apiVersion: v1
kind: Secret
metadata:
  name: phase-service-token
  namespace: phase-secrets-operator
type: Opaque
data:
  token: cHNzX3NlcnZpY2U6djI6ZTEwMTZiMjQ2NjBiNzY2YTc4MGNiZTZiOWRiZThhMWFjNmNjNTBlNzliYTIzMGJmNjBkMjg2NWQ2ZWRmY2M1ODpkODhkZmEyNTFiMjE1NWQ2NDJhYjdkZmNkNzliZDk1MmFhMDBkYzNhMDU3OTZkMWQxYjg0NmIyOThiMzlmOTBmOjZjNDQxNGJiZjg5Y2ExOTgwNTdmZjEwMmIzYzQxYzRmMzViODQ5OTk0NzM1NjhkOGZjMmM3M2JjNTg0MjgzMWQ6YmQ0MDU2ZWExYTU0ZDgyNDkwOTI4NjRmYmNkODRjZDU0NmUzOTE0MmVhNDQ0M2E3NGYxMjRlN2ViYmQ1YjY3ZQ==

---
apiVersion: secrets.phase.dev/v1alpha1
kind: PhaseSecret
metadata:
  name: cloudflare-api-key-phase-secret
  namespace: phase-secrets-operator
spec:
  phaseApp: 'cert-manager' # The name of your Phase application
  phaseAppEnv: 'production' # OPTIONAL - The Phase App Environment to fetch secrets from
  phaseAppEnvPath: '/' # OPTIONAL Path within the Phase application environment to fetch secrets from
  phaseHost: 'https://phase.hnrx.net' # OPTIONAL - URL of a Phase Console instance
  pollingInterval: 600 # OPTIONAL - Interval in seconds to poll for secret updates
  authentication:
    serviceToken:
      serviceTokenSecretReference:
        secretName: 'phase-service-token' # Name of the Phase Service Token with access to your application
        secretNamespace: 'phase-secrets-operator'
  managedSecretReferences:
    - secretName: 'cloudflare-api-key' # Name of the Kubernetes managed secret that Phase will sync
      secretNamespace: 'cert-manager'

---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: cloudflare-cluster-issuer
spec:
  acme:
    email: matthias.hinrichs@me.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: cluster-issuer-account-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-key
              key: CLOUDFLARE_API_KEY