---
# Source: cert-manager-csi-driver/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:

    app.kubernetes.io/name: cert-manager-csi-driver
    helm.sh/chart: cert-manager-csi-driver-v0.14.0
    app.kubernetes.io/instance: cert-manager-csi-driver
    app.kubernetes.io/version: "v0.14.0"
    app.kubernetes.io/managed-by: Helm
  name: cert-manager-csi-driver
  namespace: "default"
---
# Source: cert-manager-csi-driver/templates/clusterrole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:

    app.kubernetes.io/name: cert-manager-csi-driver
    helm.sh/chart: cert-manager-csi-driver-v0.14.0
    app.kubernetes.io/instance: cert-manager-csi-driver
    app.kubernetes.io/version: "v0.14.0"
    app.kubernetes.io/managed-by: Helm
  name: cert-manager-csi-driver
rules:
- apiGroups: ["cert-manager.io"]
  resources: ["certificaterequests"]
  verbs: ["watch", "create", "delete", "list"]
---
# Source: cert-manager-csi-driver/templates/clusterrolebinding.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:

    app.kubernetes.io/name: cert-manager-csi-driver
    helm.sh/chart: cert-manager-csi-driver-v0.14.0
    app.kubernetes.io/instance: cert-manager-csi-driver
    app.kubernetes.io/version: "v0.14.0"
    app.kubernetes.io/managed-by: Helm
  name: cert-manager-csi-driver
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-csi-driver
subjects:
- kind: ServiceAccount
  name: cert-manager-csi-driver
  namespace: default
---
# Source: cert-manager-csi-driver/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cert-manager-csi-driver
  namespace: "default"
  labels:

    app.kubernetes.io/name: cert-manager-csi-driver
    helm.sh/chart: cert-manager-csi-driver-v0.14.0
    app.kubernetes.io/instance: cert-manager-csi-driver
    app.kubernetes.io/version: "v0.14.0"
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app: cert-manager-csi-driver
  template:
    metadata:
      labels:
        app: cert-manager-csi-driver
        app.kubernetes.io/name: cert-manager-csi-driver
        helm.sh/chart: cert-manager-csi-driver-v0.14.0
        app.kubernetes.io/instance: cert-manager-csi-driver
        app.kubernetes.io/version: "v0.14.0"
        app.kubernetes.io/managed-by: Helm
      annotations:
        kubectl.kubernetes.io/default-container: cert-manager-csi-driver
    spec:
      securityContext:
        seccompProfile: { type: RuntimeDefault }
      serviceAccountName: cert-manager-csi-driver
      containers:

        - name: node-driver-registrar
          securityContext:
            runAsUser: 0
            allowPrivilegeEscalation: false
            capabilities: { drop: [ "ALL" ] }
            readOnlyRootFilesystem: true
          image: "quay.io/jetstack/csi-node-driver-registrar:v2.16.0"
          imagePullPolicy: IfNotPresent
          args:
            - -v=1
            - --csi-address=/plugin/csi.sock
            - --kubelet-registration-path=/var/lib/kubelet/plugins/cert-manager-csi-driver/csi.sock
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: plugin-dir
              mountPath: /plugin
            - name: registration-dir
              mountPath: /registration

        - name: liveness-probe
          securityContext:
            runAsUser: 0
            allowPrivilegeEscalation: false
            capabilities: { drop: [ "ALL" ] }
            readOnlyRootFilesystem: true
          image: "quay.io/jetstack/livenessprobe:v2.18.0"
          imagePullPolicy: IfNotPresent
          args:
            - --csi-address=/plugin/csi.sock
            - --probe-timeout=3s
            - --health-port=9809
            - -v=1
          volumeMounts:
            - name: plugin-dir
              mountPath: /plugin

        - name: cert-manager-csi-driver
          securityContext:
            runAsUser: 0
            privileged: true
            capabilities: { drop: [ "ALL" ] }
            readOnlyRootFilesystem: true
          image: "quay.io/jetstack/cert-manager-csi-driver:v0.14.0"
          imagePullPolicy: IfNotPresent
          args :
            - --log-level=1
            - --driver-name=csi.cert-manager.io
            - --node-id=$(NODE_ID)
            - --endpoint=$(CSI_ENDPOINT)
            - --data-root=csi-data-dir
            - --use-token-request=false
            - --continue-on-not-ready=false
            - --metrics-bind-address=:9402
          env:
            - name: NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: CSI_ENDPOINT
              value: unix://plugin/csi.sock
          volumeMounts:
            - name: plugin-dir
              mountPath: /plugin
            - name: pods-mount-dir
              mountPath: /var/lib/kubelet/pods
              mountPropagation: "Bidirectional"
            - name: csi-data-dir
              mountPath: /csi-data-dir
              mountPropagation: "Bidirectional"
          ports:
            - containerPort: 9809
              name: healthz
            - containerPort: 9402
              name: http-metrics
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
            initialDelaySeconds: 5
            timeoutSeconds: 5
      nodeSelector:
        kubernetes.io/os: linux

      volumes:
        - name: plugin-dir
          hostPath:
            path: /var/lib/kubelet/plugins/cert-manager-csi-driver
            type: DirectoryOrCreate
        - name: pods-mount-dir
          hostPath:
            path: /var/lib/kubelet/pods
            type: Directory
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory
        - name: csi-data-dir
          hostPath:
            path: /tmp/cert-manager-csi-driver
            type: DirectoryOrCreate
---
# Source: cert-manager-csi-driver/templates/csidriver.yaml
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: csi.cert-manager.io
  labels:

    app.kubernetes.io/name: cert-manager-csi-driver
    helm.sh/chart: cert-manager-csi-driver-v0.14.0
    app.kubernetes.io/instance: cert-manager-csi-driver
    app.kubernetes.io/version: "v0.14.0"
    app.kubernetes.io/managed-by: Helm
spec:
  podInfoOnMount: true
  volumeLifecycleModes:
  - Ephemeral