+                              from the ACME server.
+                            type: string
+                        required:
+                        - token
+                        - type
+                        - url
+                        type: object
+                      type: array
+                    identifier:
+                      description: Identifier is the DNS name to be validated as part
+                        of this authorization
+                      type: string
+                    initialState:
+                      description: InitialState is the initial state of the ACME authorization
+                        when first fetched from the ACME server. If an Authorization
+                        is already 'valid', the Order controller will not create a
+                        Challenge resource for the authorization. This will occur
+                        when working with an ACME server that enables 'authz reuse'
+                        (such as Let's Encrypt's production endpoint). If not set
+                        and 'identifier' is set, the state is assumed to be pending
+                        and a Challenge will be created.
+                      enum:
+                      - valid
+                      - ready
+                      - pending
+                      - processing
+                      - invalid
+                      - expired
+                      - errored
+                      type: string
+                    url:
+                      description: URL is the URL of the Authorization that must be
+                        completed
+                      type: string
+                    wildcard:
+                      description: Wildcard will be true if this authorization is
+                        for a wildcard DNS name. If this is true, the identifier will
+                        be the *non-wildcard* version of the DNS name. For example,
+                        if '*.example.com' is the DNS name being validated, this field
+                        will be 'true' and the 'identifier' field will be 'example.com'.
+                      type: boolean
+                  required:
+                  - url
+                  type: object
+                type: array
+              certificate:
+                description: Certificate is a copy of the PEM encoded certificate
+                  for this Order. This field will be populated after the order has
+                  been successfully finalized with the ACME server, and the order
+                  has transitioned to the 'valid' state.
+                format: byte
+                type: string
+              failureTime:
+                description: FailureTime stores the time that this order failed. This
+                  is used to influence garbage collection and back-off.
+                format: date-time
+                type: string
+              finalizeURL:
+                description: FinalizeURL of the Order. This is used to obtain certificates
+                  for this order once it has been completed.
+                type: string
+              reason:
+                description: Reason optionally provides more information about a why
+                  the order is in the current state.
+                type: string
+              state:
+                description: State contains the current state of this Order resource.
+                  States 'success' and 'expired' are 'final'
+                enum:
+                - valid
+                - ready
+                - pending
+                - processing
+                - invalid
+                - expired
+                - errored
+                type: string
+              url:
+                description: URL of the Order. This will initially be empty when the
+                  resource is first created. The Order controller will populate this
+                  field when the Order is first processed. This field will be immutable
+                  after it is initially set.
+                type: string
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

roles/kubernetes-apps/ingress_controller/cert_manager/templates/deploy-cert-manager.yml.j2

@@ -16,162 +16,153 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: cert-manager-cainjector
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: cainjector
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: cainjector
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  name: cert-manager-cainjector
+  namespace: {{ cert_manager_namespace }}
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: cainjector
-      app.kubernetes.io/instance: cert-manager
       app.kubernetes.io/component: cainjector
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: cainjector
   template:
     metadata:
       labels:
         app: cainjector
-        app.kubernetes.io/name: cainjector
-        app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: cainjector
-        helm.sh/chart: cert-manager-{{ cert_manager_version }}
+        app.kubernetes.io/instance: cert-manager
+        app.kubernetes.io/name: cainjector
     spec:
-      serviceAccountName: cert-manager-cainjector
       containers:
-        - name: cert-manager
+      - args:
-          image: "{{ cert_manager_cainjector_image_repo }}:{{ cert_manager_cainjector_image_tag }}"
+        - --v=2
-          imagePullPolicy: {{ k8s_image_pull_policy }}
+        - --leader-election-namespace=kube-system
-          args:
+        env:
-          - --v=2
+        - name: POD_NAMESPACE
-          - --leader-election-namespace=kube-system
+          valueFrom:
-          env:
+            fieldRef:
-          - name: POD_NAMESPACE
+              fieldPath: metadata.namespace
-            valueFrom:
+        image: "{{ cert_manager_cainjector_image_repo }}:{{ cert_manager_cainjector_image_tag }}"
-              fieldRef:
+        imagePullPolicy: {{ k8s_image_pull_policy }}
-                fieldPath: metadata.namespace
+        name: cert-manager
-          resources:
+        resources: {}
-            {}
+      serviceAccountName: cert-manager-cainjector
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: cert-manager
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager
+  namespace: {{ cert_manager_namespace }}
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: cert-manager
-      app.kubernetes.io/instance: cert-manager
       app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: cert-manager
   template:
     metadata:
+      annotations:
+        prometheus.io/path: /metrics
+        prometheus.io/port: "9402"
+        prometheus.io/scrape: "true"
       labels:
         app: cert-manager
-        app.kubernetes.io/name: cert-manager
-        app.kubernetes.io/instance: cert-manager
         app.kubernetes.io/component: controller
-        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/instance: cert-manager
-        helm.sh/chart: cert-manager-{{ cert_manager_version }}
+        app.kubernetes.io/name: cert-manager
-      annotations:
-        prometheus.io/path: "/metrics"
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: '9402'
     spec:
-      serviceAccountName: cert-manager
       containers:
-        - name: cert-manager
+      - args:
-          image: "{{ cert_manager_controller_image_repo }}:{{ cert_manager_controller_image_tag }}"
+        - --v=2
-          imagePullPolicy: {{ k8s_image_pull_policy }}
+        - --cluster-resource-namespace=$(POD_NAMESPACE)
-          args:
+        - --leader-election-namespace=kube-system
-          - --v=2
+        env:
-          - --cluster-resource-namespace=$(POD_NAMESPACE)
+        - name: POD_NAMESPACE
-          - --leader-election-namespace=kube-system
+          valueFrom:
-          ports:
+            fieldRef:
-          - containerPort: 9402
+              fieldPath: metadata.namespace
-            protocol: TCP
+        image: "{{ cert_manager_controller_image_repo }}:{{ cert_manager_controller_image_tag }}"
-          env:
+        imagePullPolicy: {{ k8s_image_pull_policy }}
-          - name: POD_NAMESPACE
+        name: cert-manager
-            valueFrom:
+        ports:
-              fieldRef:
+        - containerPort: 9402
-                fieldPath: metadata.namespace
+          protocol: TCP
-          resources:
+        resources: {}
-            {}
+      serviceAccountName: cert-manager
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: cert-manager-webhook
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: webhook
+  name: cert-manager-webhook
+  namespace: {{ cert_manager_namespace }}
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: webhook
-      app.kubernetes.io/instance: cert-manager
       app.kubernetes.io/component: webhook
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: webhook
   template:
     metadata:
       labels:
         app: webhook
-        app.kubernetes.io/name: webhook
-        app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: webhook
-        helm.sh/chart: cert-manager-{{ cert_manager_version }}
+        app.kubernetes.io/instance: cert-manager
+        app.kubernetes.io/name: webhook
     spec:
-      serviceAccountName: cert-manager-webhook
       containers:
-        - name: cert-manager
+      - args:
-          image: "{{ cert_manager_webhook_image_repo }}:{{ cert_manager_webhook_image_tag }}"
+        - --v=2
-          imagePullPolicy: {{ k8s_image_pull_policy }}
+        - --secure-port=10250
-          args:
+        - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
-          - --v=2
+        - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
-          - --secure-port=10250
+        - --dynamic-serving-dns-names=cert-manager-webhook,cert-manager-webhook.{{ cert_manager_namespace }},cert-manager-webhook.{{ cert_manager_namespace }}.svc
-          - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
+        env:
-          - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
+        - name: POD_NAMESPACE
-          - --dynamic-serving-dns-names=cert-manager-webhook,cert-manager-webhook.cert-manager,cert-manager-webhook.cert-manager.svc
+          valueFrom:
-          ports:
+            fieldRef:
-          - name: https
+              fieldPath: metadata.namespace
-            containerPort: 10250
+        image: "{{ cert_manager_webhook_image_repo }}:{{ cert_manager_webhook_image_tag }}"
-          livenessProbe:
+        imagePullPolicy: {{ k8s_image_pull_policy }}
-            httpGet:
+        livenessProbe:
-              path: /livez
+          failureThreshold: 3
-              port: 6080
+          httpGet:
-              scheme: HTTP
+            path: /livez
-            initialDelaySeconds: 60
+            port: 6080
-            periodSeconds: 10
+            scheme: HTTP
-          readinessProbe:
+          initialDelaySeconds: 60
-            httpGet:
+          periodSeconds: 10
-              path: /healthz
+          successThreshold: 1
-              port: 6080
+          timeoutSeconds: 1
-              scheme: HTTP
+        name: cert-manager
-            initialDelaySeconds: 5
+        ports:
-            periodSeconds: 5
+        - containerPort: 10250
-          env:
+          name: https
-          - name: POD_NAMESPACE
+        readinessProbe:
-            valueFrom:
+          failureThreshold: 3
-              fieldRef:
+          httpGet:
-                fieldPath: metadata.namespace
+            path: /healthz
-          resources:
+            port: 6080
-            {}
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+      serviceAccountName: cert-manager-webhook

roles/kubernetes-apps/ingress_controller/cert_manager/templates/role-cert-manager.yml.j2

@@ -16,70 +16,85 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: cert-manager-cainjector:leaderelection
-  namespace: kube-system
   labels:
     app: cainjector
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: cainjector
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  name: cert-manager-cainjector:leaderelection
+  namespace: kube-system
 rules:
-  # Used for leader election by the controller
+- apiGroups:
-  # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller
+  - ""
-  #   see cmd/cainjector/start.go#L113
+  resourceNames:
-  # cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller
+  - cert-manager-cainjector-leader-election
-  #   see cmd/cainjector/start.go#L137
+  - cert-manager-cainjector-leader-election-core
-  - apiGroups: [""]
+  resources:
-    resources: ["configmaps"]
+  - configmaps
-    resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"]
+  verbs:
-    verbs: ["get", "update", "patch"]
+  - get
-  - apiGroups: [""]
+  - update
-    resources: ["configmaps"]
+  - patch
-    verbs: ["create"]
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: cert-manager:leaderelection
-  namespace: kube-system
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager:leaderelection
+  namespace: kube-system
 rules:
-  # Used for leader election by the controller
+- apiGroups:
-  - apiGroups: [""]
+  - ""
-    resources: ["configmaps"]
+  resourceNames:
-    resourceNames: ["cert-manager-controller"]
+  - cert-manager-controller
-    verbs: ["get", "update", "patch"]
+  resources:
-  - apiGroups: [""]
+  - configmaps
-    resources: ["configmaps"]
+  verbs:
-    verbs: ["create"]
+  - get
+  - update
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: cert-manager-webhook:dynamic-serving
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: webhook
+  name: cert-manager-webhook:dynamic-serving
+  namespace: {{ cert_manager_namespace }}
 rules:
-- apiGroups: [""]
+- apiGroups:
-  resources: ["secrets"]
+  - ""
   resourceNames:
-  - 'cert-manager-webhook-ca'
+  - cert-manager-webhook-ca
-  verbs: ["get", "list", "watch", "update"]
+  resources:
-# It's not possible to grant CREATE permission on a single resourceName.
+  - secrets
-- apiGroups: [""]
+  verbs:
-  resources: ["secrets"]
+  - get
-  verbs: ["create"]
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create

roles/kubernetes-apps/ingress_controller/cert_manager/templates/rolebinding-cert-manager.yml.j2

@@ -16,58 +16,52 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: cert-manager-cainjector:leaderelection
-  namespace: kube-system
   labels:
     app: cainjector
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: cainjector
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  name: cert-manager-cainjector:leaderelection
+  namespace: kube-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: cert-manager-cainjector:leaderelection
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: cert-manager-cainjector
+  name: cert-manager-cainjector
-    namespace: {{ cert_manager_namespace }}
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: cert-manager:leaderelection
-  namespace: kube-system
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager:leaderelection
+  namespace: kube-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: cert-manager:leaderelection
 subjects:
-  - apiGroup: ""
+- apiGroup: ""
-    kind: ServiceAccount
+  kind: ServiceAccount
-    name: cert-manager
+  name: cert-manager
-    namespace: {{ cert_manager_namespace }}
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: cert-manager-webhook:dynamic-serving
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: webhook
+  name: cert-manager-webhook:dynamic-serving
+  namespace: {{ cert_manager_namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role

roles/kubernetes-apps/ingress_controller/cert_manager/templates/sa-cert-manager.yml.j2

@@ -16,38 +16,32 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: cert-manager-cainjector
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: cainjector
-    app.kubernetes.io/name: cainjector
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: cainjector
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  name: cert-manager-cainjector
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: cert-manager
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager
+  namespace: {{ cert_manager_namespace }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: cert-manager-webhook
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: webhook
+  name: cert-manager-webhook
+  namespace: {{ cert_manager_namespace }}

roles/kubernetes-apps/ingress_controller/cert_manager/templates/svc-cert-manager.yml.j2

@@ -16,45 +16,41 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: cert-manager
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager
+  namespace: {{ cert_manager_namespace }}
 spec:
-  type: ClusterIP
   ports:
-    - protocol: TCP
+  - port: 9402
-      port: 9402
+    protocol: TCP
-      targetPort: 9402
+    targetPort: 9402
   selector:
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  type: ClusterIP
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: cert-manager-webhook
-  namespace: {{ cert_manager_namespace }}
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: webhook
+  name: cert-manager-webhook
+  namespace: {{ cert_manager_namespace }}
 spec:
-  type: ClusterIP
   ports:
   - name: https
     port: 443
     targetPort: 10250
   selector:
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: webhook
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: webhook
+  type: ClusterIP

roles/kubernetes-apps/ingress_controller/cert_manager/templates/webhook-cert-manager.yml.j2

@@ -13,82 +13,82 @@
 # limitations under the License.
 
 ---
-apiVersion: admissionregistration.k8s.io/v1beta1
+apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
-  name: cert-manager-webhook
+  annotations:
+    cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
-  annotations:
+    app.kubernetes.io/name: webhook
-    cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
+  name: cert-manager-webhook
 webhooks:
-  - name: webhook.cert-manager.io
+- admissionReviewVersions:
-    rules:
+  - v1
-      - apiGroups:
+  - v1beta1
-          - "cert-manager.io"
+  clientConfig:
-          - "acme.cert-manager.io"
+    service:
-        apiVersions:
+      name: cert-manager-webhook
-          - "*"
+      namespace: {{ cert_manager_namespace }}
-        operations:
+      path: /mutate
-          - CREATE
+  failurePolicy: Fail
-          - UPDATE
+  name: webhook.cert-manager.io
-        resources:
+  rules:
-          - "*/*"
+  - apiGroups:
-    failurePolicy: Fail
+    - cert-manager.io
-    # Only include 'sideEffects' field in Kubernetes 1.12+
+    - acme.cert-manager.io
-    sideEffects: None
+    apiVersions:
-    clientConfig:
+    - '*'
-      service:
+    operations:
-        name: cert-manager-webhook
+    - CREATE
-        namespace: {{ cert_manager_namespace }}
+    - UPDATE
-        path: /mutate
+    resources:
+    - '*/*'
+  sideEffects: None
 ---
-apiVersion: admissionregistration.k8s.io/v1beta1
+apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
-  name: cert-manager-webhook
+  annotations:
+    cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
   labels:
     app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: webhook
-    helm.sh/chart: cert-manager-{{ cert_manager_version }}
+    app.kubernetes.io/instance: cert-manager
-  annotations:
+    app.kubernetes.io/name: webhook
-    cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
+  name: cert-manager-webhook
 webhooks:
-  - name: webhook.cert-manager.io
+- admissionReviewVersions:
-    namespaceSelector:
+  - v1
-      matchExpressions:
+  - v1beta1
-      - key: "cert-manager.io/disable-validation"
+  clientConfig:
-        operator: "NotIn"
+    service:
-        values:
+      name: cert-manager-webhook
-        - "true"
+      namespace: {{ cert_manager_namespace }}
-      - key: "name"
+      path: /validate
-        operator: "NotIn"
+  failurePolicy: Fail
-        values:
+  name: webhook.cert-manager.io
-        - cert-manager
+  namespaceSelector:
-    rules:
+    matchExpressions:
-      - apiGroups:
+    - key: cert-manager.io/disable-validation
-          - "cert-manager.io"
+      operator: NotIn
-          - "acme.cert-manager.io"
+      values:
-        apiVersions:
+      - "true"
-          - "*"
+    - key: name
-        operations:
+      operator: NotIn
-          - CREATE
+      values:
-          - UPDATE
+      - cert-manager
-        resources:
+  rules:
-          - "*/*"
+  - apiGroups:
-    failurePolicy: Fail
+    - cert-manager.io
-    # Only include 'sideEffects' field in Kubernetes 1.12+
+    - acme.cert-manager.io
-    sideEffects: None
+    apiVersions:
-    clientConfig:
+    - '*'
-      service:
+    operations:
-        name: cert-manager-webhook
+    - CREATE
-        namespace: {{ cert_manager_namespace }}
+    - UPDATE
-        path: /validate
+    resources:
+    - '*/*'
+  sideEffects: None