# Not a self-signed cert hand-copied into a Secret like
# ~/dev/kong/kube/gateway/apigw/secret.yaml does — issuer is per-domain/env
# config (e.g. sttlab-local-ca ClusterIssuer for local, a real ACME issuer
# for prod), not hardcoded here.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ${NAME}
  namespace: ${NAMESPACE}
spec:
  secretName: ${NAME}-tls
  dnsNames:
    - ${HOSTNAME}
  issuerRef:
    kind: ${TLS_ISSUER_KIND}
    name: ${TLS_ISSUER_NAME}