{{- if or .Values.crds.enabled .Values.installCRDs }}
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: "orders.acme.cert-manager.io"
  {{- if .Values.crds.keep }}
  annotations:
    helm.sh/resource-policy: keep
  {{- end }}
  labels:
    {{- include "cert-manager.crd-labels" . | nindent 4 }}
spec:
  group: acme.cert-manager.io
  names:
    categories:
      - cert-manager
      - cert-manager-acme
    kind: Order
    listKind: OrderList
    plural: orders
    singular: order
  scope: Namespaced
  versions:
    - additionalPrinterColumns:
        - jsonPath: .status.state
          name: State
          type: string
        - jsonPath: .spec.issuerRef.name
          name: Issuer
          priority: 1
          type: string
        - jsonPath: .status.reason
          name: Reason
          priority: 1
          type: string
        - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
          jsonPath: .metadata.creationTimestamp
          name: Age
          type: date
      name: v1
      schema:
        openAPIV3Schema:
          description: Order is a type to represent an Order with an ACME server
          properties:
            apiVersion:
              description: |-
                APIVersion defines the versioned schema of this representation of an object.
                Servers should convert recognized schemas to the latest internal value, and
                may reject unrecognized values.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              type: string
            kind:
              description: |-
                Kind is a string value representing the REST resource this object represents.
                Servers may infer this from the endpoint the client submits requests to.
                Cannot be updated.
                In CamelCase.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              type: string
            metadata:
              type: object
            spec:
              properties:
                commonName:
                  description: |-
                    CommonName is the common name as specified on the DER encoded CSR.
                    If specified, this value must also be present in `dnsNames` or `ipAddresses`.
                    This field must match the corresponding field on the DER encoded CSR.
                  type: string
                dnsNames:
                  description: |-
                    DNSNames is a list of DNS names that should be included as part of the Order
                    validation process.
                    This field must match the corresponding field on the DER encoded CSR.
                  items:
                    type: string
                  type: array
                  x-kubernetes-list-type: atomic
                duration:
                  description: |-
                    Duration is the duration for the not after date for the requested certificate.
                    This is set on order creation as per the ACME spec.
                  type: string
                ipAddresses:
                  description: |-
                    IPAddresses is a list of IP addresses that should be included as part of the Order
                    validation process.
                    This field must match the corresponding field on the DER encoded CSR.
                  items:
                    type: string
                  type: array
                  x-kubernetes-list-type: atomic
                issuerRef:
                  description: |-
                    IssuerRef references a properly configured ACME-type Issuer which should
                    be used to create this Order.
                    If the Issuer does not exist, processing will be retried.
                    If the Issuer is not an 'ACME' Issuer, an error will be returned and the
                    Order will be marked as failed.
                  properties:
                    group:
                      description: |-
                        Group of the issuer being referred to.
                        Defaults to 'cert-manager.io'.
                      type: string
                    kind:
                      description: |-
                        Kind of the issuer being referred to.
                        Defaults to 'Issuer'.
                      type: string
                    name:
                      description: Name of the issuer being referred to.
                      type: string
                  required:
                    - name
                  type: object
                profile:
                  description: |-
                    Profile allows requesting a certificate profile from the ACME server.
                    Supported profiles are listed by the server's ACME directory URL.
                  type: string
                replaces:
                  description: |-
                    Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this
                    Order is intended to replace. When set, cert-manager will include the
                    "replaces" field on the newOrder request to the ACME server if and only
                    if the server advertises ARI support in its directory. The CertID has
                    the form "base64url(AKI).base64url(serial)" and is derived locally from
                    the currently issued leaf certificate.
                  type: string
                request:
                  description: |-
                    Certificate signing request bytes in DER encoding.
                    This will be used when finalizing the order.
                    This field must be set on the order.
                  format: byte
                  type: string
              required:
                - issuerRef
                - request
              type: object
            status:
              properties:
                authorizations:
                  description: |-
                    Authorizations contains data returned from the ACME server on what
                    authorizations must be completed in order to validate the DNS names
                    specified on the Order.
                  items:
                    description: |-
                      ACMEAuthorization contains data returned from the ACME server on an
                      authorization that must be completed in order validate a DNS name on an ACME
                      Order resource.
                    properties:
                      challenges:
                        description: |-
                          Challenges specifies the challenge types offered by the ACME server.
                          One of these challenge types will be selected when validating the DNS
                          name and an appropriate Challenge resource will be created to perform
                          the ACME challenge process.
                        items:
                          description: |-
                            Challenge specifies a challenge offered by the ACME server for an Order.
                            An appropriate Challenge resource can be created to perform the ACME
                            challenge process.
                          properties:
                            token:
                              description: |-
                                Token is the token that must be presented for this challenge.
                                This is used to compute the 'key' that must also be presented.
                              type: string
                            type:
                              description: |-
                                Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
                                'tls-sni-01', etc.
                                This is the raw value retrieved from the ACME server.
                                Only 'http-01' and 'dns-01' are supported by cert-manager, other values
                                will be ignored.
                              type: string
                            url:
                              description: |-
                                URL is the URL of this challenge. It can be used to retrieve additional
                                metadata about the Challenge from the ACME server.
                              type: string
                          required:
                            - token
                            - type
                            - url
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      identifier:
                        description: Identifier is the DNS name to be validated as part of this authorization
                        type: string
                      initialState:
                        description: |-
                          InitialState is the initial state of the ACME authorization when first
                          fetched from the ACME server.
                          If an Authorization is already 'valid', the Order controller will not
                          create a Challenge resource for the authorization. This will occur when
                          working with an ACME server that enables 'authz reuse' (such as Let's
                          Encrypt's production endpoint).
                          If not set and 'identifier' is set, the state is assumed to be pending
                          and a Challenge will be created.
                        enum:
                          - valid
                          - ready
                          - pending
                          - processing
                          - invalid
                          - expired
                          - errored
                        type: string
                      url:
                        description: URL is the URL of the Authorization that must be completed
                        type: string
                      wildcard:
                        description: |-
                          Wildcard will be true if this authorization is for a wildcard DNS name.
                          If this is true, the identifier will be the *non-wildcard* version of
                          the DNS name.
                          For example, if '*.example.com' is the DNS name being validated, this
                          field will be 'true' and the 'identifier' field will be 'example.com'.
                        type: boolean
                    required:
                      - url
                    type: object
                  type: array
                  x-kubernetes-list-type: atomic
                certificate:
                  description: |-
                    Certificate is a copy of the PEM encoded certificate for this Order.
                    This field will be populated after the order has been successfully
                    finalized with the ACME server, and the order has transitioned to the
                    'valid' state.
                  format: byte
                  type: string
                failureTime:
                  description: |-
                    FailureTime stores the time that this order failed.
                    This is used to influence garbage collection and back-off.
                  format: date-time
                  type: string
                finalizeURL:
                  description: |-
                    FinalizeURL of the Order.
                    This is used to obtain certificates for this order once it has been completed.
                  type: string
                reason:
                  description: |-
                    Reason optionally provides more information about a why the order is in
                    the current state.
                  type: string
                state:
                  description: |-
                    State contains the current state of this Order resource.
                    States 'success' and 'expired' are 'final'
                  enum:
                    - valid
                    - ready
                    - pending
                    - processing
                    - invalid
                    - expired
                    - errored
                  type: string
                url:
                  description: |-
                    URL of the Order.
                    This will initially be empty when the resource is first created.
                    The Order controller will populate this field when the Order is first processed.
                    This field will be immutable after it is initially set.
                  type: string
              type: object
          required:
            - metadata
            - spec
          type: object
      selectableFields:
        - jsonPath: .spec.issuerRef.group
        - jsonPath: .spec.issuerRef.kind
        - jsonPath: .spec.issuerRef.name
      served: true
      storage: true
      subresources:
        status: {}
{{- end }}