{#
  Managed by Ansible (roles/k3s_cert_manager) — do not edit on the node.

  The DNS provider API credentials the ACME DNS-01 solver authenticates with,
  passed through from Vault verbatim — same rule roles/k3s_app's Secret
  follows, so the key names in k3s_cert_manager_solver are whatever you chose
  when populating the Vault path, and this role stays ignorant of which
  provider is in use.

  In the cert-manager namespace because a ClusterIssuer resolves every Secret
  it references there, never in the namespace of the Certificate being
  issued.
-#}
apiVersion: v1
kind: Secret
metadata:
  name: {{ k3s_cert_manager_credentials_secret }}
  namespace: {{ k3s_cert_manager_namespace }}
type: Opaque
stringData:
{% for key, value in (cert_manager_vault_secrets | default({})) | dictsort %}
  {{ key }}: {{ value | string | to_json }}
{% endfor %}