---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: vault-issuer
  labels:
    app.kubernetes.io/instance: cert-manager-config
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cert-manager-config
  annotations:
    meta.helm.sh/release-name: cert-manager-clusterissuer
    meta.helm.sh/release-namespace: cert-manager
spec:
  vault:
    server: https://vault.service.consul:8200
    path: pki_int/sign/servers_default
    caBundleSecretRef:
      key: ca.crt
      name: vault-ca-cert
    auth:
      kubernetes:
        mountPath: /v1/auth/k8s/au/syd1
        role: cert_manager_issuer
        serviceAccountRef:
          name: cert-manager-vault-issuer
          audiences:
            - vault