apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: gnunn@redhat.com
    # This key doesn't exist, cert-manager creates it
    privateKeySecretRef:
      name: gnunn-redhat-issuer-account-key
    solvers:
    - selector:
        dnsZones:
          - "ocplab.com"
      dns01:
        route53:
          region: ca-central-1
          accessKeyID: AKIAVW7HGAZVWLIKXRCA
          hostedZoneID: Z1LKUX3GLO9GW9
          secretAccessKeySecretRef:
            name: letsencrypt-aws
            key: secret-access-key