---
# Source: trust-manager/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: trust-manager
  namespace: default
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
---
# Source: trust-manager/templates/clusterrole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
  name: trust-manager
rules:
- apiGroups:
  - "trust.cert-manager.io"
  resources:
  - "bundles"
  verbs: ["get", "list", "watch"]

# Permissions to update finalizers are required for trust-manager to work correctly
# on OpenShift, even though we don't directly use finalizers at the time of writing
- apiGroups:
  - "trust.cert-manager.io"
  resources:
  - "bundles/finalizers"
  verbs: ["update"]

- apiGroups:
  - "trust.cert-manager.io"
  resources:
  - "bundles/status"
  verbs: ["patch"]

- apiGroups:
  - ""
  resources:
  - "namespaces"
  verbs: ["get", "list", "watch"]
- apiGroups:
  - ""
  resources:
  - "configmaps"
  verbs: ["get","list","create","patch","watch","delete"]

- apiGroups:
  - ""
  - "events.k8s.io"
  resources:
  - "events"
  verbs: ["create","patch"]
---
# Source: trust-manager/templates/clusterrolebinding.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
  name: trust-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: trust-manager
subjects:
- kind: ServiceAccount
  name: trust-manager
  namespace: default
---
# Source: trust-manager/templates/role.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: trust-manager
  namespace: cert-manager
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
  - ""
  resources:
  - "secrets"
  verbs:
  - "get"
  - "list"
  - "watch"
---
# Source: trust-manager/templates/role.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: trust-manager:leaderelection
  namespace: default
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
  - "coordination.k8s.io"
  resources:
  - "leases"
  verbs:
  - "get"
  - "create"
  - "update"
  - "watch"
  - "list"
---
# Source: trust-manager/templates/rolebinding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: trust-manager
  namespace: cert-manager
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: trust-manager
subjects:
- kind: ServiceAccount
  name: trust-manager
  namespace: default
---
# Source: trust-manager/templates/rolebinding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: trust-manager:leaderelection
  namespace: default
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: trust-manager:leaderelection
subjects:
- kind: ServiceAccount
  name: trust-manager
  namespace: default
---
# Source: trust-manager/templates/metrics-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: trust-manager-metrics
  namespace: default
  labels:
    app: trust-manager
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 9402
      targetPort: 9402
      protocol: TCP
      name: metrics
  selector:
    app: trust-manager
---
# Source: trust-manager/templates/webhook.yaml
apiVersion: v1
kind: Service
metadata:
  name: trust-manager
  namespace: default
  labels:
    app: trust-manager
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 443
      targetPort: 6443
      protocol: TCP
      name: webhook
  selector:
    app: trust-manager
---
# Source: trust-manager/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: trust-manager
  namespace: default
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: trust-manager
  template:
    metadata:
      labels:
        app: trust-manager
        app.kubernetes.io/name: trust-manager
        helm.sh/chart: trust-manager-v0.22.1
        app.kubernetes.io/instance: trust-manager
        app.kubernetes.io/version: "v0.22.1"
        app.kubernetes.io/managed-by: Helm
    spec:
      serviceAccountName: trust-manager
      automountServiceAccountToken: true
      initContainers:
      - name: cert-manager-package-debian
        image: "quay.io/jetstack/trust-pkg-debian-bookworm:20230311-deb12u1.6"
        imagePullPolicy: IfNotPresent
        args:
          - "/copyandmaybepause"
          - "/debian-package"
          - "/packages"
        volumeMounts:
        - mountPath: /packages
          name: packages
          readOnly: false
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
      containers:
      - name: trust-manager
        image: "quay.io/jetstack/trust-manager:v0.22.1"
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 6443
          name: webhook # for the PodMonitor port field
        - containerPort: 9402
          name: metrics # for the PodMonitor port field
        readinessProbe:
          httpGet:
            port: 6060
            path: /readyz
          initialDelaySeconds: 3
          periodSeconds: 7
        args:
          - "--log-format=text"
          - "--log-level=1"
          - "--metrics-port=9402"
          - "--readiness-probe-port=6060"
          - "--readiness-probe-path=/readyz"
          - "--leader-elect=true"
          - "--leader-election-lease-duration=15s"
          - "--leader-election-renew-deadline=10s"
            # trust
          - "--trust-namespace=cert-manager"
            # webhook
          - "--webhook-host=0.0.0.0"
          - "--webhook-port=6443"
          - "--webhook-certificate-dir=/tls"
          - "--default-package-location=/packages/cert-manager-package-debian.json"
        volumeMounts:
        - mountPath: /tls
          name: tls
          readOnly: true
        - mountPath: /packages
          name: packages
          readOnly: true
        resources:
            {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
      - name: packages
        emptyDir:
          sizeLimit: 50M
      - name: tls
        secret:
          defaultMode: 420
          secretName: trust-manager-tls
---
# Source: trust-manager/templates/webhook.yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: trust-manager
  labels:
    app: trust-manager
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
  annotations:
    cert-manager.io/inject-ca-from: "default/trust-manager"
webhooks:
  - name: trust.cert-manager.io
    rules:
      - apiGroups:
          - "trust.cert-manager.io"
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - bundles
    admissionReviewVersions: ["v1"]
    timeoutSeconds: 5
    failurePolicy: Fail
    sideEffects: None
    clientConfig:

      service:
        name: trust-manager
        namespace: default
        path: /validate-trust-cert-manager-io-v1alpha1-bundle
---
# Source: trust-manager/templates/certificate.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: trust-manager
  namespace: default
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
spec:
  commonName: "trust-manager.default.svc"
  dnsNames:
  - "trust-manager.default.svc"
  secretName: trust-manager-tls
  privateKey:
    rotationPolicy: Always
  revisionHistoryLimit: 1
  issuerRef:
    name: trust-manager
    kind: Issuer
    group: cert-manager.io
---
# Source: trust-manager/templates/certificate.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: trust-manager
  namespace: default
  labels:
    app.kubernetes.io/name: trust-manager
    helm.sh/chart: trust-manager-v0.22.1
    app.kubernetes.io/instance: trust-manager
    app.kubernetes.io/version: "v0.22.1"
    app.kubernetes.io/managed-by: Helm
spec:
  selfSigned: {}