Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/certificates/base/apiserver.yaml

@@ -0,0 +1,14 @@
+apiVersion: config.openshift.io/v1
+kind: APIServer
+metadata:
+  name: cluster
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true
+spec:
+  servingCerts:
+    namedCertificates:
+    - names:
+      - api.${BASE_DOMAIN}
+      servingCertificate:
+        name: openshift-api-certificate

cluster-config/components/certificates/base/ingresscontroller.yaml

@@ -0,0 +1,11 @@
+apiVersion: operator.openshift.io/v1
+kind: IngressController
+metadata:
+  name: default
+  namespace: openshift-ingress-operator
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true
+spec:
+  defaultCertificate:
+    name: openshift-wildcard-certificate

cluster-config/components/certificates/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - openshift-api-certificate.yaml
+  - openshift-wildcard-certificate.yaml
+  - apiserver.yaml
+  - ingresscontroller.yaml

cluster-config/components/certificates/base/openshift-api-certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: openshift-api
+  namespace: openshift-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  secretName: openshift-api-certificate
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - api.${BASE_DOMAIN}

cluster-config/components/certificates/base/openshift-wildcard-certificate.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: openshift-wildcard
+  namespace: openshift-ingress
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  secretName: openshift-wildcard-certificate
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  commonName: '*.${SUB_DOMAIN}'
+  dnsNames:
+  - '*.${SUB_DOMAIN}'