Proposal for cert-manager CRD format

cert-manager-letsencrypt.yaml

# This would create a certificate valid for www.google.com, twitter.com and yahoo.com
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: production-crt
spec:
  secret: production-crt
  issuer: letsencrypt-prod
  domains:
  - www.google.com
  - twitter.com
  - yahoo.com
  acme:
    config:
    - domains:
      - www.google.com
        http-01:
          # if the ingress resource already exists, we modify it to add our path
          # instead of creating our own ingress resource (to support gce). if
          # this is blank, a temporary ingress resource will be used
          ingress: google-com
    - domains:
      - twitter.com
      http-01:
        ingressClass: nginx
    - domains:
      - yahoo.com
      dns-01:
        provider: yahoo-services
status:
  state: Pending
  acme:
    authorizations:
    - domain: www.google.com
      uri: http://letsencrypt-prod.org/authorization/123123
    - domain: twitter.com
    - domain: yahoo.com
      uri: http://letsencrypt-prod.org/authorization/123124
---

cert-manager-vault.yaml

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: facebook-crt
spec:
  secret: facebook-crt
  issuer: vault-staging
  domains:
  - www.facebook.com
  - facebook.com
  vault:
    role: http-server
status:
  state: Ready

---
# letsencrypt issuer resource
apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: vault-staging
spec:
  vault:
    url: https://vault.vault.svc.cluster.local
    path: pki/prod-ca/
    auth:
      token:
        secretName: vault-staging-token
status:
  ready: true

letsencrypt-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: foo
  annotations:
    certmanager.kubernetes.io/tls: "true"
    certmanager.kubernetes.io/issuer: letsencrypt-prod
    certmanager.kubernetes.io/acme-challenge-type: dns-01
    certmanager.kubernetes.io/acme-dns-01-provider: clouddns-staging
spec:
  tls:
  - hosts:
    - foo.bar.com
    - www.foo.bar.com
    secretName: foo-bar-com
  rules:
  - host: foo.bar.com
    http:
      paths:
      - backend:
          serviceName: echoheaders-x
          servicePort: 80
        path: /
  - host: www.foo.bar.com
    http:
      paths:
      - backend:
          serviceName: echoheaders-x
          servicePort: 80
        path: /
---
## This ingress resource would cause cert-manager to create the follow Certificate resource automatically
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: production-crt
spec:
  secret: foo-bar-com
  issuer: letsencrypt-prod
  domains:
  - foo.bar.com
  - ww.foo.bar.com
  acme:
    config:
    - domains:
      - foo.bar.com
      - www.foo.bar.com
      dns-01:
        provider: clouddns-staging
status:
  state: Ready
  acme:
    authorizations:
    - domain: www.foo.bar.com
      uri: http://letsencrypt-prod.org/authorization/123123
    - domain: foo.bar.com
      uri: http://letsencrypt-prod.org/authorization/123124

letsencrypt-issuer.yaml

# letsencrypt issuer resource
apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    url: https://letsencrypt-prod.org/directory
    email: james@jetstack.io
    privateKey: james-letsencrypt-prod
    # dns-01 config options
    dns-01:
      providers:
      - name: yahoo-services
        rackspace:
          username: yahoo-admin
          apiKeySecret: yahoo-services-aws-key
      - name: clouddns-staging
        clouddns:
          serviceAccount: service-account-secret-staging
          project: googles-corp-project
status:
  ready: true
---