---
# TSIG key cert-manager uses to send RFC2136 dynamic updates (the DNS-01 TXT
# records) to the primary, and that the secondary reuses for AXFR. The operator
# generates the material into Secret certmanager-tsig in this namespace;
# secretTemplate stamps emberstack reflector hints so the Secret is mirrored into
# the cert-manager namespace, where the rfc2136 solver reads its "secret" key.
apiVersion: bind.unkin.net/v1alpha1
kind: BindTSIGKey
metadata:
  name: certmanager
  namespace: bind-external
spec:
  clusterRef: bind-external
  algorithm: hmac-sha256
  secretTemplate:
    annotations:
      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cert-manager"
      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cert-manager"