Merge pull request #2513 from munnerz/add-v1alpha3

Create v1alpha3 API version

BUILD.bazel

@@ -57,7 +57,9 @@ filegroup(
         "//pkg/client/clientset/versioned:all-srcs",
         "//pkg/client/informers/externalversions:all-srcs",
         "//pkg/client/listers/acme/v1alpha2:all-srcs",
+        "//pkg/client/listers/acme/v1alpha3:all-srcs",
         "//pkg/client/listers/certmanager/v1alpha2:all-srcs",
+        "//pkg/client/listers/certmanager/v1alpha3:all-srcs",
         "//pkg/controller:all-srcs",
         "//pkg/feature:all-srcs",
         "//pkg/internal:all-srcs",

cmd/webhook/main.go

@@ -46,7 +46,7 @@ func init() {
 	flag.StringVar(&tlsKeyFile, "tls-private-key-file", "", "path to the file containing the TLS private key to serve with")
 }
 
-var validationHook handlers.ValidatingAdmissionHook = handlers.NewFuncBackedValidator(logs.Log, webhook.Scheme, webhook.Validators)
+var validationHook handlers.ValidatingAdmissionHook = handlers.NewRegistryBackedValidator(logs.Log, webhook.Scheme, webhook.ValidationRegistry)
 var mutationHook handlers.MutatingAdmissionHook = handlers.NewSchemeBackedDefaulter(logs.Log, webhook.Scheme)
 var conversionHook handlers.ConversionHook = handlers.NewSchemeBackedConverter(logs.Log, webhook.Scheme)
 

hack/update-all.sh

@@ -28,4 +28,3 @@ hack=$(dirname "${BASH_SOURCE[0]}")
 # This is already run automatically by update-deps.sh
 #"$hack"/update-deps-licenses.sh
 "$hack"/update-gofmt.sh
-"$hack"/update-reference-docs.sh

hack/update-codegen.sh

@@ -36,8 +36,10 @@ module_name="github.com/jetstack/cert-manager"
 # Generate deepcopy functions for all internal and external APIs
 deepcopy_inputs=(
   pkg/apis/certmanager/v1alpha2 \
+  pkg/apis/certmanager/v1alpha3 \
   pkg/internal/apis/certmanager \
   pkg/apis/acme/v1alpha2 \
+  pkg/apis/acme/v1alpha3 \
   pkg/internal/apis/acme \
   pkg/apis/meta/v1 \
   pkg/internal/apis/meta \
@@ -52,13 +54,17 @@ client_package="${module_name}/${client_subpackage}"
 # Generate clientsets, listers and informers for user-facing API types
 client_inputs=(
   pkg/apis/certmanager/v1alpha2 \
+  pkg/apis/certmanager/v1alpha3 \
   pkg/apis/acme/v1alpha2 \
+  pkg/apis/acme/v1alpha3 \
 )
 
 # Generate defaulting functions to be used by the mutating webhook
 defaulter_inputs=(
   pkg/internal/apis/certmanager/v1alpha2 \
+  pkg/internal/apis/certmanager/v1alpha3 \
   pkg/internal/apis/acme/v1alpha2 \
+  pkg/internal/apis/acme/v1alpha3 \
   pkg/internal/apis/meta/v1 \
   pkg/webhook/handlers/testdata/apis/testgroup/v2 \
   pkg/webhook/handlers/testdata/apis/testgroup/v1 \
@@ -67,7 +73,9 @@ defaulter_inputs=(
 # Generate conversion functions to be used by the conversion webhook
 conversion_inputs=(
   pkg/internal/apis/certmanager/v1alpha2 \
+  pkg/internal/apis/certmanager/v1alpha3 \
   pkg/internal/apis/acme/v1alpha2 \
+  pkg/internal/apis/acme/v1alpha3 \
   pkg/internal/apis/meta/v1 \
   pkg/webhook/handlers/testdata/apis/testgroup/v2 \
   pkg/webhook/handlers/testdata/apis/testgroup/v1 \
@@ -121,6 +129,15 @@ clean() {
   find "$path" -name "$name" -delete
 }
 
+mkcp() {
+  src="$1"
+  dst="$2"
+  mkdir -p "$(dirname "$dst")"
+  cp "$src" "$dst"
+}
+# Export mkcp for use in sub-shells
+export -f mkcp
+
 copyfiles() {
   # Don't copy data if the workspace directory is already within the GOPATH
   if [ "${BUILD_WORKSPACE_DIRECTORY:0:${#GOPATH}}" = "$GOPATH" ]; then
@@ -134,7 +151,8 @@ copyfiles() {
   fi
   (
     cd "$GOPATH/src/$module_name/$path"
-    find "." -name "$name" -exec cp {} "$BUILD_WORKSPACE_DIRECTORY/$path/{}" \;
+
+    find "." -name "$name" -exec bash -c "mkcp {} \"$BUILD_WORKSPACE_DIRECTORY/$path/{}\"" \;
   )
 }
 

pkg/api/BUILD.bazel

@@ -8,7 +8,9 @@ go_library(
     deps = [
         "//pkg/acme/webhook/apis/acme/v1alpha1:go_default_library",
         "//pkg/apis/acme/v1alpha2:go_default_library",
+        "//pkg/apis/acme/v1alpha3:go_default_library",
         "//pkg/apis/certmanager/v1alpha2:go_default_library",
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
         "//pkg/apis/meta/v1:go_default_library",
         "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",

pkg/api/scheme.go

@@ -28,7 +28,9 @@ import (
 
 	whapi "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
 	cmacme "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha2"
+	cmacmev1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
 	cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
+	cmapiv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
 	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
 )
 
@@ -46,7 +48,9 @@ var Codecs = serializer.NewCodecFactory(Scheme)
 var ParameterCodec = runtime.NewParameterCodec(Scheme)
 var localSchemeBuilder = runtime.SchemeBuilder{
 	cmapi.AddToScheme,
+	cmapiv1alpha3.AddToScheme,
 	cmacme.AddToScheme,
+	cmacmev1alpha3.AddToScheme,
 	cmmeta.AddToScheme,
 	whapi.AddToScheme,
 	kscheme.AddToScheme,

pkg/apis/acme/BUILD.bazel

@@ -19,6 +19,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//pkg/apis/acme/v1alpha2:all-srcs",
+        "//pkg/apis/acme/v1alpha3:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],

pkg/apis/acme/v1alpha3/BUILD.bazel

@@ -0,0 +1,40 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "const.go",
+        "doc.go",
+        "register.go",
+        "types.go",
+        "types_challenge.go",
+        "types_issuer.go",
+        "types_order.go",
+        "zz_generated.deepcopy.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/acme:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_api//core/v1:go_default_library",
+        "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/apis/acme/v1alpha3/const.go

@@ -0,0 +1,21 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+const (
+	ACMEFinalizer = "finalizer.acme.cert-manager.io"
+)

pkg/apis/acme/v1alpha3/doc.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha3 is the v1alpha3 version of the API.
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=github.com/jetstack/cert-manager/pkg/apis/acme
+// +k8s:openapi-gen=true
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=acme.cert-manager.io
+package v1alpha3

pkg/apis/acme/v1alpha3/register.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/jetstack/cert-manager/pkg/apis/acme"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: acme.GroupName, Version: "v1alpha3"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to api.Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Order{},
+		&OrderList{},
+		&Challenge{},
+		&ChallengeList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

pkg/apis/acme/v1alpha3/types.go

@@ -0,0 +1,43 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+const (
+	// If this annotation is specified on a Certificate or Order resource when
+	// using the HTTP01 solver type, the ingress.name field of the HTTP01
+	// solver's configuration will be set to the value given here.
+	// This is especially useful for users of Ingress controllers that maintain
+	// a 1:1 mapping between endpoint IP and Ingress resource.
+	ACMECertificateHTTP01IngressNameOverride = "acme.cert-manager.io/http01-override-ingress-name"
+
+	// If this annotation is specified on a Certificate or Order resource when
+	// using the HTTP01 solver type, the ingress.class field of the HTTP01
+	// solver's configuration will be set to the value given here.
+	// This is especially useful for users deploying many different ingress
+	// classes into a single cluster that want to be able to re-use a single
+	// solver for each ingress class.
+	ACMECertificateHTTP01IngressClassOverride = "acme.cert-manager.io/http01-override-ingress-class"
+
+	// IngressEditInPlaceAnnotation is used to toggle the use of ingressClass instead
+	// of ingress on the created Certificate resource
+	IngressEditInPlaceAnnotationKey = "acme.cert-manager.io/http01-edit-in-place"
+)
+
+const (
+	OrderKind     = "Order"
+	ChallengeKind = "Challenge"
+)

pkg/apis/acme/v1alpha3/types_challenge.go

@@ -0,0 +1,122 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Challenge is a type to represent a Challenge request with an ACME server
+// +k8s:openapi-gen=true
+// +kubebuilder:printcolumn:name="State",type="string",JSONPath=".status.state"
+// +kubebuilder:printcolumn:name="Domain",type="string",JSONPath=".spec.dnsName"
+// +kubebuilder:printcolumn:name="Reason",type="string",JSONPath=".status.reason",description="",priority=1
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=challenges
+type Challenge struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata"`
+
+	Spec   ChallengeSpec   `json:"spec,omitempty"`
+	Status ChallengeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ChallengeList is a list of Challenges
+type ChallengeList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Challenge `json:"items"`
+}
+
+type ChallengeSpec struct {
+	// AuthzURL is the URL to the ACME Authorization resource that this
+	// challenge is a part of.
+	AuthzURL string `json:"authzURL"`
+
+	// Type is the type of ACME challenge this resource represents, e.g. "dns01"
+	// or "http01"
+	Type ACMEChallengeType `json:"type"`
+
+	// URL is the URL of the ACME Challenge resource for this challenge.
+	// This can be used to lookup details about the status of this challenge.
+	URL string `json:"url"`
+
+	// DNSName is the identifier that this challenge is for, e.g. example.com.
+	DNSName string `json:"dnsName"`
+
+	// Token is the ACME challenge token for this challenge.
+	Token string `json:"token"`
+
+	// Key is the ACME challenge key for this challenge
+	Key string `json:"key"`
+
+	// Wildcard will be true if this challenge is for a wildcard identifier,
+	// for example '*.example.com'
+	// +optional
+	Wildcard bool `json:"wildcard"`
+
+	// Solver contains the domain solving configuration that should be used to
+	// solve this challenge resource.
+	Solver *ACMEChallengeSolver `json:"solver,omitempty"`
+
+	// IssuerRef references a properly configured ACME-type Issuer which should
+	// be used to create this Challenge.
+	// If the Issuer does not exist, processing will be retried.
+	// If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+	// Challenge will be marked as failed.
+	IssuerRef cmmeta.ObjectReference `json:"issuerRef"`
+}
+
+type ChallengeStatus struct {
+	// Processing is used to denote whether this challenge should be processed
+	// or not.
+	// This field will only be set to true by the 'scheduling' component.
+	// It will only be set to false by the 'challenges' controller, after the
+	// challenge has reached a final state or timed out.
+	// If this field is set to false, the challenge controller will not take
+	// any more action.
+	// +optional
+	Processing bool `json:"processing"`
+
+	// Presented will be set to true if the challenge values for this challenge
+	// are currently 'presented'.
+	// This *does not* imply the self check is passing. Only that the values
+	// have been 'submitted' for the appropriate challenge mechanism (i.e. the
+	// DNS01 TXT record has been presented, or the HTTP01 configuration has been
+	// configured).
+	// +optional
+	Presented bool `json:"presented"`
+
+	// Reason contains human readable information on why the Challenge is in the
+	// current state.
+	// +optional
+	Reason string `json:"reason"`
+
+	// State contains the current 'state' of the challenge.
+	// If not set, the state of the challenge is unknown.
+	// +optional
+	State State `json:"state,omitempty"`
+}

pkg/apis/acme/v1alpha3/types_issuer.go

@@ -0,0 +1,417 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	apiext "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+)
+
+// ACMEIssuer contains the specification for an ACME issuer
+type ACMEIssuer struct {
+	// Email is the email for this account
+	// +optional
+	Email string `json:"email,omitempty"`
+
+	// Server is the ACME server URL
+	Server string `json:"server"`
+
+	// If true, skip verifying the ACME server TLS certificate
+	// +optional
+	SkipTLSVerify bool `json:"skipTLSVerify,omitempty"`
+
+	// ExternalAcccountBinding is a reference to a CA external account of the ACME
+	// server.
+	// +optional
+	ExternalAccountBinding *ACMEExternalAccountBinding `json:"externalAccountBinding,omitempty"`
+
+	// PrivateKey is the name of a secret containing the private key for this
+	// user account.
+	PrivateKey cmmeta.SecretKeySelector `json:"privateKeySecretRef"`
+
+	// Solvers is a list of challenge solvers that will be used to solve
+	// ACME challenges for the matching domains.
+	// +optional
+	Solvers []ACMEChallengeSolver `json:"solvers,omitempty"`
+}
+
+// ACMEExternalAcccountBinding is a reference to a CA external account of the ACME
+// server.
+type ACMEExternalAccountBinding struct {
+	// keyID is the ID of the CA key that the External Account is bound to.
+	KeyID string `json:"keyID"`
+
+	// keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes
+	// Secret which holds the symmetric MAC key of the External Account Binding.
+	// The `key` is the index string that is paired with the key data in the
+	// Secret and should not be confused with the key data itself, or indeed with
+	// the External Account Binding keyID above.
+	// The secret key stored in the Secret **must** be un-padded, base64 URL
+	// encoded data.
+	Key cmmeta.SecretKeySelector `json:"keySecretRef"`
+
+	// keyAlgorithm is the MAC key algorithm that the key is used for. Valid
+	// values are "HS256", "HS384" and "HS512".
+	KeyAlgorithm HMACKeyAlgorithm `json:"keyAlgorithm"`
+}
+
+// HMACKeyAlgorithm is the name of a key algorithm used for HMAC encryption
+// +kubebuilder:validation:Enum=HS256;HS384;HS512
+type HMACKeyAlgorithm string
+
+const (
+	HS256 HMACKeyAlgorithm = "HS256"
+	HS384 HMACKeyAlgorithm = "HS384"
+	HS512 HMACKeyAlgorithm = "HS512"
+)
+
+type ACMEChallengeSolver struct {
+	// Selector selects a set of DNSNames on the Certificate resource that
+	// should be solved using this challenge solver.
+	Selector *CertificateDNSNameSelector `json:"selector,omitempty"`
+
+	// +optional
+	HTTP01 *ACMEChallengeSolverHTTP01 `json:"http01,omitempty"`
+
+	// +optional
+	DNS01 *ACMEChallengeSolverDNS01 `json:"dns01,omitempty"`
+}
+
+// CertificateDomainSelector selects certificates using a label selector, and
+// can optionally select individual DNS names within those certificates.
+// If both MatchLabels and DNSNames are empty, this selector will match all
+// certificates and DNS names within them.
+type CertificateDNSNameSelector struct {
+	// A label selector that is used to refine the set of certificate's that
+	// this challenge solver will apply to.
+	// +optional
+	MatchLabels map[string]string `json:"matchLabels,omitempty"`
+
+	// List of DNSNames that this solver will be used to solve.
+	// If specified and a match is found, a dnsNames selector will take
+	// precedence over a dnsZones selector.
+	// If multiple solvers match with the same dnsNames value, the solver
+	// with the most matching labels in matchLabels will be selected.
+	// If neither has more matches, the solver defined earlier in the list
+	// will be selected.
+	// +optional
+	DNSNames []string `json:"dnsNames,omitempty"`
+
+	// List of DNSZones that this solver will be used to solve.
+	// The most specific DNS zone match specified here will take precedence
+	// over other DNS zone matches, so a solver specifying sys.example.com
+	// will be selected over one specifying example.com for the domain
+	// www.sys.example.com.
+	// If multiple solvers match with the same dnsZones value, the solver
+	// with the most matching labels in matchLabels will be selected.
+	// If neither has more matches, the solver defined earlier in the list
+	// will be selected.
+	// +optional
+	DNSZones []string `json:"dnsZones,omitempty"`
+}
+
+// ACMEChallengeSolverHTTP01 contains configuration detailing how to solve
+// HTTP01 challenges within a Kubernetes cluster.
+// Typically this is accomplished through creating 'routes' of some description
+// that configure ingress controllers to direct traffic to 'solver pods', which
+// are responsible for responding to the ACME server's HTTP requests.
+type ACMEChallengeSolverHTTP01 struct {
+	// The ingress based HTTP01 challenge solver will solve challenges by
+	// creating or modifying Ingress resources in order to route requests for
+	// '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are
+	// provisioned by cert-manager for each Challenge to be completed.
+	// +optional
+	Ingress *ACMEChallengeSolverHTTP01Ingress `json:"ingress"`
+}
+
+type ACMEChallengeSolverHTTP01Ingress struct {
+	// Optional service type for Kubernetes solver service
+	// +optional
+	ServiceType corev1.ServiceType `json:"serviceType,omitempty"`
+
+	// The ingress class to use when creating Ingress resources to solve ACME
+	// challenges that use this challenge solver.
+	// Only one of 'class' or 'name' may be specified.
+	// +optional
+	Class *string `json:"class,omitempty"`
+
+	// The name of the ingress resource that should have ACME challenge solving
+	// routes inserted into it in order to solve HTTP01 challenges.
+	// This is typically used in conjunction with ingress controllers like
+	// ingress-gce, which maintains a 1:1 mapping between external IPs and
+	// ingress resources.
+	// +optional
+	Name string `json:"name,omitempty"`
+
+	// Optional pod template used to configure the ACME challenge solver pods
+	// used for HTTP01 challenges
+	// +optional
+	PodTemplate *ACMEChallengeSolverHTTP01IngressPodTemplate `json:"podTemplate,omitempty"`
+}
+
+type ACMEChallengeSolverHTTP01IngressPodTemplate struct {
+	// ObjectMeta overrides for the pod used to solve HTTP01 challenges.
+	// Only the 'labels' and 'annotations' fields may be set.
+	// If labels or annotations overlap with in-built values, the values here
+	// will override the in-built values.
+	// +optional
+	ACMEChallengeSolverHTTP01IngressPodObjectMeta `json:"metadata,omitempty"`
+
+	// PodSpec defines overrides for the HTTP01 challenge solver pod.
+	// Only the 'nodeSelector', 'affinity' and 'tolerations' fields are
+	// supported currently. All other fields will be ignored.
+	// +optional
+	Spec ACMEChallengeSolverHTTP01IngressPodSpec `json:"spec,omitempty"`
+}
+
+type ACMEChallengeSolverHTTP01IngressPodObjectMeta struct {
+	// Annotations that should be added to the create ACME HTTP01 solver pods.
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Labels that should be added to the created ACME HTTP01 solver pods.
+	Labels map[string]string `json:"labels,omitempty"`
+}
+
+type ACMEChallengeSolverHTTP01IngressPodSpec struct {
+	// NodeSelector is a selector which must be true for the pod to fit on a node.
+	// Selector which must match a node's labels for the pod to be scheduled on that node.
+	// More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+
+	// If specified, the pod's scheduling constraints
+	// +optional
+	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+
+	// If specified, the pod's tolerations.
+	// +optional
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
+}
+
+type ACMEChallengeSolverDNS01 struct {
+	// CNAMEStrategy configures how the DNS01 provider should handle CNAME
+	// records when found in DNS zones.
+	// +optional
+	CNAMEStrategy CNAMEStrategy `json:"cnameStrategy,omitempty"`
+
+	// +optional
+	Akamai *ACMEIssuerDNS01ProviderAkamai `json:"akamai,omitempty"`
+
+	// +optional
+	CloudDNS *ACMEIssuerDNS01ProviderCloudDNS `json:"clouddns,omitempty"`
+
+	// +optional
+	Cloudflare *ACMEIssuerDNS01ProviderCloudflare `json:"cloudflare,omitempty"`
+
+	// +optional
+	Route53 *ACMEIssuerDNS01ProviderRoute53 `json:"route53,omitempty"`
+
+	// +optional
+	AzureDNS *ACMEIssuerDNS01ProviderAzureDNS `json:"azuredns,omitempty"`
+
+	// +optional
+	DigitalOcean *ACMEIssuerDNS01ProviderDigitalOcean `json:"digitalocean,omitempty"`
+
+	// +optional
+	AcmeDNS *ACMEIssuerDNS01ProviderAcmeDNS `json:"acmedns,omitempty"`
+
+	// +optional
+	RFC2136 *ACMEIssuerDNS01ProviderRFC2136 `json:"rfc2136,omitempty"`
+
+	// +optional
+	Webhook *ACMEIssuerDNS01ProviderWebhook `json:"webhook,omitempty"`
+}
+
+// CNAMEStrategy configures how the DNS01 provider should handle CNAME records
+// when found in DNS zones.
+// By default, the None strategy will be applied (i.e. do not follow CNAMEs).
+// +kubebuilder:validation:Enum=None;Follow
+type CNAMEStrategy string
+
+const (
+	// NoneStrategy indicates that no CNAME resolution strategy should be used
+	// when determining which DNS zone to update during DNS01 challenges.
+	NoneStrategy = "None"
+
+	// FollowStrategy will cause cert-manager to recurse through CNAMEs in
+	// order to determine which DNS zone to update during DNS01 challenges.
+	// This is useful if you do not want to grant cert-manager access to your
+	// root DNS zone, and instead delegate the _acme-challenge.example.com
+	// subdomain to some other, less privileged domain.
+	FollowStrategy = "Follow"
+)
+
+// ACMEIssuerDNS01ProviderAkamai is a structure containing the DNS
+// configuration for Akamai DNS—Zone Record Management API
+type ACMEIssuerDNS01ProviderAkamai struct {
+	ServiceConsumerDomain string                   `json:"serviceConsumerDomain"`
+	ClientToken           cmmeta.SecretKeySelector `json:"clientTokenSecretRef"`
+	ClientSecret          cmmeta.SecretKeySelector `json:"clientSecretSecretRef"`
+	AccessToken           cmmeta.SecretKeySelector `json:"accessTokenSecretRef"`
+}
+
+// ACMEIssuerDNS01ProviderCloudDNS is a structure containing the DNS
+// configuration for Google Cloud DNS
+type ACMEIssuerDNS01ProviderCloudDNS struct {
+	// +optional
+	ServiceAccount *cmmeta.SecretKeySelector `json:"serviceAccountSecretRef,omitempty"`
+	Project        string                    `json:"project"`
+}
+
+// ACMEIssuerDNS01ProviderCloudflare is a structure containing the DNS
+// configuration for Cloudflare
+type ACMEIssuerDNS01ProviderCloudflare struct {
+	Email    string                    `json:"email"`
+	APIKey   *cmmeta.SecretKeySelector `json:"apiKeySecretRef,omitempty"`
+	APIToken *cmmeta.SecretKeySelector `json:"apiTokenSecretRef,omitempty"`
+}
+
+// ACMEIssuerDNS01ProviderDigitalOcean is a structure containing the DNS
+// configuration for DigitalOcean Domains
+type ACMEIssuerDNS01ProviderDigitalOcean struct {
+	Token cmmeta.SecretKeySelector `json:"tokenSecretRef"`
+}
+
+// ACMEIssuerDNS01ProviderRoute53 is a structure containing the Route 53
+// configuration for AWS
+type ACMEIssuerDNS01ProviderRoute53 struct {
+	// The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
+	// see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+	// +optional
+	AccessKeyID string `json:"accessKeyID"`
+
+	// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
+	// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+	// +optional
+	SecretAccessKey cmmeta.SecretKeySelector `json:"secretAccessKeySecretRef"`
+
+	// Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey
+	// or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata
+	// +optional
+	Role string `json:"role"`
+
+	// If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call.
+	// +optional
+	HostedZoneID string `json:"hostedZoneID,omitempty"`
+
+	// Always set the region when using AccessKeyID and SecretAccessKey
+	Region string `json:"region"`
+}
+
+// ACMEIssuerDNS01ProviderAzureDNS is a structure containing the
+// configuration for Azure DNS
+type ACMEIssuerDNS01ProviderAzureDNS struct {
+	ClientID string `json:"clientID"`
+
+	ClientSecret cmmeta.SecretKeySelector `json:"clientSecretSecretRef"`
+
+	SubscriptionID string `json:"subscriptionID"`
+
+	TenantID string `json:"tenantID"`
+
+	ResourceGroupName string `json:"resourceGroupName"`
+
+	// +optional
+	HostedZoneName string `json:"hostedZoneName,omitempty"`
+
+	// +optional
+	Environment AzureDNSEnvironment `json:"environment,omitempty"`
+}
+
+// +kubebuilder:validation:Enum=AzurePublicCloud;AzureChinaCloud;AzureGermanCloud;AzureUSGovernmentCloud
+type AzureDNSEnvironment string
+
+const (
+	AzurePublicCloud       AzureDNSEnvironment = "AzurePublicCloud"
+	AzureChinaCloud        AzureDNSEnvironment = "AzureChinaCloud"
+	AzureGermanCloud       AzureDNSEnvironment = "AzureGermanCloud"
+	AzureUSGovernmentCloud AzureDNSEnvironment = "AzureUSGovernmentCloud"
+)
+
+// ACMEIssuerDNS01ProviderAcmeDNS is a structure containing the
+// configuration for ACME-DNS servers
+type ACMEIssuerDNS01ProviderAcmeDNS struct {
+	Host string `json:"host"`
+
+	AccountSecret cmmeta.SecretKeySelector `json:"accountSecretRef"`
+}
+
+// ACMEIssuerDNS01ProviderRFC2136 is a structure containing the
+// configuration for RFC2136 DNS
+type ACMEIssuerDNS01ProviderRFC2136 struct {
+	// The IP address of the DNS supporting RFC2136. Required.
+	// Note: FQDN is not a valid value, only IP.
+	Nameserver string `json:"nameserver"`
+
+	// The name of the secret containing the TSIG value.
+	// If ``tsigKeyName`` is defined, this field is required.
+	// +optional
+	TSIGSecret cmmeta.SecretKeySelector `json:"tsigSecretSecretRef,omitempty"`
+
+	// The TSIG Key name configured in the DNS.
+	// If ``tsigSecretSecretRef`` is defined, this field is required.
+	// +optional
+	TSIGKeyName string `json:"tsigKeyName,omitempty"`
+
+	// The TSIG Algorithm configured in the DNS supporting RFC2136. Used only
+	// when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.
+	// Supported values are (case-insensitive): ``HMACMD5`` (default),
+	// ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.
+	// +optional
+	TSIGAlgorithm string `json:"tsigAlgorithm,omitempty"`
+}
+
+// ACMEIssuerDNS01ProviderWebhook specifies configuration for a webhook DNS01
+// provider, including where to POST ChallengePayload resources.
+type ACMEIssuerDNS01ProviderWebhook struct {
+	// The API group name that should be used when POSTing ChallengePayload
+	// resources to the webhook apiserver.
+	// This should be the same as the GroupName specified in the webhook
+	// provider implementation.
+	GroupName string `json:"groupName"`
+
+	// The name of the solver to use, as defined in the webhook provider
+	// implementation.
+	// This will typically be the name of the provider, e.g. 'cloudflare'.
+	SolverName string `json:"solverName"`
+
+	// Additional configuration that should be passed to the webhook apiserver
+	// when challenges are processed.
+	// This can contain arbitrary JSON data.
+	// Secret values should not be specified in this stanza.
+	// If secret values are needed (e.g. credentials for a DNS service), you
+	// should use a SecretKeySelector to reference a Secret resource.
+	// For details on the schema of this field, consult the webhook provider
+	// implementation's documentation.
+	// +optional
+	Config *apiext.JSON `json:"config,omitempty"`
+}
+
+type ACMEIssuerStatus struct {
+	// URI is the unique account identifier, which can also be used to retrieve
+	// account details from the CA
+	// +optional
+	URI string `json:"uri,omitempty"`
+
+	// LastRegisteredEmail is the email associated with the latest registered
+	// ACME account, in order to track changes made to registered account
+	// associated with the  Issuer
+	// +optional
+	LastRegisteredEmail string `json:"lastRegisteredEmail,omitempty"`
+}

pkg/apis/acme/v1alpha3/types_order.go

@@ -0,0 +1,237 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+)
+
+// TODO: these types should be moved into their own API group once we have a loose
+// coupling between ACME Issuers and their solver configurations (see: Solver proposal)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Order is a type to represent an Order with an ACME server
+// +k8s:openapi-gen=true
+// +kubebuilder:printcolumn:name="State",type="string",JSONPath=".status.state"
+// +kubebuilder:printcolumn:name="Issuer",type="string",JSONPath=".spec.issuerRef.name",description="",priority=1
+// +kubebuilder:printcolumn:name="Reason",type="string",JSONPath=".status.reason",description="",priority=1
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=orders
+type Order struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata"`
+
+	Spec   OrderSpec   `json:"spec,omitempty"`
+	Status OrderStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// OrderList is a list of Orders
+type OrderList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Order `json:"items"`
+}
+
+type OrderSpec struct {
+	// Certificate signing request bytes in DER encoding.
+	// This will be used when finalizing the order.
+	// This field must be set on the order.
+	CSR []byte `json:"csr"`
+
+	// IssuerRef references a properly configured ACME-type Issuer which should
+	// be used to create this Order.
+	// If the Issuer does not exist, processing will be retried.
+	// If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+	// Order will be marked as failed.
+	IssuerRef cmmeta.ObjectReference `json:"issuerRef"`
+
+	// CommonName is the common name as specified on the DER encoded CSR.
+	// If CommonName is not specified, the first DNSName specified will be used
+	// as the CommonName.
+	// At least one of CommonName or a DNSNames must be set.
+	// This field must match the corresponding field on the DER encoded CSR.
+	// +optional
+	CommonName string `json:"commonName,omitempty"`
+
+	// DNSNames is a list of DNS names that should be included as part of the Order
+	// validation process.
+	// If CommonName is not specified, the first DNSName specified will be used
+	// as the CommonName.
+	// At least one of CommonName or a DNSNames must be set.
+	// This field must match the corresponding field on the DER encoded CSR.
+	// +optional
+	DNSNames []string `json:"dnsNames,omitempty"`
+}
+
+type OrderStatus struct {
+	// URL of the Order.
+	// This will initially be empty when the resource is first created.
+	// The Order controller will populate this field when the Order is first processed.
+	// This field will be immutable after it is initially set.
+	// +optional
+	URL string `json:"url,omitempty"`
+
+	// FinalizeURL of the Order.
+	// This is used to obtain certificates for this order once it has been completed.
+	// +optional
+	FinalizeURL string `json:"finalizeURL,omitempty"`
+
+	// Authorizations contains data returned from the ACME server on what
+	// authoriations must be completed in order to validate the DNS names
+	// specified on the Order.
+	// +optional
+	Authorizations []ACMEAuthorization `json:"authorizations,omitempty"`
+
+	// Certificate is a copy of the PEM encoded certificate for this Order.
+	// This field will be populated after the order has been successfully
+	// finalized with the ACME server, and the order has transitioned to the
+	// 'valid' state.
+	// +optional
+	Certificate []byte `json:"certificate,omitempty"`
+
+	// State contains the current state of this Order resource.
+	// States 'success' and 'expired' are 'final'
+	// +optional
+	State State `json:"state,omitempty"`
+
+	// Reason optionally provides more information about a why the order is in
+	// the current state.
+	// +optional
+	Reason string `json:"reason,omitempty"`
+
+	// FailureTime stores the time that this order failed.
+	// This is used to influence garbage collection and back-off.
+	// +optional
+	FailureTime *metav1.Time `json:"failureTime,omitempty"`
+}
+
+// ACMEAuthorization contains data returned from the ACME server on an
+// authorization that must be completed in order validate a DNS name on an ACME
+// Order resource.
+type ACMEAuthorization struct {
+	// URL is the URL of the Authorization that must be completed
+	URL string `json:"url"`
+
+	// Identifier is the DNS name to be validated as part of this authorization
+	// +optional
+	Identifier string `json:"identifier,omitempty"`
+
+	// Wildcard will be true if this authorization is for a wildcard DNS name.
+	// If this is true, the identifier will be the *non-wildcard* version of
+	// the DNS name.
+	// For example, if '*.example.com' is the DNS name being validated, this
+	// field will be 'true' and the 'identifier' field will be 'example.com'.
+	// +optional
+	Wildcard *bool `json:"wildcard,omitempty"`
+
+	// Challenges specifies the challenge types offered by the ACME server.
+	// One of these challenge types will be selected when validating the DNS
+	// name and an appropriate Challenge resource will be created to perform
+	// the ACME challenge process.
+	// +optional
+	Challenges []ACMEChallenge `json:"challenges,omitempty"`
+}
+
+// Challenge specifies a challenge offered by the ACME server for an Order.
+// An appropriate Challenge resource can be created to perform the ACME
+// challenge process.
+type ACMEChallenge struct {
+	// URL is the URL of this challenge. It can be used to retrieve additional
+	// metadata about the Challenge from the ACME server.
+	URL string `json:"url"`
+
+	// Token is the token that must be presented for this challenge.
+	// This is used to compute the 'key' that must also be presented.
+	Token string `json:"token"`
+
+	// Type is the type of challenge being offered, e.g. http-01, dns-01
+	Type ACMEChallengeType `json:"type"`
+}
+
+// ACMEChallengeType denotes a type of ACME challenge
+type ACMEChallengeType string
+
+const (
+	// ACMEChallengeTypeHTTP01 denotes a Challenge is of type http-01
+	ACMEChallengeTypeHTTP01 ACMEChallengeType = "http-01"
+
+	// ACMEChallengeTypeDNS01 denotes a Challenge is of type dns-01
+	ACMEChallengeTypeDNS01 ACMEChallengeType = "dns-01"
+)
+
+// State represents the state of an ACME resource, such as an Order.
+// The possible options here map to the corresponding values in the
+// ACME specification.
+// Full details of these values can be found here: https://tools.ietf.org/html/draft-ietf-acme-acme-15#section-7.1.6
+// Clients utilising this type must also gracefully handle unknown
+// values, as the contents of this enumeration may be added to over time.
+// +kubebuilder:validation:Enum=valid;ready;pending;processing;invalid;expired;errored
+type State string
+
+const (
+	// Unknown is not a real state as part of the ACME spec.
+	// It is used to represent an unrecognised value.
+	Unknown State = ""
+
+	// Valid signifies that an ACME resource is in a valid state.
+	// If an order is 'valid', it has been finalized with the ACME server and
+	// the certificate can be retrieved from the ACME server using the
+	// certificate URL stored in the Order's status subresource.
+	// This is a final state.
+	Valid State = "valid"
+
+	// Ready signifies that an ACME resource is in a ready state.
+	// If an order is 'ready', all of its challenges have been completed
+	// successfully and the order is ready to be finalized.
+	// Once finalized, it will transition to the Valid state.
+	// This is a transient state.
+	Ready State = "ready"
+
+	// Pending signifies that an ACME resource is still pending and is not yet ready.
+	// If an Order is marked 'Pending', the validations for that Order are still in progress.
+	// This is a transient state.
+	Pending State = "pending"
+
+	// Processing signifies that an ACME resource is being processed by the server.
+	// If an Order is marked 'Processing', the validations for that Order are currently being processed.
+	// This is a transient state.
+	Processing State = "processing"
+
+	// Invalid signifies that an ACME resource is invalid for some reason.
+	// If an Order is marked 'invalid', one of its validations be have invalid for some reason.
+	// This is a final state.
+	Invalid State = "invalid"
+
+	// Expired signifies that an ACME resource has expired.
+	// If an Order is marked 'Expired', one of its validations may have expired or the Order itself.
+	// This is a final state.
+	Expired State = "expired"
+
+	// Errored signifies that the ACME resource has errored for some reason.
+	// This is a catch-all state, and is used for marking internal cert-manager
+	// errors such as validation failures.
+	// This is a final state.
+	Errored State = "errored"
+)

pkg/apis/acme/v1alpha3/zz_generated.deepcopy.go

@@ -0,0 +1,778 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	metav1 "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+	v1 "k8s.io/api/core/v1"
+	v1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEAuthorization) DeepCopyInto(out *ACMEAuthorization) {
+	*out = *in
+	if in.Wildcard != nil {
+		in, out := &in.Wildcard, &out.Wildcard
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Challenges != nil {
+		in, out := &in.Challenges, &out.Challenges
+		*out = make([]ACMEChallenge, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEAuthorization.
+func (in *ACMEAuthorization) DeepCopy() *ACMEAuthorization {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEAuthorization)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallenge) DeepCopyInto(out *ACMEChallenge) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallenge.
+func (in *ACMEChallenge) DeepCopy() *ACMEChallenge {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallenge)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolver) DeepCopyInto(out *ACMEChallengeSolver) {
+	*out = *in
+	if in.Selector != nil {
+		in, out := &in.Selector, &out.Selector
+		*out = new(CertificateDNSNameSelector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP01 != nil {
+		in, out := &in.HTTP01, &out.HTTP01
+		*out = new(ACMEChallengeSolverHTTP01)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DNS01 != nil {
+		in, out := &in.DNS01, &out.DNS01
+		*out = new(ACMEChallengeSolverDNS01)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolver.
+func (in *ACMEChallengeSolver) DeepCopy() *ACMEChallengeSolver {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolver)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolverDNS01) DeepCopyInto(out *ACMEChallengeSolverDNS01) {
+	*out = *in
+	if in.Akamai != nil {
+		in, out := &in.Akamai, &out.Akamai
+		*out = new(ACMEIssuerDNS01ProviderAkamai)
+		**out = **in
+	}
+	if in.CloudDNS != nil {
+		in, out := &in.CloudDNS, &out.CloudDNS
+		*out = new(ACMEIssuerDNS01ProviderCloudDNS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Cloudflare != nil {
+		in, out := &in.Cloudflare, &out.Cloudflare
+		*out = new(ACMEIssuerDNS01ProviderCloudflare)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Route53 != nil {
+		in, out := &in.Route53, &out.Route53
+		*out = new(ACMEIssuerDNS01ProviderRoute53)
+		**out = **in
+	}
+	if in.AzureDNS != nil {
+		in, out := &in.AzureDNS, &out.AzureDNS
+		*out = new(ACMEIssuerDNS01ProviderAzureDNS)
+		**out = **in
+	}
+	if in.DigitalOcean != nil {
+		in, out := &in.DigitalOcean, &out.DigitalOcean
+		*out = new(ACMEIssuerDNS01ProviderDigitalOcean)
+		**out = **in
+	}
+	if in.AcmeDNS != nil {
+		in, out := &in.AcmeDNS, &out.AcmeDNS
+		*out = new(ACMEIssuerDNS01ProviderAcmeDNS)
+		**out = **in
+	}
+	if in.RFC2136 != nil {
+		in, out := &in.RFC2136, &out.RFC2136
+		*out = new(ACMEIssuerDNS01ProviderRFC2136)
+		**out = **in
+	}
+	if in.Webhook != nil {
+		in, out := &in.Webhook, &out.Webhook
+		*out = new(ACMEIssuerDNS01ProviderWebhook)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolverDNS01.
+func (in *ACMEChallengeSolverDNS01) DeepCopy() *ACMEChallengeSolverDNS01 {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolverDNS01)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolverHTTP01) DeepCopyInto(out *ACMEChallengeSolverHTTP01) {
+	*out = *in
+	if in.Ingress != nil {
+		in, out := &in.Ingress, &out.Ingress
+		*out = new(ACMEChallengeSolverHTTP01Ingress)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolverHTTP01.
+func (in *ACMEChallengeSolverHTTP01) DeepCopy() *ACMEChallengeSolverHTTP01 {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolverHTTP01)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolverHTTP01Ingress) DeepCopyInto(out *ACMEChallengeSolverHTTP01Ingress) {
+	*out = *in
+	if in.Class != nil {
+		in, out := &in.Class, &out.Class
+		*out = new(string)
+		**out = **in
+	}
+	if in.PodTemplate != nil {
+		in, out := &in.PodTemplate, &out.PodTemplate
+		*out = new(ACMEChallengeSolverHTTP01IngressPodTemplate)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolverHTTP01Ingress.
+func (in *ACMEChallengeSolverHTTP01Ingress) DeepCopy() *ACMEChallengeSolverHTTP01Ingress {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolverHTTP01Ingress)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolverHTTP01IngressPodObjectMeta) DeepCopyInto(out *ACMEChallengeSolverHTTP01IngressPodObjectMeta) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolverHTTP01IngressPodObjectMeta.
+func (in *ACMEChallengeSolverHTTP01IngressPodObjectMeta) DeepCopy() *ACMEChallengeSolverHTTP01IngressPodObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolverHTTP01IngressPodObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolverHTTP01IngressPodSpec) DeepCopyInto(out *ACMEChallengeSolverHTTP01IngressPodSpec) {
+	*out = *in
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(v1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]v1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolverHTTP01IngressPodSpec.
+func (in *ACMEChallengeSolverHTTP01IngressPodSpec) DeepCopy() *ACMEChallengeSolverHTTP01IngressPodSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolverHTTP01IngressPodSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEChallengeSolverHTTP01IngressPodTemplate) DeepCopyInto(out *ACMEChallengeSolverHTTP01IngressPodTemplate) {
+	*out = *in
+	in.ACMEChallengeSolverHTTP01IngressPodObjectMeta.DeepCopyInto(&out.ACMEChallengeSolverHTTP01IngressPodObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEChallengeSolverHTTP01IngressPodTemplate.
+func (in *ACMEChallengeSolverHTTP01IngressPodTemplate) DeepCopy() *ACMEChallengeSolverHTTP01IngressPodTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEChallengeSolverHTTP01IngressPodTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEExternalAccountBinding) DeepCopyInto(out *ACMEExternalAccountBinding) {
+	*out = *in
+	out.Key = in.Key
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEExternalAccountBinding.
+func (in *ACMEExternalAccountBinding) DeepCopy() *ACMEExternalAccountBinding {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEExternalAccountBinding)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuer) DeepCopyInto(out *ACMEIssuer) {
+	*out = *in
+	if in.ExternalAccountBinding != nil {
+		in, out := &in.ExternalAccountBinding, &out.ExternalAccountBinding
+		*out = new(ACMEExternalAccountBinding)
+		**out = **in
+	}
+	out.PrivateKey = in.PrivateKey
+	if in.Solvers != nil {
+		in, out := &in.Solvers, &out.Solvers
+		*out = make([]ACMEChallengeSolver, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuer.
+func (in *ACMEIssuer) DeepCopy() *ACMEIssuer {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderAcmeDNS) DeepCopyInto(out *ACMEIssuerDNS01ProviderAcmeDNS) {
+	*out = *in
+	out.AccountSecret = in.AccountSecret
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderAcmeDNS.
+func (in *ACMEIssuerDNS01ProviderAcmeDNS) DeepCopy() *ACMEIssuerDNS01ProviderAcmeDNS {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderAcmeDNS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderAkamai) DeepCopyInto(out *ACMEIssuerDNS01ProviderAkamai) {
+	*out = *in
+	out.ClientToken = in.ClientToken
+	out.ClientSecret = in.ClientSecret
+	out.AccessToken = in.AccessToken
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderAkamai.
+func (in *ACMEIssuerDNS01ProviderAkamai) DeepCopy() *ACMEIssuerDNS01ProviderAkamai {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderAkamai)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderAzureDNS) DeepCopyInto(out *ACMEIssuerDNS01ProviderAzureDNS) {
+	*out = *in
+	out.ClientSecret = in.ClientSecret
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderAzureDNS.
+func (in *ACMEIssuerDNS01ProviderAzureDNS) DeepCopy() *ACMEIssuerDNS01ProviderAzureDNS {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderAzureDNS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderCloudDNS) DeepCopyInto(out *ACMEIssuerDNS01ProviderCloudDNS) {
+	*out = *in
+	if in.ServiceAccount != nil {
+		in, out := &in.ServiceAccount, &out.ServiceAccount
+		*out = new(metav1.SecretKeySelector)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderCloudDNS.
+func (in *ACMEIssuerDNS01ProviderCloudDNS) DeepCopy() *ACMEIssuerDNS01ProviderCloudDNS {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderCloudDNS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderCloudflare) DeepCopyInto(out *ACMEIssuerDNS01ProviderCloudflare) {
+	*out = *in
+	if in.APIKey != nil {
+		in, out := &in.APIKey, &out.APIKey
+		*out = new(metav1.SecretKeySelector)
+		**out = **in
+	}
+	if in.APIToken != nil {
+		in, out := &in.APIToken, &out.APIToken
+		*out = new(metav1.SecretKeySelector)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderCloudflare.
+func (in *ACMEIssuerDNS01ProviderCloudflare) DeepCopy() *ACMEIssuerDNS01ProviderCloudflare {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderCloudflare)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderDigitalOcean) DeepCopyInto(out *ACMEIssuerDNS01ProviderDigitalOcean) {
+	*out = *in
+	out.Token = in.Token
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderDigitalOcean.
+func (in *ACMEIssuerDNS01ProviderDigitalOcean) DeepCopy() *ACMEIssuerDNS01ProviderDigitalOcean {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderDigitalOcean)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopyInto(out *ACMEIssuerDNS01ProviderRFC2136) {
+	*out = *in
+	out.TSIGSecret = in.TSIGSecret
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderRFC2136.
+func (in *ACMEIssuerDNS01ProviderRFC2136) DeepCopy() *ACMEIssuerDNS01ProviderRFC2136 {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderRFC2136)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopyInto(out *ACMEIssuerDNS01ProviderRoute53) {
+	*out = *in
+	out.SecretAccessKey = in.SecretAccessKey
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderRoute53.
+func (in *ACMEIssuerDNS01ProviderRoute53) DeepCopy() *ACMEIssuerDNS01ProviderRoute53 {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderRoute53)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerDNS01ProviderWebhook) DeepCopyInto(out *ACMEIssuerDNS01ProviderWebhook) {
+	*out = *in
+	if in.Config != nil {
+		in, out := &in.Config, &out.Config
+		*out = new(v1beta1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerDNS01ProviderWebhook.
+func (in *ACMEIssuerDNS01ProviderWebhook) DeepCopy() *ACMEIssuerDNS01ProviderWebhook {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerDNS01ProviderWebhook)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ACMEIssuerStatus) DeepCopyInto(out *ACMEIssuerStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMEIssuerStatus.
+func (in *ACMEIssuerStatus) DeepCopy() *ACMEIssuerStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ACMEIssuerStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateDNSNameSelector) DeepCopyInto(out *CertificateDNSNameSelector) {
+	*out = *in
+	if in.MatchLabels != nil {
+		in, out := &in.MatchLabels, &out.MatchLabels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.DNSNames != nil {
+		in, out := &in.DNSNames, &out.DNSNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.DNSZones != nil {
+		in, out := &in.DNSZones, &out.DNSZones
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateDNSNameSelector.
+func (in *CertificateDNSNameSelector) DeepCopy() *CertificateDNSNameSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateDNSNameSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Challenge) DeepCopyInto(out *Challenge) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Challenge.
+func (in *Challenge) DeepCopy() *Challenge {
+	if in == nil {
+		return nil
+	}
+	out := new(Challenge)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Challenge) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ChallengeList) DeepCopyInto(out *ChallengeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Challenge, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ChallengeList.
+func (in *ChallengeList) DeepCopy() *ChallengeList {
+	if in == nil {
+		return nil
+	}
+	out := new(ChallengeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ChallengeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ChallengeSpec) DeepCopyInto(out *ChallengeSpec) {
+	*out = *in
+	if in.Solver != nil {
+		in, out := &in.Solver, &out.Solver
+		*out = new(ACMEChallengeSolver)
+		(*in).DeepCopyInto(*out)
+	}
+	out.IssuerRef = in.IssuerRef
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ChallengeSpec.
+func (in *ChallengeSpec) DeepCopy() *ChallengeSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ChallengeSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ChallengeStatus) DeepCopyInto(out *ChallengeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ChallengeStatus.
+func (in *ChallengeStatus) DeepCopy() *ChallengeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ChallengeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Order) DeepCopyInto(out *Order) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Order.
+func (in *Order) DeepCopy() *Order {
+	if in == nil {
+		return nil
+	}
+	out := new(Order)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Order) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OrderList) DeepCopyInto(out *OrderList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Order, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrderList.
+func (in *OrderList) DeepCopy() *OrderList {
+	if in == nil {
+		return nil
+	}
+	out := new(OrderList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *OrderList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OrderSpec) DeepCopyInto(out *OrderSpec) {
+	*out = *in
+	if in.CSR != nil {
+		in, out := &in.CSR, &out.CSR
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	out.IssuerRef = in.IssuerRef
+	if in.DNSNames != nil {
+		in, out := &in.DNSNames, &out.DNSNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrderSpec.
+func (in *OrderSpec) DeepCopy() *OrderSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(OrderSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OrderStatus) DeepCopyInto(out *OrderStatus) {
+	*out = *in
+	if in.Authorizations != nil {
+		in, out := &in.Authorizations, &out.Authorizations
+		*out = make([]ACMEAuthorization, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Certificate != nil {
+		in, out := &in.Certificate, &out.Certificate
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.FailureTime != nil {
+		in, out := &in.FailureTime, &out.FailureTime
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrderStatus.
+func (in *OrderStatus) DeepCopy() *OrderStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(OrderStatus)
+	in.DeepCopyInto(out)
+	return out
+}

pkg/apis/certmanager/BUILD.bazel

@@ -19,6 +19,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//pkg/apis/certmanager/v1alpha2:all-srcs",
+        "//pkg/apis/certmanager/v1alpha3:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],

pkg/apis/certmanager/v1alpha3/BUILD.bazel

@@ -0,0 +1,40 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "const.go",
+        "doc.go",
+        "generic_issuer.go",
+        "register.go",
+        "types.go",
+        "types_certificate.go",
+        "types_certificaterequest.go",
+        "types_issuer.go",
+        "zz_generated.deepcopy.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/acme/v1alpha3:go_default_library",
+        "//pkg/apis/certmanager:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/apis/certmanager/v1alpha3/const.go

@@ -0,0 +1,43 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import "time"
+
+const (
+	// minimum permitted certificate duration by cert-manager
+	MinimumCertificateDuration = time.Hour
+
+	// default certificate duration if Issuer.spec.duration is not set
+	DefaultCertificateDuration = time.Hour * 24 * 90
+
+	// minimum certificate duration before certificate expiration
+	MinimumRenewBefore = time.Minute * 5
+
+	// Default duration before certificate expiration if  Issuer.spec.renewBefore is not set
+	DefaultRenewBefore = time.Hour * 24 * 30
+)
+
+const (
+	// Default index key for the Secret reference for Token authentication
+	DefaultVaultTokenAuthSecretKey = "token"
+
+	// Default mount path location for Kubernetes ServiceAccount authentication
+	// (/v1/auth/kubernetes). The endpoint will then be called at `/login`, so
+	// left as the default, `/v1/auth/kubernetes/login` will be called.
+	DefaultVaultKubernetesAuthMountPath = "/v1/auth/kubernetes"
+)

pkg/apis/certmanager/v1alpha3/doc.go

@@ -0,0 +1,24 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha3 is the v1alpha3 version of the API.
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=github.com/jetstack/cert-manager/pkg/apis/certmanager
+// +k8s:openapi-gen=true
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=cert-manager.io
+// +groupGoName=Certmanager
+package v1alpha3

pkg/apis/certmanager/v1alpha3/generic_issuer.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+
+	cmacme "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+)
+
+type GenericIssuer interface {
+	runtime.Object
+	metav1.Object
+
+	GetObjectMeta() *metav1.ObjectMeta
+	GetSpec() *IssuerSpec
+	GetStatus() *IssuerStatus
+}
+
+var _ GenericIssuer = &Issuer{}
+var _ GenericIssuer = &ClusterIssuer{}
+
+func (c *ClusterIssuer) GetObjectMeta() *metav1.ObjectMeta {
+	return &c.ObjectMeta
+}
+func (c *ClusterIssuer) GetSpec() *IssuerSpec {
+	return &c.Spec
+}
+func (c *ClusterIssuer) GetStatus() *IssuerStatus {
+	return &c.Status
+}
+func (c *ClusterIssuer) SetSpec(spec IssuerSpec) {
+	c.Spec = spec
+}
+func (c *ClusterIssuer) SetStatus(status IssuerStatus) {
+	c.Status = status
+}
+func (c *ClusterIssuer) Copy() GenericIssuer {
+	return c.DeepCopy()
+}
+func (c *Issuer) GetObjectMeta() *metav1.ObjectMeta {
+	return &c.ObjectMeta
+}
+func (c *Issuer) GetSpec() *IssuerSpec {
+	return &c.Spec
+}
+func (c *Issuer) GetStatus() *IssuerStatus {
+	return &c.Status
+}
+func (c *Issuer) SetSpec(spec IssuerSpec) {
+	c.Spec = spec
+}
+func (c *Issuer) SetStatus(status IssuerStatus) {
+	c.Status = status
+}
+func (c *Issuer) Copy() GenericIssuer {
+	return c.DeepCopy()
+}
+
+// TODO: refactor these functions away
+func (i *IssuerStatus) ACMEStatus() *cmacme.ACMEIssuerStatus {
+	// this is an edge case, but this will prevent panics
+	if i == nil {
+		return &cmacme.ACMEIssuerStatus{}
+	}
+	if i.ACME == nil {
+		i.ACME = &cmacme.ACMEIssuerStatus{}
+	}
+	return i.ACME
+}

pkg/apis/certmanager/v1alpha3/register.go

@@ -0,0 +1,62 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/jetstack/cert-manager/pkg/apis/certmanager"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: certmanager.GroupName, Version: "v1alpha3"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to api.Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Certificate{},
+		&CertificateList{},
+		&Issuer{},
+		&IssuerList{},
+		&ClusterIssuer{},
+		&ClusterIssuerList{},
+		&CertificateRequest{},
+		&CertificateRequestList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

pkg/apis/certmanager/v1alpha3/types.go

@@ -0,0 +1,162 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+// Annotation names for Secrets
+const (
+	AltNamesAnnotationKey    = "cert-manager.io/alt-names"
+	IPSANAnnotationKey       = "cert-manager.io/ip-sans"
+	URISANAnnotationKey      = "cert-manager.io/uri-sans"
+	CommonNameAnnotationKey  = "cert-manager.io/common-name"
+	IssuerNameAnnotationKey  = "cert-manager.io/issuer-name"
+	IssuerKindAnnotationKey  = "cert-manager.io/issuer-kind"
+	IssuerGroupAnnotationKey = "cert-manager.io/issuer-group"
+	CertificateNameKey       = "cert-manager.io/certificate-name"
+)
+
+// Deprecated annotation names for Secrets
+const (
+	DeprecatedIssuerNameAnnotationKey = "certmanager.k8s.io/issuer-name"
+	DeprecatedIssuerKindAnnotationKey = "certmanager.k8s.io/issuer-kind"
+)
+
+const (
+	// issuerNameAnnotation can be used to override the issuer specified on the
+	// created Certificate resource.
+	IngressIssuerNameAnnotationKey = "cert-manager.io/issuer"
+	// clusterIssuerNameAnnotation can be used to override the issuer specified on the
+	// created Certificate resource. The Certificate will reference the
+	// specified *ClusterIssuer* instead of normal issuer.
+	IngressClusterIssuerNameAnnotationKey = "cert-manager.io/cluster-issuer"
+	// acmeIssuerHTTP01IngressClassAnnotation can be used to override the http01 ingressClass
+	// if the challenge type is set to http01
+	IngressACMEIssuerHTTP01IngressClassAnnotationKey = "acme.cert-manager.io/http01-ingress-class"
+
+	// IngessClassAnnotationKey picks a specific "class" for the Ingress. The
+	// controller only processes Ingresses with this annotation either unset, or
+	// set to either the configured value or the empty string.
+	IngressClassAnnotationKey = "kubernetes.io/ingress.class"
+)
+
+// Annotation names for CertificateRequests
+const (
+	CRPrivateKeyAnnotationKey = "cert-manager.io/private-key-secret-name"
+)
+
+const (
+	// IssueTemporaryCertificateAnnotation is an annotation that can be added to
+	// Certificate resources.
+	// If it is present, a temporary internally signed certificate will be
+	// stored in the target Secret resource whilst the real Issuer is processing
+	// the certificate request.
+	IssueTemporaryCertificateAnnotation = "cert-manager.io/issue-temporary-certificate"
+)
+
+const (
+	ClusterIssuerKind      = "ClusterIssuer"
+	IssuerKind             = "Issuer"
+	CertificateKind        = "Certificate"
+	CertificateRequestKind = "CertificateRequest"
+)
+
+const (
+	// WantInjectAnnotation is the annotation that specifies that a particular
+	// object wants injection of CAs.  It takes the form of a reference to a certificate
+	// as namespace/name.  The certificate is expected to have the is-serving-for annotations.
+	WantInjectAnnotation = "cert-manager.io/inject-ca-from"
+
+	// WantInjectAPIServerCAAnnotation, if set to "true", will make the cainjector
+	// inject the CA certificate for the Kubernetes apiserver into the resource.
+	// It discovers the apiserver's CA by inspecting the service account credentials
+	// mounted into the cainjector pod.
+	WantInjectAPIServerCAAnnotation = "cert-manager.io/inject-apiserver-ca"
+
+	// WantInjectFromSecretAnnotation is the annotation that specifies that a particular
+	// object wants injection of CAs.  It takes the form of a reference to a Secret
+	// as namespace/name.
+	WantInjectFromSecretAnnotation = "cert-manager.io/inject-ca-from-secret"
+
+	// AllowsInjectionFromSecretAnnotation is an annotation that must be added
+	// to Secret resource that want to denote that they can be directly
+	// injected into injectables that have a `inject-ca-from-secret` annotation.
+	// If an injectable references a Secret that does NOT have this annotation,
+	// the cainjector will refuse to inject the secret.
+	AllowsInjectionFromSecretAnnotation = "cert-manager.io/allow-direct-injection"
+)
+
+// KeyUsage specifies valid usage contexts for keys.
+// See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3
+//      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
+// Valid KeyUsage values are as follows:
+// "signing",
+// "digital signature",
+// "content commitment",
+// "key encipherment",
+// "key agreement",
+// "data encipherment",
+// "cert sign",
+// "crl sign",
+// "encipher only",
+// "decipher only",
+// "any",
+// "server auth",
+// "client auth",
+// "code signing",
+// "email protection",
+// "s/mime",
+// "ipsec end system",
+// "ipsec tunnel",
+// "ipsec user",
+// "timestamping",
+// "ocsp signing",
+// "microsoft sgc",
+// "netscape sgc"
+// +kubebuilder:validation:Enum="signing";"digital signature";"content commitment";"key encipherment";"key agreement";"data encipherment";"cert sign";"crl sign";"encipher only";"decipher only";"any";"server auth";"client auth";"code signing";"email protection";"s/mime";"ipsec end system";"ipsec tunnel";"ipsec user";"timestamping";"ocsp signing";"microsoft sgc";"netscape sgc"
+type KeyUsage string
+
+const (
+	UsageSigning            KeyUsage = "signing"
+	UsageDigitalSignature   KeyUsage = "digital signature"
+	UsageContentCommittment KeyUsage = "content commitment"
+	UsageKeyEncipherment    KeyUsage = "key encipherment"
+	UsageKeyAgreement       KeyUsage = "key agreement"
+	UsageDataEncipherment   KeyUsage = "data encipherment"
+	UsageCertSign           KeyUsage = "cert sign"
+	UsageCRLSign            KeyUsage = "crl sign"
+	UsageEncipherOnly       KeyUsage = "encipher only"
+	UsageDecipherOnly       KeyUsage = "decipher only"
+	UsageAny                KeyUsage = "any"
+	UsageServerAuth         KeyUsage = "server auth"
+	UsageClientAuth         KeyUsage = "client auth"
+	UsageCodeSigning        KeyUsage = "code signing"
+	UsageEmailProtection    KeyUsage = "email protection"
+	UsageSMIME              KeyUsage = "s/mime"
+	UsageIPsecEndSystem     KeyUsage = "ipsec end system"
+	UsageIPsecTunnel        KeyUsage = "ipsec tunnel"
+	UsageIPsecUser          KeyUsage = "ipsec user"
+	UsageTimestamping       KeyUsage = "timestamping"
+	UsageOCSPSigning        KeyUsage = "ocsp signing"
+	UsageMicrosoftSGC       KeyUsage = "microsoft sgc"
+	UsageNetscapSGC         KeyUsage = "netscape sgc"
+)
+
+// DefaultKeyUsages contains the default list of key usages
+func DefaultKeyUsages() []KeyUsage {
+	// The serverAuth EKU is required as of Mac OS Catalina: https://support.apple.com/en-us/HT210176
+	// Without this usage, certificates will _always_ flag a warning in newer Mac OS browsers.
+	return []KeyUsage{UsageDigitalSignature, UsageKeyEncipherment, UsageServerAuth}
+}

pkg/apis/certmanager/v1alpha3/types_certificate.go

@@ -0,0 +1,226 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Certificate is a type to represent a Certificate from ACME
+// +k8s:openapi-gen=true
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
+// +kubebuilder:printcolumn:name="Secret",type="string",JSONPath=".spec.secretName",description=""
+// +kubebuilder:printcolumn:name="Issuer",type="string",JSONPath=".spec.issuerRef.name",description="",priority=1
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",priority=1
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=certificates,shortName=cert;certs
+type Certificate struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   CertificateSpec   `json:"spec,omitempty"`
+	Status CertificateStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CertificateList is a list of Certificates
+type CertificateList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Certificate `json:"items"`
+}
+
+// +kubebuilder:validation:Enum=rsa;ecdsa
+type KeyAlgorithm string
+
+const (
+	RSAKeyAlgorithm   KeyAlgorithm = "rsa"
+	ECDSAKeyAlgorithm KeyAlgorithm = "ecdsa"
+)
+
+// +kubebuilder:validation:Enum=pkcs1;pkcs8
+type KeyEncoding string
+
+const (
+	PKCS1 KeyEncoding = "pkcs1"
+	PKCS8 KeyEncoding = "pkcs8"
+)
+
+// CertificateSpec defines the desired state of Certificate.
+// A valid Certificate requires at least one of a CommonName, DNSName, or
+// URISAN to be valid.
+type CertificateSpec struct {
+	// Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
+	// +optional
+	Subject *X509Subject `json:"subject,omitempty"`
+
+	// CommonName is a common name to be used on the Certificate.
+	// The CommonName should have a length of 64 characters or fewer to avoid
+	// generating invalid CSRs.
+	// +optional
+	CommonName string `json:"commonName,omitempty"`
+
+	// Organization is the organization to be used on the Certificate
+	// +optional
+	Organization []string `json:"organization,omitempty"`
+
+	// Certificate default Duration
+	// +optional
+	Duration *metav1.Duration `json:"duration,omitempty"`
+
+	// Certificate renew before expiration duration
+	// +optional
+	RenewBefore *metav1.Duration `json:"renewBefore,omitempty"`
+
+	// DNSNames is a list of subject alt names to be used on the Certificate.
+	// +optional
+	DNSNames []string `json:"dnsNames,omitempty"`
+
+	// IPAddresses is a list of IP addresses to be used on the Certificate
+	// +optional
+	IPAddresses []string `json:"ipAddresses,omitempty"`
+
+	// URISANs is a list of URI Subject Alternative Names to be set on this
+	// Certificate.
+	// +optional
+	URISANs []string `json:"uriSANs,omitempty"`
+
+	// SecretName is the name of the secret resource to store this secret in
+	SecretName string `json:"secretName"`
+
+	// IssuerRef is a reference to the issuer for this certificate.
+	// If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
+	// with the given name in the same namespace as the Certificate will be used.
+	// If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the
+	// provided name will be used.
+	// The 'name' field in this stanza is required at all times.
+	IssuerRef cmmeta.ObjectReference `json:"issuerRef"`
+
+	// IsCA will mark this Certificate as valid for signing.
+	// This implies that the 'cert sign' usage is set
+	// +optional
+	IsCA bool `json:"isCA,omitempty"`
+
+	// Usages is the set of x509 actions that are enabled for a given key. Defaults are ('digital signature', 'key encipherment') if empty
+	// +optional
+	Usages []KeyUsage `json:"usages,omitempty"`
+
+	// KeySize is the key bit size of the corresponding private key for this certificate.
+	// If provided, value must be between 2048 and 8192 inclusive when KeyAlgorithm is
+	// empty or is set to "rsa", and value must be one of (256, 384, 521) when
+	// KeyAlgorithm is set to "ecdsa".
+	// +optional
+	KeySize int `json:"keySize,omitempty"`
+
+	// KeyAlgorithm is the private key algorithm of the corresponding private key
+	// for this certificate. If provided, allowed values are either "rsa" or "ecdsa"
+	// If KeyAlgorithm is specified and KeySize is not provided,
+	// key size of 256 will be used for "ecdsa" key algorithm and
+	// key size of 2048 will be used for "rsa" key algorithm.
+	// +optional
+	KeyAlgorithm KeyAlgorithm `json:"keyAlgorithm,omitempty"`
+
+	// KeyEncoding is the private key cryptography standards (PKCS)
+	// for this certificate's private key to be encoded in. If provided, allowed
+	// values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively.
+	// If KeyEncoding is not specified, then PKCS#1 will be used by default.
+	KeyEncoding KeyEncoding `json:"keyEncoding,omitempty"`
+}
+
+// X509Subject Full X509 name specification
+type X509Subject struct {
+	// Countries to be used on the Certificate.
+	// +optional
+	Countries []string `json:"countries,omitempty"`
+	// Organizational Units to be used on the Certificate.
+	// +optional
+	OrganizationalUnits []string `json:"organizationalUnits,omitempty"`
+	// Cities to be used on the Certificate.
+	// +optional
+	Localities []string `json:"localities,omitempty"`
+	// State/Provinces to be used on the Certificate.
+	// +optional
+	Provinces []string `json:"provinces,omitempty"`
+	// Street addresses to be used on the Certificate.
+	// +optional
+	StreetAddresses []string `json:"streetAddresses,omitempty"`
+	// Postal codes to be used on the Certificate.
+	// +optional
+	PostalCodes []string `json:"postalCodes,omitempty"`
+	// Serial number to be used on the Certificate.
+	// +optional
+	SerialNumber string `json:"serialNumber,omitempty"`
+}
+
+// CertificateStatus defines the observed state of Certificate
+type CertificateStatus struct {
+	// +optional
+	Conditions []CertificateCondition `json:"conditions,omitempty"`
+
+	// +optional
+	LastFailureTime *metav1.Time `json:"lastFailureTime,omitempty"`
+
+	// The expiration time of the certificate stored in the secret named
+	// by this resource in spec.secretName.
+	// +optional
+	NotAfter *metav1.Time `json:"notAfter,omitempty"`
+}
+
+// CertificateCondition contains condition information for an Certificate.
+type CertificateCondition struct {
+	// Type of the condition, currently ('Ready').
+	Type CertificateConditionType `json:"type"`
+
+	// Status of the condition, one of ('True', 'False', 'Unknown').
+	Status cmmeta.ConditionStatus `json:"status"`
+
+	// LastTransitionTime is the timestamp corresponding to the last status
+	// change of this condition.
+	// +optional
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+
+	// Reason is a brief machine readable explanation for the condition's last
+	// transition.
+	// +optional
+	Reason string `json:"reason,omitempty"`
+
+	// Message is a human readable description of the details of the last
+	// transition, complementing reason.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+// CertificateConditionType represents an Certificate condition value.
+type CertificateConditionType string
+
+const (
+	// CertificateConditionReady indicates that a certificate is ready for use.
+	// This is defined as:
+	// - The target secret exists
+	// - The target secret contains a certificate that has not expired
+	// - The target secret contains a private key valid for the certificate
+	// - The commonName and dnsNames attributes match those specified on the Certificate
+	CertificateConditionReady CertificateConditionType = "Ready"
+)

pkg/apis/certmanager/v1alpha3/types_certificaterequest.go

@@ -0,0 +1,143 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+)
+
+const (
+	CertificateRequestReasonPending = "Pending"
+	CertificateRequestReasonFailed  = "Failed"
+	CertificateRequestReasonIssued  = "Issued"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CertificateRequest is a type to represent a Certificate Signing Request
+// +k8s:openapi-gen=true
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
+// +kubebuilder:printcolumn:name="Issuer",type="string",JSONPath=".spec.issuerRef.name",description="",priority=1
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",priority=1
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=certificaterequests,shortName=cr;crs
+type CertificateRequest struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   CertificateRequestSpec   `json:"spec,omitempty"`
+	Status CertificateRequestStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CertificateRequestList is a list of Certificates
+type CertificateRequestList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []CertificateRequest `json:"items"`
+}
+
+// CertificateRequestSpec defines the desired state of CertificateRequest
+type CertificateRequestSpec struct {
+	// Requested certificate default Duration
+	// +optional
+	Duration *metav1.Duration `json:"duration,omitempty"`
+
+	// IssuerRef is a reference to the issuer for this CertificateRequest.  If
+	// the 'kind' field is not set, or set to 'Issuer', an Issuer resource with
+	// the given name in the same namespace as the CertificateRequest will be
+	// used.  If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with
+	// the provided name will be used. The 'name' field in this stanza is
+	// required at all times. The group field refers to the API group of the
+	// issuer which defaults to 'cert-manager.io' if empty.
+	IssuerRef cmmeta.ObjectReference `json:"issuerRef"`
+
+	// Byte slice containing the PEM encoded CertificateSigningRequest
+	CSRPEM []byte `json:"csr"`
+
+	// IsCA will mark the resulting certificate as valid for signing. This
+	// implies that the 'cert sign' usage is set
+	// +optional
+	IsCA bool `json:"isCA,omitempty"`
+
+	// Usages is the set of x509 actions that are enabled for a given key.
+	// Defaults are ('digital signature', 'key encipherment') if empty
+	// +optional
+	Usages []KeyUsage `json:"usages,omitempty"`
+}
+
+// CertificateStatus defines the observed state of CertificateRequest and
+// resulting signed certificate.
+type CertificateRequestStatus struct {
+	// +optional
+	Conditions []CertificateRequestCondition `json:"conditions,omitempty"`
+
+	// Byte slice containing a PEM encoded signed certificate resulting from the
+	// given certificate signing request.
+	// +optional
+	Certificate []byte `json:"certificate,omitempty"`
+
+	// Byte slice containing the PEM encoded certificate authority of the signed
+	// certificate.
+	// +optional
+	CA []byte `json:"ca,omitempty"`
+
+	// FailureTime stores the time that this CertificateRequest failed. This is
+	// used to influence garbage collection and back-off.
+	// +optional
+	FailureTime *metav1.Time `json:"failureTime,omitempty"`
+}
+
+// CertificateRequestCondition contains condition information for a CertificateRequest.
+type CertificateRequestCondition struct {
+	// Type of the condition, currently ('Ready').
+	Type CertificateRequestConditionType `json:"type"`
+
+	// Status of the condition, one of ('True', 'False', 'Unknown').
+	Status cmmeta.ConditionStatus `json:"status"`
+
+	// LastTransitionTime is the timestamp corresponding to the last status
+	// change of this condition.
+	// +optional
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+
+	// Reason is a brief machine readable explanation for the condition's last
+	// transition.
+	// +optional
+	Reason string `json:"reason,omitempty"`
+
+	// Message is a human readable description of the details of the last
+	// transition, complementing reason.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+// CertificateRequestConditionType represents an Certificate condition value.
+type CertificateRequestConditionType string
+
+const (
+	// CertificateRequestConditionReady indicates that a certificate is ready for use.
+	// This is defined as:
+	// - The target certificate exists in CertificateRequest.Status
+	CertificateRequestConditionReady CertificateRequestConditionType = "Ready"
+)

pkg/apis/certmanager/v1alpha3/types_issuer.go

@@ -0,0 +1,262 @@
+/*
+Copyright 2019 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	cmacme "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=clusterissuers,scope=Cluster
+type ClusterIssuer struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   IssuerSpec   `json:"spec,omitempty"`
+	Status IssuerStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ClusterIssuerList is a list of Issuers
+type ClusterIssuerList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []ClusterIssuer `json:"items"`
+}
+
+// +genclient
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=issuers
+type Issuer struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   IssuerSpec   `json:"spec,omitempty"`
+	Status IssuerStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// IssuerList is a list of Issuers
+type IssuerList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Issuer `json:"items"`
+}
+
+// IssuerSpec is the specification of an Issuer. This includes any
+// configuration required for the issuer.
+type IssuerSpec struct {
+	IssuerConfig `json:",inline"`
+}
+
+type IssuerConfig struct {
+	// +optional
+	ACME *cmacme.ACMEIssuer `json:"acme,omitempty"`
+
+	// +optional
+	CA *CAIssuer `json:"ca,omitempty"`
+
+	// +optional
+	Vault *VaultIssuer `json:"vault,omitempty"`
+
+	// +optional
+	SelfSigned *SelfSignedIssuer `json:"selfSigned,omitempty"`
+
+	// +optional
+	Venafi *VenafiIssuer `json:"venafi,omitempty"`
+}
+
+// VenafiIssuer describes issuer configuration details for Venafi Cloud.
+type VenafiIssuer struct {
+	// Zone is the Venafi Policy Zone to use for this issuer.
+	// All requests made to the Venafi platform will be restricted by the named
+	// zone policy.
+	// This field is required.
+	Zone string `json:"zone"`
+
+	// TPP specifies Trust Protection Platform configuration settings.
+	// Only one of TPP or Cloud may be specified.
+	// +optional
+	TPP *VenafiTPP `json:"tpp,omitempty"`
+
+	// Cloud specifies the Venafi cloud configuration settings.
+	// Only one of TPP or Cloud may be specified.
+	// +optional
+	Cloud *VenafiCloud `json:"cloud,omitempty"`
+}
+
+// VenafiTPP defines connection configuration details for a Venafi TPP instance
+type VenafiTPP struct {
+	// URL is the base URL for the Venafi TPP instance
+	URL string `json:"url"`
+
+	// CredentialsRef is a reference to a Secret containing the username and
+	// password for the TPP server.
+	// The secret must contain two keys, 'username' and 'password'.
+	CredentialsRef cmmeta.LocalObjectReference `json:"credentialsRef"`
+
+	// CABundle is a PEM encoded TLS certifiate to use to verify connections to
+	// the TPP instance.
+	// If specified, system roots will not be used and the issuing CA for the
+	// TPP instance must be verifiable using the provided root.
+	// If not specified, the connection will be verified using the cert-manager
+	// system root certificates.
+	// +optional
+	CABundle []byte `json:"caBundle,omitempty"`
+}
+
+// VenafiCloud defines connection configuration details for Venafi Cloud
+type VenafiCloud struct {
+	// URL is the base URL for Venafi Cloud
+	URL string `json:"url"`
+
+	// APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+	APITokenSecretRef cmmeta.SecretKeySelector `json:"apiTokenSecretRef"`
+}
+
+type SelfSignedIssuer struct{}
+
+type VaultIssuer struct {
+	// Vault authentication
+	Auth VaultAuth `json:"auth"`
+
+	// Server is the vault connection address
+	Server string `json:"server"`
+
+	// Vault URL path to the certificate role
+	Path string `json:"path"`
+
+	// Base64 encoded CA bundle to validate Vault server certificate. Only used
+	// if the Server URL is using HTTPS protocol. This parameter is ignored for
+	// plain HTTP protocol connection. If not set the system root certificates
+	// are used to validate the TLS connection.
+	// +optional
+	CABundle []byte `json:"caBundle,omitempty"`
+}
+
+// Vault authentication  can be configured:
+// - With a secret containing a token. Cert-manager is using this token as-is.
+// - With a secret containing a AppRole. This AppRole is used to authenticate to
+//   Vault and retrieve a token.
+type VaultAuth struct {
+	// This Secret contains the Vault token key
+	// +optional
+	TokenSecretRef *cmmeta.SecretKeySelector `json:"tokenSecretRef,omitempty"`
+
+	// This Secret contains a AppRole and Secret
+	// +optional
+	AppRole *VaultAppRole `json:"appRole,omitempty"`
+
+	// This contains a Role and Secret with a ServiceAccount token to
+	// authenticate with vault.
+	// +optional
+	Kubernetes *VaultKubernetesAuth `json:"kubernetes,omitempty"`
+}
+
+type VaultAppRole struct {
+	// Where the authentication path is mounted in Vault.
+	Path string `json:"path"`
+
+	RoleId    string                   `json:"roleId"`
+	SecretRef cmmeta.SecretKeySelector `json:"secretRef"`
+}
+
+// Authenticate against Vault using a Kubernetes ServiceAccount token stored in
+// a Secret.
+type VaultKubernetesAuth struct {
+	// The Vault mountPath here is the mount path to use when authenticating with
+	// Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+	// `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+	// default value "/v1/auth/kubernetes" will be used.
+	// +optional
+	Path string `json:"mountPath,omitempty"`
+
+	// The required Secret field containing a Kubernetes ServiceAccount JWT used
+	// for authenticating with Vault. Use of 'ambient credentials' is not
+	// supported.
+	SecretRef cmmeta.SecretKeySelector `json:"secretRef"`
+
+	// A required field containing the Vault Role to assume. A Role binds a
+	// Kubernetes ServiceAccount with a set of Vault policies.
+	Role string `json:"role"`
+}
+
+type CAIssuer struct {
+	// SecretName is the name of the secret used to sign Certificates issued
+	// by this Issuer.
+	SecretName string `json:"secretName"`
+}
+
+// IssuerStatus contains status information about an Issuer
+type IssuerStatus struct {
+	// +optional
+	Conditions []IssuerCondition `json:"conditions,omitempty"`
+
+	// +optional
+	ACME *cmacme.ACMEIssuerStatus `json:"acme,omitempty"`
+}
+
+// IssuerCondition contains condition information for an Issuer.
+type IssuerCondition struct {
+	// Type of the condition, currently ('Ready').
+	Type IssuerConditionType `json:"type"`
+
+	// Status of the condition, one of ('True', 'False', 'Unknown').
+	Status cmmeta.ConditionStatus `json:"status"`
+
+	// LastTransitionTime is the timestamp corresponding to the last status
+	// change of this condition.
+	// +optional
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+
+	// Reason is a brief machine readable explanation for the condition's last
+	// transition.
+	// +optional
+	Reason string `json:"reason,omitempty"`
+
+	// Message is a human readable description of the details of the last
+	// transition, complementing reason.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+// IssuerConditionType represents an Issuer condition value.
+type IssuerConditionType string
+
+const (
+	// IssuerConditionReady represents the fact that a given Issuer condition
+	// is in ready state.
+	IssuerConditionReady IssuerConditionType = "Ready"
+)

pkg/apis/certmanager/v1alpha3/zz_generated.deepcopy.go

@@ -0,0 +1,805 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	metav1 "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CAIssuer) DeepCopyInto(out *CAIssuer) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CAIssuer.
+func (in *CAIssuer) DeepCopy() *CAIssuer {
+	if in == nil {
+		return nil
+	}
+	out := new(CAIssuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Certificate) DeepCopyInto(out *Certificate) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Certificate.
+func (in *Certificate) DeepCopy() *Certificate {
+	if in == nil {
+		return nil
+	}
+	out := new(Certificate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Certificate) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateCondition) DeepCopyInto(out *CertificateCondition) {
+	*out = *in
+	if in.LastTransitionTime != nil {
+		in, out := &in.LastTransitionTime, &out.LastTransitionTime
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateCondition.
+func (in *CertificateCondition) DeepCopy() *CertificateCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateList) DeepCopyInto(out *CertificateList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Certificate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateList.
+func (in *CertificateList) DeepCopy() *CertificateList {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CertificateList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateRequest) DeepCopyInto(out *CertificateRequest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateRequest.
+func (in *CertificateRequest) DeepCopy() *CertificateRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateRequest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CertificateRequest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateRequestCondition) DeepCopyInto(out *CertificateRequestCondition) {
+	*out = *in
+	if in.LastTransitionTime != nil {
+		in, out := &in.LastTransitionTime, &out.LastTransitionTime
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateRequestCondition.
+func (in *CertificateRequestCondition) DeepCopy() *CertificateRequestCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateRequestCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateRequestList) DeepCopyInto(out *CertificateRequestList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]CertificateRequest, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateRequestList.
+func (in *CertificateRequestList) DeepCopy() *CertificateRequestList {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateRequestList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CertificateRequestList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateRequestSpec) DeepCopyInto(out *CertificateRequestSpec) {
+	*out = *in
+	if in.Duration != nil {
+		in, out := &in.Duration, &out.Duration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	out.IssuerRef = in.IssuerRef
+	if in.CSRPEM != nil {
+		in, out := &in.CSRPEM, &out.CSRPEM
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Usages != nil {
+		in, out := &in.Usages, &out.Usages
+		*out = make([]KeyUsage, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateRequestSpec.
+func (in *CertificateRequestSpec) DeepCopy() *CertificateRequestSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateRequestSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateRequestStatus) DeepCopyInto(out *CertificateRequestStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]CertificateRequestCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Certificate != nil {
+		in, out := &in.Certificate, &out.Certificate
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.CA != nil {
+		in, out := &in.CA, &out.CA
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.FailureTime != nil {
+		in, out := &in.FailureTime, &out.FailureTime
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateRequestStatus.
+func (in *CertificateRequestStatus) DeepCopy() *CertificateRequestStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateRequestStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) {
+	*out = *in
+	if in.Subject != nil {
+		in, out := &in.Subject, &out.Subject
+		*out = new(X509Subject)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Organization != nil {
+		in, out := &in.Organization, &out.Organization
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Duration != nil {
+		in, out := &in.Duration, &out.Duration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.RenewBefore != nil {
+		in, out := &in.RenewBefore, &out.RenewBefore
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.DNSNames != nil {
+		in, out := &in.DNSNames, &out.DNSNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.IPAddresses != nil {
+		in, out := &in.IPAddresses, &out.IPAddresses
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.URISANs != nil {
+		in, out := &in.URISANs, &out.URISANs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	out.IssuerRef = in.IssuerRef
+	if in.Usages != nil {
+		in, out := &in.Usages, &out.Usages
+		*out = make([]KeyUsage, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSpec.
+func (in *CertificateSpec) DeepCopy() *CertificateSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertificateStatus) DeepCopyInto(out *CertificateStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]CertificateCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.LastFailureTime != nil {
+		in, out := &in.LastFailureTime, &out.LastFailureTime
+		*out = (*in).DeepCopy()
+	}
+	if in.NotAfter != nil {
+		in, out := &in.NotAfter, &out.NotAfter
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateStatus.
+func (in *CertificateStatus) DeepCopy() *CertificateStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CertificateStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterIssuer) DeepCopyInto(out *ClusterIssuer) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterIssuer.
+func (in *ClusterIssuer) DeepCopy() *ClusterIssuer {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterIssuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterIssuer) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterIssuerList) DeepCopyInto(out *ClusterIssuerList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterIssuer, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterIssuerList.
+func (in *ClusterIssuerList) DeepCopy() *ClusterIssuerList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterIssuerList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterIssuerList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Issuer) DeepCopyInto(out *Issuer) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Issuer.
+func (in *Issuer) DeepCopy() *Issuer {
+	if in == nil {
+		return nil
+	}
+	out := new(Issuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Issuer) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IssuerCondition) DeepCopyInto(out *IssuerCondition) {
+	*out = *in
+	if in.LastTransitionTime != nil {
+		in, out := &in.LastTransitionTime, &out.LastTransitionTime
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IssuerCondition.
+func (in *IssuerCondition) DeepCopy() *IssuerCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(IssuerCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IssuerConfig) DeepCopyInto(out *IssuerConfig) {
+	*out = *in
+	if in.ACME != nil {
+		in, out := &in.ACME, &out.ACME
+		*out = new(acmev1alpha3.ACMEIssuer)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.CA != nil {
+		in, out := &in.CA, &out.CA
+		*out = new(CAIssuer)
+		**out = **in
+	}
+	if in.Vault != nil {
+		in, out := &in.Vault, &out.Vault
+		*out = new(VaultIssuer)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SelfSigned != nil {
+		in, out := &in.SelfSigned, &out.SelfSigned
+		*out = new(SelfSignedIssuer)
+		**out = **in
+	}
+	if in.Venafi != nil {
+		in, out := &in.Venafi, &out.Venafi
+		*out = new(VenafiIssuer)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IssuerConfig.
+func (in *IssuerConfig) DeepCopy() *IssuerConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(IssuerConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IssuerList) DeepCopyInto(out *IssuerList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Issuer, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IssuerList.
+func (in *IssuerList) DeepCopy() *IssuerList {
+	if in == nil {
+		return nil
+	}
+	out := new(IssuerList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *IssuerList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IssuerSpec) DeepCopyInto(out *IssuerSpec) {
+	*out = *in
+	in.IssuerConfig.DeepCopyInto(&out.IssuerConfig)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IssuerSpec.
+func (in *IssuerSpec) DeepCopy() *IssuerSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(IssuerSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IssuerStatus) DeepCopyInto(out *IssuerStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]IssuerCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ACME != nil {
+		in, out := &in.ACME, &out.ACME
+		*out = new(acmev1alpha3.ACMEIssuerStatus)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IssuerStatus.
+func (in *IssuerStatus) DeepCopy() *IssuerStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(IssuerStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SelfSignedIssuer) DeepCopyInto(out *SelfSignedIssuer) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelfSignedIssuer.
+func (in *SelfSignedIssuer) DeepCopy() *SelfSignedIssuer {
+	if in == nil {
+		return nil
+	}
+	out := new(SelfSignedIssuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VaultAppRole) DeepCopyInto(out *VaultAppRole) {
+	*out = *in
+	out.SecretRef = in.SecretRef
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultAppRole.
+func (in *VaultAppRole) DeepCopy() *VaultAppRole {
+	if in == nil {
+		return nil
+	}
+	out := new(VaultAppRole)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VaultAuth) DeepCopyInto(out *VaultAuth) {
+	*out = *in
+	if in.TokenSecretRef != nil {
+		in, out := &in.TokenSecretRef, &out.TokenSecretRef
+		*out = new(metav1.SecretKeySelector)
+		**out = **in
+	}
+	if in.AppRole != nil {
+		in, out := &in.AppRole, &out.AppRole
+		*out = new(VaultAppRole)
+		**out = **in
+	}
+	if in.Kubernetes != nil {
+		in, out := &in.Kubernetes, &out.Kubernetes
+		*out = new(VaultKubernetesAuth)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultAuth.
+func (in *VaultAuth) DeepCopy() *VaultAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(VaultAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VaultIssuer) DeepCopyInto(out *VaultIssuer) {
+	*out = *in
+	in.Auth.DeepCopyInto(&out.Auth)
+	if in.CABundle != nil {
+		in, out := &in.CABundle, &out.CABundle
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultIssuer.
+func (in *VaultIssuer) DeepCopy() *VaultIssuer {
+	if in == nil {
+		return nil
+	}
+	out := new(VaultIssuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VaultKubernetesAuth) DeepCopyInto(out *VaultKubernetesAuth) {
+	*out = *in
+	out.SecretRef = in.SecretRef
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultKubernetesAuth.
+func (in *VaultKubernetesAuth) DeepCopy() *VaultKubernetesAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(VaultKubernetesAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VenafiCloud) DeepCopyInto(out *VenafiCloud) {
+	*out = *in
+	out.APITokenSecretRef = in.APITokenSecretRef
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VenafiCloud.
+func (in *VenafiCloud) DeepCopy() *VenafiCloud {
+	if in == nil {
+		return nil
+	}
+	out := new(VenafiCloud)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VenafiIssuer) DeepCopyInto(out *VenafiIssuer) {
+	*out = *in
+	if in.TPP != nil {
+		in, out := &in.TPP, &out.TPP
+		*out = new(VenafiTPP)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Cloud != nil {
+		in, out := &in.Cloud, &out.Cloud
+		*out = new(VenafiCloud)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VenafiIssuer.
+func (in *VenafiIssuer) DeepCopy() *VenafiIssuer {
+	if in == nil {
+		return nil
+	}
+	out := new(VenafiIssuer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VenafiTPP) DeepCopyInto(out *VenafiTPP) {
+	*out = *in
+	out.CredentialsRef = in.CredentialsRef
+	if in.CABundle != nil {
+		in, out := &in.CABundle, &out.CABundle
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VenafiTPP.
+func (in *VenafiTPP) DeepCopy() *VenafiTPP {
+	if in == nil {
+		return nil
+	}
+	out := new(VenafiTPP)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *X509Subject) DeepCopyInto(out *X509Subject) {
+	*out = *in
+	if in.Countries != nil {
+		in, out := &in.Countries, &out.Countries
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.OrganizationalUnits != nil {
+		in, out := &in.OrganizationalUnits, &out.OrganizationalUnits
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Localities != nil {
+		in, out := &in.Localities, &out.Localities
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Provinces != nil {
+		in, out := &in.Provinces, &out.Provinces
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.StreetAddresses != nil {
+		in, out := &in.StreetAddresses, &out.StreetAddresses
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.PostalCodes != nil {
+		in, out := &in.PostalCodes, &out.PostalCodes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new X509Subject.
+func (in *X509Subject) DeepCopy() *X509Subject {
+	if in == nil {
+		return nil
+	}
+	out := new(X509Subject)
+	in.DeepCopyInto(out)
+	return out
+}

pkg/client/clientset/versioned/BUILD.bazel

@@ -10,7 +10,9 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/client/clientset/versioned/typed/acme/v1alpha2:go_default_library",
+        "//pkg/client/clientset/versioned/typed/acme/v1alpha3:go_default_library",
         "//pkg/client/clientset/versioned/typed/certmanager/v1alpha2:go_default_library",
+        "//pkg/client/clientset/versioned/typed/certmanager/v1alpha3:go_default_library",
         "@io_k8s_client_go//discovery:go_default_library",
         "@io_k8s_client_go//rest:go_default_library",
         "@io_k8s_client_go//util/flowcontrol:go_default_library",
@@ -31,7 +33,9 @@ filegroup(
         "//pkg/client/clientset/versioned/fake:all-srcs",
         "//pkg/client/clientset/versioned/scheme:all-srcs",
         "//pkg/client/clientset/versioned/typed/acme/v1alpha2:all-srcs",
+        "//pkg/client/clientset/versioned/typed/acme/v1alpha3:all-srcs",
         "//pkg/client/clientset/versioned/typed/certmanager/v1alpha2:all-srcs",
+        "//pkg/client/clientset/versioned/typed/certmanager/v1alpha3:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],

pkg/client/clientset/versioned/clientset.go

@@ -22,7 +22,9 @@ import (
 	"fmt"
 
 	acmev1alpha2 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha2"
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha3"
 	certmanagerv1alpha2 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha2"
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha3"
 	discovery "k8s.io/client-go/discovery"
 	rest "k8s.io/client-go/rest"
 	flowcontrol "k8s.io/client-go/util/flowcontrol"
@@ -31,7 +33,9 @@ import (
 type Interface interface {
 	Discovery() discovery.DiscoveryInterface
 	AcmeV1alpha2() acmev1alpha2.AcmeV1alpha2Interface
+	AcmeV1alpha3() acmev1alpha3.AcmeV1alpha3Interface
 	CertmanagerV1alpha2() certmanagerv1alpha2.CertmanagerV1alpha2Interface
+	CertmanagerV1alpha3() certmanagerv1alpha3.CertmanagerV1alpha3Interface
 }
 
 // Clientset contains the clients for groups. Each group has exactly one
@@ -39,7 +43,9 @@ type Interface interface {
 type Clientset struct {
 	*discovery.DiscoveryClient
 	acmeV1alpha2        *acmev1alpha2.AcmeV1alpha2Client
+	acmeV1alpha3        *acmev1alpha3.AcmeV1alpha3Client
 	certmanagerV1alpha2 *certmanagerv1alpha2.CertmanagerV1alpha2Client
+	certmanagerV1alpha3 *certmanagerv1alpha3.CertmanagerV1alpha3Client
 }
 
 // AcmeV1alpha2 retrieves the AcmeV1alpha2Client
@@ -47,11 +53,21 @@ func (c *Clientset) AcmeV1alpha2() acmev1alpha2.AcmeV1alpha2Interface {
 	return c.acmeV1alpha2
 }
 
+// AcmeV1alpha3 retrieves the AcmeV1alpha3Client
+func (c *Clientset) AcmeV1alpha3() acmev1alpha3.AcmeV1alpha3Interface {
+	return c.acmeV1alpha3
+}
+
 // CertmanagerV1alpha2 retrieves the CertmanagerV1alpha2Client
 func (c *Clientset) CertmanagerV1alpha2() certmanagerv1alpha2.CertmanagerV1alpha2Interface {
 	return c.certmanagerV1alpha2
 }
 
+// CertmanagerV1alpha3 retrieves the CertmanagerV1alpha3Client
+func (c *Clientset) CertmanagerV1alpha3() certmanagerv1alpha3.CertmanagerV1alpha3Interface {
+	return c.certmanagerV1alpha3
+}
+
 // Discovery retrieves the DiscoveryClient
 func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 	if c == nil {
@@ -77,10 +93,18 @@ func NewForConfig(c *rest.Config) (*Clientset, error) {
 	if err != nil {
 		return nil, err
 	}
+	cs.acmeV1alpha3, err = acmev1alpha3.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
 	cs.certmanagerV1alpha2, err = certmanagerv1alpha2.NewForConfig(&configShallowCopy)
 	if err != nil {
 		return nil, err
 	}
+	cs.certmanagerV1alpha3, err = certmanagerv1alpha3.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
 
 	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
 	if err != nil {
@@ -94,7 +118,9 @@ func NewForConfig(c *rest.Config) (*Clientset, error) {
 func NewForConfigOrDie(c *rest.Config) *Clientset {
 	var cs Clientset
 	cs.acmeV1alpha2 = acmev1alpha2.NewForConfigOrDie(c)
+	cs.acmeV1alpha3 = acmev1alpha3.NewForConfigOrDie(c)
 	cs.certmanagerV1alpha2 = certmanagerv1alpha2.NewForConfigOrDie(c)
+	cs.certmanagerV1alpha3 = certmanagerv1alpha3.NewForConfigOrDie(c)
 
 	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
 	return &cs
@@ -104,7 +130,9 @@ func NewForConfigOrDie(c *rest.Config) *Clientset {
 func New(c rest.Interface) *Clientset {
 	var cs Clientset
 	cs.acmeV1alpha2 = acmev1alpha2.New(c)
+	cs.acmeV1alpha3 = acmev1alpha3.New(c)
 	cs.certmanagerV1alpha2 = certmanagerv1alpha2.New(c)
+	cs.certmanagerV1alpha3 = certmanagerv1alpha3.New(c)
 
 	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
 	return &cs

pkg/client/clientset/versioned/fake/BUILD.bazel

@@ -11,12 +11,18 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/apis/acme/v1alpha2:go_default_library",
+        "//pkg/apis/acme/v1alpha3:go_default_library",
         "//pkg/apis/certmanager/v1alpha2:go_default_library",
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
         "//pkg/client/clientset/versioned:go_default_library",
         "//pkg/client/clientset/versioned/typed/acme/v1alpha2:go_default_library",
         "//pkg/client/clientset/versioned/typed/acme/v1alpha2/fake:go_default_library",
+        "//pkg/client/clientset/versioned/typed/acme/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned/typed/acme/v1alpha3/fake:go_default_library",
         "//pkg/client/clientset/versioned/typed/certmanager/v1alpha2:go_default_library",
         "//pkg/client/clientset/versioned/typed/certmanager/v1alpha2/fake:go_default_library",
+        "//pkg/client/clientset/versioned/typed/certmanager/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake:go_default_library",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",

pkg/client/clientset/versioned/fake/clientset_generated.go

@@ -22,8 +22,12 @@ import (
 	clientset "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
 	acmev1alpha2 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha2"
 	fakeacmev1alpha2 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha2/fake"
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha3"
+	fakeacmev1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha3/fake"
 	certmanagerv1alpha2 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha2"
 	fakecertmanagerv1alpha2 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha2/fake"
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha3"
+	fakecertmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/discovery"
@@ -83,7 +87,17 @@ func (c *Clientset) AcmeV1alpha2() acmev1alpha2.AcmeV1alpha2Interface {
 	return &fakeacmev1alpha2.FakeAcmeV1alpha2{Fake: &c.Fake}
 }
 
+// AcmeV1alpha3 retrieves the AcmeV1alpha3Client
+func (c *Clientset) AcmeV1alpha3() acmev1alpha3.AcmeV1alpha3Interface {
+	return &fakeacmev1alpha3.FakeAcmeV1alpha3{Fake: &c.Fake}
+}
+
 // CertmanagerV1alpha2 retrieves the CertmanagerV1alpha2Client
 func (c *Clientset) CertmanagerV1alpha2() certmanagerv1alpha2.CertmanagerV1alpha2Interface {
 	return &fakecertmanagerv1alpha2.FakeCertmanagerV1alpha2{Fake: &c.Fake}
 }
+
+// CertmanagerV1alpha3 retrieves the CertmanagerV1alpha3Client
+func (c *Clientset) CertmanagerV1alpha3() certmanagerv1alpha3.CertmanagerV1alpha3Interface {
+	return &fakecertmanagerv1alpha3.FakeCertmanagerV1alpha3{Fake: &c.Fake}
+}

pkg/client/clientset/versioned/fake/register.go

@@ -20,7 +20,9 @@ package fake
 
 import (
 	acmev1alpha2 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha2"
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
 	certmanagerv1alpha2 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -33,7 +35,9 @@ var codecs = serializer.NewCodecFactory(scheme)
 var parameterCodec = runtime.NewParameterCodec(scheme)
 var localSchemeBuilder = runtime.SchemeBuilder{
 	acmev1alpha2.AddToScheme,
+	acmev1alpha3.AddToScheme,
 	certmanagerv1alpha2.AddToScheme,
+	certmanagerv1alpha3.AddToScheme,
 }
 
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition

pkg/client/clientset/versioned/scheme/BUILD.bazel

@@ -10,7 +10,9 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/apis/acme/v1alpha2:go_default_library",
+        "//pkg/apis/acme/v1alpha3:go_default_library",
         "//pkg/apis/certmanager/v1alpha2:go_default_library",
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",

pkg/client/clientset/versioned/scheme/register.go

@@ -20,7 +20,9 @@ package scheme
 
 import (
 	acmev1alpha2 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha2"
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
 	certmanagerv1alpha2 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
@@ -33,7 +35,9 @@ var Codecs = serializer.NewCodecFactory(Scheme)
 var ParameterCodec = runtime.NewParameterCodec(Scheme)
 var localSchemeBuilder = runtime.SchemeBuilder{
 	acmev1alpha2.AddToScheme,
+	acmev1alpha3.AddToScheme,
 	certmanagerv1alpha2.AddToScheme,
+	certmanagerv1alpha3.AddToScheme,
 }
 
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition

pkg/client/clientset/versioned/typed/acme/v1alpha3/BUILD.bazel

@@ -0,0 +1,39 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "acme_client.go",
+        "challenge.go",
+        "doc.go",
+        "generated_expansion.go",
+        "order.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/acme/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned/scheme:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/types:go_default_library",
+        "@io_k8s_apimachinery//pkg/watch:go_default_library",
+        "@io_k8s_client_go//rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/client/clientset/versioned/typed/acme/v1alpha3/fake:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/clientset/versioned/typed/acme/v1alpha3/acme_client.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	"github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type AcmeV1alpha3Interface interface {
+	RESTClient() rest.Interface
+	ChallengesGetter
+	OrdersGetter
+}
+
+// AcmeV1alpha3Client is used to interact with features provided by the acme.cert-manager.io group.
+type AcmeV1alpha3Client struct {
+	restClient rest.Interface
+}
+
+func (c *AcmeV1alpha3Client) Challenges(namespace string) ChallengeInterface {
+	return newChallenges(c, namespace)
+}
+
+func (c *AcmeV1alpha3Client) Orders(namespace string) OrderInterface {
+	return newOrders(c, namespace)
+}
+
+// NewForConfig creates a new AcmeV1alpha3Client for the given config.
+func NewForConfig(c *rest.Config) (*AcmeV1alpha3Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &AcmeV1alpha3Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new AcmeV1alpha3Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *AcmeV1alpha3Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new AcmeV1alpha3Client for the given RESTClient.
+func New(c rest.Interface) *AcmeV1alpha3Client {
+	return &AcmeV1alpha3Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha3.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AcmeV1alpha3Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

pkg/client/clientset/versioned/typed/acme/v1alpha3/challenge.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	"time"
+
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	scheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// ChallengesGetter has a method to return a ChallengeInterface.
+// A group's client should implement this interface.
+type ChallengesGetter interface {
+	Challenges(namespace string) ChallengeInterface
+}
+
+// ChallengeInterface has methods to work with Challenge resources.
+type ChallengeInterface interface {
+	Create(*v1alpha3.Challenge) (*v1alpha3.Challenge, error)
+	Update(*v1alpha3.Challenge) (*v1alpha3.Challenge, error)
+	UpdateStatus(*v1alpha3.Challenge) (*v1alpha3.Challenge, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.Challenge, error)
+	List(opts v1.ListOptions) (*v1alpha3.ChallengeList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Challenge, err error)
+	ChallengeExpansion
+}
+
+// challenges implements ChallengeInterface
+type challenges struct {
+	client rest.Interface
+	ns     string
+}
+
+// newChallenges returns a Challenges
+func newChallenges(c *AcmeV1alpha3Client, namespace string) *challenges {
+	return &challenges{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the challenge, and returns the corresponding challenge object, and an error if there is any.
+func (c *challenges) Get(name string, options v1.GetOptions) (result *v1alpha3.Challenge, err error) {
+	result = &v1alpha3.Challenge{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("challenges").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Challenges that match those selectors.
+func (c *challenges) List(opts v1.ListOptions) (result *v1alpha3.ChallengeList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha3.ChallengeList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("challenges").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested challenges.
+func (c *challenges) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("challenges").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a challenge and creates it.  Returns the server's representation of the challenge, and an error, if there is any.
+func (c *challenges) Create(challenge *v1alpha3.Challenge) (result *v1alpha3.Challenge, err error) {
+	result = &v1alpha3.Challenge{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("challenges").
+		Body(challenge).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a challenge and updates it. Returns the server's representation of the challenge, and an error, if there is any.
+func (c *challenges) Update(challenge *v1alpha3.Challenge) (result *v1alpha3.Challenge, err error) {
+	result = &v1alpha3.Challenge{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("challenges").
+		Name(challenge.Name).
+		Body(challenge).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *challenges) UpdateStatus(challenge *v1alpha3.Challenge) (result *v1alpha3.Challenge, err error) {
+	result = &v1alpha3.Challenge{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("challenges").
+		Name(challenge.Name).
+		SubResource("status").
+		Body(challenge).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the challenge and deletes it. Returns an error if one occurs.
+func (c *challenges) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("challenges").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *challenges) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("challenges").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched challenge.
+func (c *challenges) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Challenge, err error) {
+	result = &v1alpha3.Challenge{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("challenges").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/acme/v1alpha3/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha3

pkg/client/clientset/versioned/typed/acme/v1alpha3/fake/BUILD.bazel

@@ -0,0 +1,38 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "fake_acme_client.go",
+        "fake_challenge.go",
+        "fake_order.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha3/fake",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/acme/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned/typed/acme/v1alpha3:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/labels:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+        "@io_k8s_apimachinery//pkg/types:go_default_library",
+        "@io_k8s_apimachinery//pkg/watch:go_default_library",
+        "@io_k8s_client_go//rest:go_default_library",
+        "@io_k8s_client_go//testing:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/clientset/versioned/typed/acme/v1alpha3/fake/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake

pkg/client/clientset/versioned/typed/acme/v1alpha3/fake/fake_acme_client.go

@@ -0,0 +1,44 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/acme/v1alpha3"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeAcmeV1alpha3 struct {
+	*testing.Fake
+}
+
+func (c *FakeAcmeV1alpha3) Challenges(namespace string) v1alpha3.ChallengeInterface {
+	return &FakeChallenges{c, namespace}
+}
+
+func (c *FakeAcmeV1alpha3) Orders(namespace string) v1alpha3.OrderInterface {
+	return &FakeOrders{c, namespace}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeAcmeV1alpha3) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}

pkg/client/clientset/versioned/typed/acme/v1alpha3/fake/fake_challenge.go

@@ -0,0 +1,140 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeChallenges implements ChallengeInterface
+type FakeChallenges struct {
+	Fake *FakeAcmeV1alpha3
+	ns   string
+}
+
+var challengesResource = schema.GroupVersionResource{Group: "acme.cert-manager.io", Version: "v1alpha3", Resource: "challenges"}
+
+var challengesKind = schema.GroupVersionKind{Group: "acme.cert-manager.io", Version: "v1alpha3", Kind: "Challenge"}
+
+// Get takes name of the challenge, and returns the corresponding challenge object, and an error if there is any.
+func (c *FakeChallenges) Get(name string, options v1.GetOptions) (result *v1alpha3.Challenge, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(challengesResource, c.ns, name), &v1alpha3.Challenge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Challenge), err
+}
+
+// List takes label and field selectors, and returns the list of Challenges that match those selectors.
+func (c *FakeChallenges) List(opts v1.ListOptions) (result *v1alpha3.ChallengeList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(challengesResource, challengesKind, c.ns, opts), &v1alpha3.ChallengeList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha3.ChallengeList{ListMeta: obj.(*v1alpha3.ChallengeList).ListMeta}
+	for _, item := range obj.(*v1alpha3.ChallengeList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested challenges.
+func (c *FakeChallenges) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(challengesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a challenge and creates it.  Returns the server's representation of the challenge, and an error, if there is any.
+func (c *FakeChallenges) Create(challenge *v1alpha3.Challenge) (result *v1alpha3.Challenge, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(challengesResource, c.ns, challenge), &v1alpha3.Challenge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Challenge), err
+}
+
+// Update takes the representation of a challenge and updates it. Returns the server's representation of the challenge, and an error, if there is any.
+func (c *FakeChallenges) Update(challenge *v1alpha3.Challenge) (result *v1alpha3.Challenge, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(challengesResource, c.ns, challenge), &v1alpha3.Challenge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Challenge), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeChallenges) UpdateStatus(challenge *v1alpha3.Challenge) (*v1alpha3.Challenge, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(challengesResource, "status", c.ns, challenge), &v1alpha3.Challenge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Challenge), err
+}
+
+// Delete takes name of the challenge and deletes it. Returns an error if one occurs.
+func (c *FakeChallenges) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(challengesResource, c.ns, name), &v1alpha3.Challenge{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeChallenges) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(challengesResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha3.ChallengeList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched challenge.
+func (c *FakeChallenges) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Challenge, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(challengesResource, c.ns, name, pt, data, subresources...), &v1alpha3.Challenge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Challenge), err
+}

pkg/client/clientset/versioned/typed/acme/v1alpha3/fake/fake_order.go

@@ -0,0 +1,140 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeOrders implements OrderInterface
+type FakeOrders struct {
+	Fake *FakeAcmeV1alpha3
+	ns   string
+}
+
+var ordersResource = schema.GroupVersionResource{Group: "acme.cert-manager.io", Version: "v1alpha3", Resource: "orders"}
+
+var ordersKind = schema.GroupVersionKind{Group: "acme.cert-manager.io", Version: "v1alpha3", Kind: "Order"}
+
+// Get takes name of the order, and returns the corresponding order object, and an error if there is any.
+func (c *FakeOrders) Get(name string, options v1.GetOptions) (result *v1alpha3.Order, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(ordersResource, c.ns, name), &v1alpha3.Order{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Order), err
+}
+
+// List takes label and field selectors, and returns the list of Orders that match those selectors.
+func (c *FakeOrders) List(opts v1.ListOptions) (result *v1alpha3.OrderList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(ordersResource, ordersKind, c.ns, opts), &v1alpha3.OrderList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha3.OrderList{ListMeta: obj.(*v1alpha3.OrderList).ListMeta}
+	for _, item := range obj.(*v1alpha3.OrderList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested orders.
+func (c *FakeOrders) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(ordersResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a order and creates it.  Returns the server's representation of the order, and an error, if there is any.
+func (c *FakeOrders) Create(order *v1alpha3.Order) (result *v1alpha3.Order, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(ordersResource, c.ns, order), &v1alpha3.Order{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Order), err
+}
+
+// Update takes the representation of a order and updates it. Returns the server's representation of the order, and an error, if there is any.
+func (c *FakeOrders) Update(order *v1alpha3.Order) (result *v1alpha3.Order, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(ordersResource, c.ns, order), &v1alpha3.Order{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Order), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeOrders) UpdateStatus(order *v1alpha3.Order) (*v1alpha3.Order, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(ordersResource, "status", c.ns, order), &v1alpha3.Order{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Order), err
+}
+
+// Delete takes name of the order and deletes it. Returns an error if one occurs.
+func (c *FakeOrders) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(ordersResource, c.ns, name), &v1alpha3.Order{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeOrders) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(ordersResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha3.OrderList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched order.
+func (c *FakeOrders) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Order, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(ordersResource, c.ns, name, pt, data, subresources...), &v1alpha3.Order{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Order), err
+}

pkg/client/clientset/versioned/typed/acme/v1alpha3/generated_expansion.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+type ChallengeExpansion interface{}
+
+type OrderExpansion interface{}

pkg/client/clientset/versioned/typed/acme/v1alpha3/order.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	"time"
+
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	scheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// OrdersGetter has a method to return a OrderInterface.
+// A group's client should implement this interface.
+type OrdersGetter interface {
+	Orders(namespace string) OrderInterface
+}
+
+// OrderInterface has methods to work with Order resources.
+type OrderInterface interface {
+	Create(*v1alpha3.Order) (*v1alpha3.Order, error)
+	Update(*v1alpha3.Order) (*v1alpha3.Order, error)
+	UpdateStatus(*v1alpha3.Order) (*v1alpha3.Order, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.Order, error)
+	List(opts v1.ListOptions) (*v1alpha3.OrderList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Order, err error)
+	OrderExpansion
+}
+
+// orders implements OrderInterface
+type orders struct {
+	client rest.Interface
+	ns     string
+}
+
+// newOrders returns a Orders
+func newOrders(c *AcmeV1alpha3Client, namespace string) *orders {
+	return &orders{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the order, and returns the corresponding order object, and an error if there is any.
+func (c *orders) Get(name string, options v1.GetOptions) (result *v1alpha3.Order, err error) {
+	result = &v1alpha3.Order{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("orders").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Orders that match those selectors.
+func (c *orders) List(opts v1.ListOptions) (result *v1alpha3.OrderList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha3.OrderList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("orders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested orders.
+func (c *orders) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("orders").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a order and creates it.  Returns the server's representation of the order, and an error, if there is any.
+func (c *orders) Create(order *v1alpha3.Order) (result *v1alpha3.Order, err error) {
+	result = &v1alpha3.Order{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("orders").
+		Body(order).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a order and updates it. Returns the server's representation of the order, and an error, if there is any.
+func (c *orders) Update(order *v1alpha3.Order) (result *v1alpha3.Order, err error) {
+	result = &v1alpha3.Order{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("orders").
+		Name(order.Name).
+		Body(order).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *orders) UpdateStatus(order *v1alpha3.Order) (result *v1alpha3.Order, err error) {
+	result = &v1alpha3.Order{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("orders").
+		Name(order.Name).
+		SubResource("status").
+		Body(order).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the order and deletes it. Returns an error if one occurs.
+func (c *orders) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("orders").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *orders) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("orders").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched order.
+func (c *orders) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Order, err error) {
+	result = &v1alpha3.Order{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("orders").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/BUILD.bazel

@@ -0,0 +1,41 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "certificate.go",
+        "certificaterequest.go",
+        "certmanager_client.go",
+        "clusterissuer.go",
+        "doc.go",
+        "generated_expansion.go",
+        "issuer.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned/scheme:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/types:go_default_library",
+        "@io_k8s_apimachinery//pkg/watch:go_default_library",
+        "@io_k8s_client_go//rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/certificate.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	"time"
+
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	scheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// CertificatesGetter has a method to return a CertificateInterface.
+// A group's client should implement this interface.
+type CertificatesGetter interface {
+	Certificates(namespace string) CertificateInterface
+}
+
+// CertificateInterface has methods to work with Certificate resources.
+type CertificateInterface interface {
+	Create(*v1alpha3.Certificate) (*v1alpha3.Certificate, error)
+	Update(*v1alpha3.Certificate) (*v1alpha3.Certificate, error)
+	UpdateStatus(*v1alpha3.Certificate) (*v1alpha3.Certificate, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.Certificate, error)
+	List(opts v1.ListOptions) (*v1alpha3.CertificateList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Certificate, err error)
+	CertificateExpansion
+}
+
+// certificates implements CertificateInterface
+type certificates struct {
+	client rest.Interface
+	ns     string
+}
+
+// newCertificates returns a Certificates
+func newCertificates(c *CertmanagerV1alpha3Client, namespace string) *certificates {
+	return &certificates{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the certificate, and returns the corresponding certificate object, and an error if there is any.
+func (c *certificates) Get(name string, options v1.GetOptions) (result *v1alpha3.Certificate, err error) {
+	result = &v1alpha3.Certificate{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("certificates").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Certificates that match those selectors.
+func (c *certificates) List(opts v1.ListOptions) (result *v1alpha3.CertificateList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha3.CertificateList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("certificates").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested certificates.
+func (c *certificates) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("certificates").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a certificate and creates it.  Returns the server's representation of the certificate, and an error, if there is any.
+func (c *certificates) Create(certificate *v1alpha3.Certificate) (result *v1alpha3.Certificate, err error) {
+	result = &v1alpha3.Certificate{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("certificates").
+		Body(certificate).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a certificate and updates it. Returns the server's representation of the certificate, and an error, if there is any.
+func (c *certificates) Update(certificate *v1alpha3.Certificate) (result *v1alpha3.Certificate, err error) {
+	result = &v1alpha3.Certificate{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("certificates").
+		Name(certificate.Name).
+		Body(certificate).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *certificates) UpdateStatus(certificate *v1alpha3.Certificate) (result *v1alpha3.Certificate, err error) {
+	result = &v1alpha3.Certificate{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("certificates").
+		Name(certificate.Name).
+		SubResource("status").
+		Body(certificate).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the certificate and deletes it. Returns an error if one occurs.
+func (c *certificates) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("certificates").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *certificates) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("certificates").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched certificate.
+func (c *certificates) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Certificate, err error) {
+	result = &v1alpha3.Certificate{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("certificates").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/certificaterequest.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	"time"
+
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	scheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// CertificateRequestsGetter has a method to return a CertificateRequestInterface.
+// A group's client should implement this interface.
+type CertificateRequestsGetter interface {
+	CertificateRequests(namespace string) CertificateRequestInterface
+}
+
+// CertificateRequestInterface has methods to work with CertificateRequest resources.
+type CertificateRequestInterface interface {
+	Create(*v1alpha3.CertificateRequest) (*v1alpha3.CertificateRequest, error)
+	Update(*v1alpha3.CertificateRequest) (*v1alpha3.CertificateRequest, error)
+	UpdateStatus(*v1alpha3.CertificateRequest) (*v1alpha3.CertificateRequest, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.CertificateRequest, error)
+	List(opts v1.ListOptions) (*v1alpha3.CertificateRequestList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.CertificateRequest, err error)
+	CertificateRequestExpansion
+}
+
+// certificateRequests implements CertificateRequestInterface
+type certificateRequests struct {
+	client rest.Interface
+	ns     string
+}
+
+// newCertificateRequests returns a CertificateRequests
+func newCertificateRequests(c *CertmanagerV1alpha3Client, namespace string) *certificateRequests {
+	return &certificateRequests{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the certificateRequest, and returns the corresponding certificateRequest object, and an error if there is any.
+func (c *certificateRequests) Get(name string, options v1.GetOptions) (result *v1alpha3.CertificateRequest, err error) {
+	result = &v1alpha3.CertificateRequest{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of CertificateRequests that match those selectors.
+func (c *certificateRequests) List(opts v1.ListOptions) (result *v1alpha3.CertificateRequestList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha3.CertificateRequestList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested certificateRequests.
+func (c *certificateRequests) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a certificateRequest and creates it.  Returns the server's representation of the certificateRequest, and an error, if there is any.
+func (c *certificateRequests) Create(certificateRequest *v1alpha3.CertificateRequest) (result *v1alpha3.CertificateRequest, err error) {
+	result = &v1alpha3.CertificateRequest{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		Body(certificateRequest).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a certificateRequest and updates it. Returns the server's representation of the certificateRequest, and an error, if there is any.
+func (c *certificateRequests) Update(certificateRequest *v1alpha3.CertificateRequest) (result *v1alpha3.CertificateRequest, err error) {
+	result = &v1alpha3.CertificateRequest{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		Name(certificateRequest.Name).
+		Body(certificateRequest).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *certificateRequests) UpdateStatus(certificateRequest *v1alpha3.CertificateRequest) (result *v1alpha3.CertificateRequest, err error) {
+	result = &v1alpha3.CertificateRequest{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		Name(certificateRequest.Name).
+		SubResource("status").
+		Body(certificateRequest).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the certificateRequest and deletes it. Returns an error if one occurs.
+func (c *certificateRequests) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *certificateRequests) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched certificateRequest.
+func (c *certificateRequests) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.CertificateRequest, err error) {
+	result = &v1alpha3.CertificateRequest{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("certificaterequests").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/certmanager_client.go

@@ -0,0 +1,104 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	"github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type CertmanagerV1alpha3Interface interface {
+	RESTClient() rest.Interface
+	CertificatesGetter
+	CertificateRequestsGetter
+	ClusterIssuersGetter
+	IssuersGetter
+}
+
+// CertmanagerV1alpha3Client is used to interact with features provided by the cert-manager.io group.
+type CertmanagerV1alpha3Client struct {
+	restClient rest.Interface
+}
+
+func (c *CertmanagerV1alpha3Client) Certificates(namespace string) CertificateInterface {
+	return newCertificates(c, namespace)
+}
+
+func (c *CertmanagerV1alpha3Client) CertificateRequests(namespace string) CertificateRequestInterface {
+	return newCertificateRequests(c, namespace)
+}
+
+func (c *CertmanagerV1alpha3Client) ClusterIssuers() ClusterIssuerInterface {
+	return newClusterIssuers(c)
+}
+
+func (c *CertmanagerV1alpha3Client) Issuers(namespace string) IssuerInterface {
+	return newIssuers(c, namespace)
+}
+
+// NewForConfig creates a new CertmanagerV1alpha3Client for the given config.
+func NewForConfig(c *rest.Config) (*CertmanagerV1alpha3Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &CertmanagerV1alpha3Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new CertmanagerV1alpha3Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *CertmanagerV1alpha3Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new CertmanagerV1alpha3Client for the given RESTClient.
+func New(c rest.Interface) *CertmanagerV1alpha3Client {
+	return &CertmanagerV1alpha3Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha3.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *CertmanagerV1alpha3Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/clusterissuer.go

@@ -0,0 +1,180 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	"time"
+
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	scheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// ClusterIssuersGetter has a method to return a ClusterIssuerInterface.
+// A group's client should implement this interface.
+type ClusterIssuersGetter interface {
+	ClusterIssuers() ClusterIssuerInterface
+}
+
+// ClusterIssuerInterface has methods to work with ClusterIssuer resources.
+type ClusterIssuerInterface interface {
+	Create(*v1alpha3.ClusterIssuer) (*v1alpha3.ClusterIssuer, error)
+	Update(*v1alpha3.ClusterIssuer) (*v1alpha3.ClusterIssuer, error)
+	UpdateStatus(*v1alpha3.ClusterIssuer) (*v1alpha3.ClusterIssuer, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.ClusterIssuer, error)
+	List(opts v1.ListOptions) (*v1alpha3.ClusterIssuerList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.ClusterIssuer, err error)
+	ClusterIssuerExpansion
+}
+
+// clusterIssuers implements ClusterIssuerInterface
+type clusterIssuers struct {
+	client rest.Interface
+}
+
+// newClusterIssuers returns a ClusterIssuers
+func newClusterIssuers(c *CertmanagerV1alpha3Client) *clusterIssuers {
+	return &clusterIssuers{
+		client: c.RESTClient(),
+	}
+}
+
+// Get takes name of the clusterIssuer, and returns the corresponding clusterIssuer object, and an error if there is any.
+func (c *clusterIssuers) Get(name string, options v1.GetOptions) (result *v1alpha3.ClusterIssuer, err error) {
+	result = &v1alpha3.ClusterIssuer{}
+	err = c.client.Get().
+		Resource("clusterissuers").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of ClusterIssuers that match those selectors.
+func (c *clusterIssuers) List(opts v1.ListOptions) (result *v1alpha3.ClusterIssuerList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha3.ClusterIssuerList{}
+	err = c.client.Get().
+		Resource("clusterissuers").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested clusterIssuers.
+func (c *clusterIssuers) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Resource("clusterissuers").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a clusterIssuer and creates it.  Returns the server's representation of the clusterIssuer, and an error, if there is any.
+func (c *clusterIssuers) Create(clusterIssuer *v1alpha3.ClusterIssuer) (result *v1alpha3.ClusterIssuer, err error) {
+	result = &v1alpha3.ClusterIssuer{}
+	err = c.client.Post().
+		Resource("clusterissuers").
+		Body(clusterIssuer).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a clusterIssuer and updates it. Returns the server's representation of the clusterIssuer, and an error, if there is any.
+func (c *clusterIssuers) Update(clusterIssuer *v1alpha3.ClusterIssuer) (result *v1alpha3.ClusterIssuer, err error) {
+	result = &v1alpha3.ClusterIssuer{}
+	err = c.client.Put().
+		Resource("clusterissuers").
+		Name(clusterIssuer.Name).
+		Body(clusterIssuer).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *clusterIssuers) UpdateStatus(clusterIssuer *v1alpha3.ClusterIssuer) (result *v1alpha3.ClusterIssuer, err error) {
+	result = &v1alpha3.ClusterIssuer{}
+	err = c.client.Put().
+		Resource("clusterissuers").
+		Name(clusterIssuer.Name).
+		SubResource("status").
+		Body(clusterIssuer).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the clusterIssuer and deletes it. Returns an error if one occurs.
+func (c *clusterIssuers) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Resource("clusterissuers").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *clusterIssuers) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Resource("clusterissuers").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched clusterIssuer.
+func (c *clusterIssuers) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.ClusterIssuer, err error) {
+	result = &v1alpha3.ClusterIssuer{}
+	err = c.client.Patch(pt).
+		Resource("clusterissuers").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha3

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/BUILD.bazel

@@ -0,0 +1,40 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "fake_certificate.go",
+        "fake_certificaterequest.go",
+        "fake_certmanager_client.go",
+        "fake_clusterissuer.go",
+        "fake_issuer.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned/typed/certmanager/v1alpha3:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/labels:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+        "@io_k8s_apimachinery//pkg/types:go_default_library",
+        "@io_k8s_apimachinery//pkg/watch:go_default_library",
+        "@io_k8s_client_go//rest:go_default_library",
+        "@io_k8s_client_go//testing:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/fake_certificate.go

@@ -0,0 +1,140 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeCertificates implements CertificateInterface
+type FakeCertificates struct {
+	Fake *FakeCertmanagerV1alpha3
+	ns   string
+}
+
+var certificatesResource = schema.GroupVersionResource{Group: "cert-manager.io", Version: "v1alpha3", Resource: "certificates"}
+
+var certificatesKind = schema.GroupVersionKind{Group: "cert-manager.io", Version: "v1alpha3", Kind: "Certificate"}
+
+// Get takes name of the certificate, and returns the corresponding certificate object, and an error if there is any.
+func (c *FakeCertificates) Get(name string, options v1.GetOptions) (result *v1alpha3.Certificate, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(certificatesResource, c.ns, name), &v1alpha3.Certificate{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Certificate), err
+}
+
+// List takes label and field selectors, and returns the list of Certificates that match those selectors.
+func (c *FakeCertificates) List(opts v1.ListOptions) (result *v1alpha3.CertificateList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(certificatesResource, certificatesKind, c.ns, opts), &v1alpha3.CertificateList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha3.CertificateList{ListMeta: obj.(*v1alpha3.CertificateList).ListMeta}
+	for _, item := range obj.(*v1alpha3.CertificateList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested certificates.
+func (c *FakeCertificates) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(certificatesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a certificate and creates it.  Returns the server's representation of the certificate, and an error, if there is any.
+func (c *FakeCertificates) Create(certificate *v1alpha3.Certificate) (result *v1alpha3.Certificate, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(certificatesResource, c.ns, certificate), &v1alpha3.Certificate{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Certificate), err
+}
+
+// Update takes the representation of a certificate and updates it. Returns the server's representation of the certificate, and an error, if there is any.
+func (c *FakeCertificates) Update(certificate *v1alpha3.Certificate) (result *v1alpha3.Certificate, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(certificatesResource, c.ns, certificate), &v1alpha3.Certificate{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Certificate), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeCertificates) UpdateStatus(certificate *v1alpha3.Certificate) (*v1alpha3.Certificate, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(certificatesResource, "status", c.ns, certificate), &v1alpha3.Certificate{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Certificate), err
+}
+
+// Delete takes name of the certificate and deletes it. Returns an error if one occurs.
+func (c *FakeCertificates) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(certificatesResource, c.ns, name), &v1alpha3.Certificate{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeCertificates) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(certificatesResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha3.CertificateList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched certificate.
+func (c *FakeCertificates) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Certificate, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(certificatesResource, c.ns, name, pt, data, subresources...), &v1alpha3.Certificate{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Certificate), err
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/fake_certificaterequest.go

@@ -0,0 +1,140 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeCertificateRequests implements CertificateRequestInterface
+type FakeCertificateRequests struct {
+	Fake *FakeCertmanagerV1alpha3
+	ns   string
+}
+
+var certificaterequestsResource = schema.GroupVersionResource{Group: "cert-manager.io", Version: "v1alpha3", Resource: "certificaterequests"}
+
+var certificaterequestsKind = schema.GroupVersionKind{Group: "cert-manager.io", Version: "v1alpha3", Kind: "CertificateRequest"}
+
+// Get takes name of the certificateRequest, and returns the corresponding certificateRequest object, and an error if there is any.
+func (c *FakeCertificateRequests) Get(name string, options v1.GetOptions) (result *v1alpha3.CertificateRequest, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(certificaterequestsResource, c.ns, name), &v1alpha3.CertificateRequest{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.CertificateRequest), err
+}
+
+// List takes label and field selectors, and returns the list of CertificateRequests that match those selectors.
+func (c *FakeCertificateRequests) List(opts v1.ListOptions) (result *v1alpha3.CertificateRequestList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(certificaterequestsResource, certificaterequestsKind, c.ns, opts), &v1alpha3.CertificateRequestList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha3.CertificateRequestList{ListMeta: obj.(*v1alpha3.CertificateRequestList).ListMeta}
+	for _, item := range obj.(*v1alpha3.CertificateRequestList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested certificateRequests.
+func (c *FakeCertificateRequests) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(certificaterequestsResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a certificateRequest and creates it.  Returns the server's representation of the certificateRequest, and an error, if there is any.
+func (c *FakeCertificateRequests) Create(certificateRequest *v1alpha3.CertificateRequest) (result *v1alpha3.CertificateRequest, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(certificaterequestsResource, c.ns, certificateRequest), &v1alpha3.CertificateRequest{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.CertificateRequest), err
+}
+
+// Update takes the representation of a certificateRequest and updates it. Returns the server's representation of the certificateRequest, and an error, if there is any.
+func (c *FakeCertificateRequests) Update(certificateRequest *v1alpha3.CertificateRequest) (result *v1alpha3.CertificateRequest, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(certificaterequestsResource, c.ns, certificateRequest), &v1alpha3.CertificateRequest{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.CertificateRequest), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeCertificateRequests) UpdateStatus(certificateRequest *v1alpha3.CertificateRequest) (*v1alpha3.CertificateRequest, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(certificaterequestsResource, "status", c.ns, certificateRequest), &v1alpha3.CertificateRequest{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.CertificateRequest), err
+}
+
+// Delete takes name of the certificateRequest and deletes it. Returns an error if one occurs.
+func (c *FakeCertificateRequests) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(certificaterequestsResource, c.ns, name), &v1alpha3.CertificateRequest{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeCertificateRequests) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(certificaterequestsResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha3.CertificateRequestList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched certificateRequest.
+func (c *FakeCertificateRequests) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.CertificateRequest, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(certificaterequestsResource, c.ns, name, pt, data, subresources...), &v1alpha3.CertificateRequest{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.CertificateRequest), err
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/fake_certmanager_client.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1alpha3"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeCertmanagerV1alpha3 struct {
+	*testing.Fake
+}
+
+func (c *FakeCertmanagerV1alpha3) Certificates(namespace string) v1alpha3.CertificateInterface {
+	return &FakeCertificates{c, namespace}
+}
+
+func (c *FakeCertmanagerV1alpha3) CertificateRequests(namespace string) v1alpha3.CertificateRequestInterface {
+	return &FakeCertificateRequests{c, namespace}
+}
+
+func (c *FakeCertmanagerV1alpha3) ClusterIssuers() v1alpha3.ClusterIssuerInterface {
+	return &FakeClusterIssuers{c}
+}
+
+func (c *FakeCertmanagerV1alpha3) Issuers(namespace string) v1alpha3.IssuerInterface {
+	return &FakeIssuers{c, namespace}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeCertmanagerV1alpha3) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/fake_clusterissuer.go

@@ -0,0 +1,131 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeClusterIssuers implements ClusterIssuerInterface
+type FakeClusterIssuers struct {
+	Fake *FakeCertmanagerV1alpha3
+}
+
+var clusterissuersResource = schema.GroupVersionResource{Group: "cert-manager.io", Version: "v1alpha3", Resource: "clusterissuers"}
+
+var clusterissuersKind = schema.GroupVersionKind{Group: "cert-manager.io", Version: "v1alpha3", Kind: "ClusterIssuer"}
+
+// Get takes name of the clusterIssuer, and returns the corresponding clusterIssuer object, and an error if there is any.
+func (c *FakeClusterIssuers) Get(name string, options v1.GetOptions) (result *v1alpha3.ClusterIssuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetAction(clusterissuersResource, name), &v1alpha3.ClusterIssuer{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.ClusterIssuer), err
+}
+
+// List takes label and field selectors, and returns the list of ClusterIssuers that match those selectors.
+func (c *FakeClusterIssuers) List(opts v1.ListOptions) (result *v1alpha3.ClusterIssuerList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootListAction(clusterissuersResource, clusterissuersKind, opts), &v1alpha3.ClusterIssuerList{})
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha3.ClusterIssuerList{ListMeta: obj.(*v1alpha3.ClusterIssuerList).ListMeta}
+	for _, item := range obj.(*v1alpha3.ClusterIssuerList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested clusterIssuers.
+func (c *FakeClusterIssuers) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewRootWatchAction(clusterissuersResource, opts))
+}
+
+// Create takes the representation of a clusterIssuer and creates it.  Returns the server's representation of the clusterIssuer, and an error, if there is any.
+func (c *FakeClusterIssuers) Create(clusterIssuer *v1alpha3.ClusterIssuer) (result *v1alpha3.ClusterIssuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootCreateAction(clusterissuersResource, clusterIssuer), &v1alpha3.ClusterIssuer{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.ClusterIssuer), err
+}
+
+// Update takes the representation of a clusterIssuer and updates it. Returns the server's representation of the clusterIssuer, and an error, if there is any.
+func (c *FakeClusterIssuers) Update(clusterIssuer *v1alpha3.ClusterIssuer) (result *v1alpha3.ClusterIssuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateAction(clusterissuersResource, clusterIssuer), &v1alpha3.ClusterIssuer{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.ClusterIssuer), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeClusterIssuers) UpdateStatus(clusterIssuer *v1alpha3.ClusterIssuer) (*v1alpha3.ClusterIssuer, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceAction(clusterissuersResource, "status", clusterIssuer), &v1alpha3.ClusterIssuer{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.ClusterIssuer), err
+}
+
+// Delete takes name of the clusterIssuer and deletes it. Returns an error if one occurs.
+func (c *FakeClusterIssuers) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewRootDeleteAction(clusterissuersResource, name), &v1alpha3.ClusterIssuer{})
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeClusterIssuers) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewRootDeleteCollectionAction(clusterissuersResource, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha3.ClusterIssuerList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched clusterIssuer.
+func (c *FakeClusterIssuers) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.ClusterIssuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootPatchSubresourceAction(clusterissuersResource, name, pt, data, subresources...), &v1alpha3.ClusterIssuer{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.ClusterIssuer), err
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/fake/fake_issuer.go

@@ -0,0 +1,140 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeIssuers implements IssuerInterface
+type FakeIssuers struct {
+	Fake *FakeCertmanagerV1alpha3
+	ns   string
+}
+
+var issuersResource = schema.GroupVersionResource{Group: "cert-manager.io", Version: "v1alpha3", Resource: "issuers"}
+
+var issuersKind = schema.GroupVersionKind{Group: "cert-manager.io", Version: "v1alpha3", Kind: "Issuer"}
+
+// Get takes name of the issuer, and returns the corresponding issuer object, and an error if there is any.
+func (c *FakeIssuers) Get(name string, options v1.GetOptions) (result *v1alpha3.Issuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(issuersResource, c.ns, name), &v1alpha3.Issuer{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Issuer), err
+}
+
+// List takes label and field selectors, and returns the list of Issuers that match those selectors.
+func (c *FakeIssuers) List(opts v1.ListOptions) (result *v1alpha3.IssuerList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(issuersResource, issuersKind, c.ns, opts), &v1alpha3.IssuerList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha3.IssuerList{ListMeta: obj.(*v1alpha3.IssuerList).ListMeta}
+	for _, item := range obj.(*v1alpha3.IssuerList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested issuers.
+func (c *FakeIssuers) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(issuersResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a issuer and creates it.  Returns the server's representation of the issuer, and an error, if there is any.
+func (c *FakeIssuers) Create(issuer *v1alpha3.Issuer) (result *v1alpha3.Issuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(issuersResource, c.ns, issuer), &v1alpha3.Issuer{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Issuer), err
+}
+
+// Update takes the representation of a issuer and updates it. Returns the server's representation of the issuer, and an error, if there is any.
+func (c *FakeIssuers) Update(issuer *v1alpha3.Issuer) (result *v1alpha3.Issuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(issuersResource, c.ns, issuer), &v1alpha3.Issuer{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Issuer), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeIssuers) UpdateStatus(issuer *v1alpha3.Issuer) (*v1alpha3.Issuer, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(issuersResource, "status", c.ns, issuer), &v1alpha3.Issuer{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Issuer), err
+}
+
+// Delete takes name of the issuer and deletes it. Returns an error if one occurs.
+func (c *FakeIssuers) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(issuersResource, c.ns, name), &v1alpha3.Issuer{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeIssuers) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(issuersResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha3.IssuerList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched issuer.
+func (c *FakeIssuers) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Issuer, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(issuersResource, c.ns, name, pt, data, subresources...), &v1alpha3.Issuer{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha3.Issuer), err
+}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/generated_expansion.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+type CertificateExpansion interface{}
+
+type CertificateRequestExpansion interface{}
+
+type ClusterIssuerExpansion interface{}
+
+type IssuerExpansion interface{}

pkg/client/clientset/versioned/typed/certmanager/v1alpha3/issuer.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	"time"
+
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	scheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// IssuersGetter has a method to return a IssuerInterface.
+// A group's client should implement this interface.
+type IssuersGetter interface {
+	Issuers(namespace string) IssuerInterface
+}
+
+// IssuerInterface has methods to work with Issuer resources.
+type IssuerInterface interface {
+	Create(*v1alpha3.Issuer) (*v1alpha3.Issuer, error)
+	Update(*v1alpha3.Issuer) (*v1alpha3.Issuer, error)
+	UpdateStatus(*v1alpha3.Issuer) (*v1alpha3.Issuer, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.Issuer, error)
+	List(opts v1.ListOptions) (*v1alpha3.IssuerList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Issuer, err error)
+	IssuerExpansion
+}
+
+// issuers implements IssuerInterface
+type issuers struct {
+	client rest.Interface
+	ns     string
+}
+
+// newIssuers returns a Issuers
+func newIssuers(c *CertmanagerV1alpha3Client, namespace string) *issuers {
+	return &issuers{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the issuer, and returns the corresponding issuer object, and an error if there is any.
+func (c *issuers) Get(name string, options v1.GetOptions) (result *v1alpha3.Issuer, err error) {
+	result = &v1alpha3.Issuer{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("issuers").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Issuers that match those selectors.
+func (c *issuers) List(opts v1.ListOptions) (result *v1alpha3.IssuerList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha3.IssuerList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("issuers").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested issuers.
+func (c *issuers) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("issuers").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a issuer and creates it.  Returns the server's representation of the issuer, and an error, if there is any.
+func (c *issuers) Create(issuer *v1alpha3.Issuer) (result *v1alpha3.Issuer, err error) {
+	result = &v1alpha3.Issuer{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("issuers").
+		Body(issuer).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a issuer and updates it. Returns the server's representation of the issuer, and an error, if there is any.
+func (c *issuers) Update(issuer *v1alpha3.Issuer) (result *v1alpha3.Issuer, err error) {
+	result = &v1alpha3.Issuer{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("issuers").
+		Name(issuer.Name).
+		Body(issuer).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *issuers) UpdateStatus(issuer *v1alpha3.Issuer) (result *v1alpha3.Issuer, err error) {
+	result = &v1alpha3.Issuer{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("issuers").
+		Name(issuer.Name).
+		SubResource("status").
+		Body(issuer).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the issuer and deletes it. Returns an error if one occurs.
+func (c *issuers) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("issuers").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *issuers) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("issuers").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched issuer.
+func (c *issuers) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Issuer, err error) {
+	result = &v1alpha3.Issuer{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("issuers").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/informers/externalversions/BUILD.bazel

@@ -10,7 +10,9 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/apis/acme/v1alpha2:go_default_library",
+        "//pkg/apis/acme/v1alpha3:go_default_library",
         "//pkg/apis/certmanager/v1alpha2:go_default_library",
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
         "//pkg/client/clientset/versioned:go_default_library",
         "//pkg/client/informers/externalversions/acme:go_default_library",
         "//pkg/client/informers/externalversions/certmanager:go_default_library",

pkg/client/informers/externalversions/acme/BUILD.bazel

@@ -7,6 +7,7 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/client/informers/externalversions/acme/v1alpha2:go_default_library",
+        "//pkg/client/informers/externalversions/acme/v1alpha3:go_default_library",
         "//pkg/client/informers/externalversions/internalinterfaces:go_default_library",
     ],
 )
@@ -23,6 +24,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//pkg/client/informers/externalversions/acme/v1alpha2:all-srcs",
+        "//pkg/client/informers/externalversions/acme/v1alpha3:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],

pkg/client/informers/externalversions/acme/interface.go

@@ -20,6 +20,7 @@ package acme
 
 import (
 	v1alpha2 "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/acme/v1alpha2"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/acme/v1alpha3"
 	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
 )
 
@@ -27,6 +28,8 @@ import (
 type Interface interface {
 	// V1alpha2 provides access to shared informers for resources in V1alpha2.
 	V1alpha2() v1alpha2.Interface
+	// V1alpha3 provides access to shared informers for resources in V1alpha3.
+	V1alpha3() v1alpha3.Interface
 }
 
 type group struct {
@@ -44,3 +47,8 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 func (g *group) V1alpha2() v1alpha2.Interface {
 	return v1alpha2.New(g.factory, g.namespace, g.tweakListOptions)
 }
+
+// V1alpha3 returns a new v1alpha3.Interface.
+func (g *group) V1alpha3() v1alpha3.Interface {
+	return v1alpha3.New(g.factory, g.namespace, g.tweakListOptions)
+}

pkg/client/informers/externalversions/acme/v1alpha3/BUILD.bazel

@@ -0,0 +1,36 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "challenge.go",
+        "interface.go",
+        "order.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/acme/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/acme/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned:go_default_library",
+        "//pkg/client/informers/externalversions/internalinterfaces:go_default_library",
+        "//pkg/client/listers/acme/v1alpha3:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/watch:go_default_library",
+        "@io_k8s_client_go//tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/informers/externalversions/acme/v1alpha3/challenge.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	versioned "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/listers/acme/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// ChallengeInformer provides access to a shared informer and lister for
+// Challenges.
+type ChallengeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.ChallengeLister
+}
+
+type challengeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewChallengeInformer constructs a new informer for Challenge type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewChallengeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredChallengeInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredChallengeInformer constructs a new informer for Challenge type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredChallengeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AcmeV1alpha3().Challenges(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AcmeV1alpha3().Challenges(namespace).Watch(options)
+			},
+		},
+		&acmev1alpha3.Challenge{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *challengeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredChallengeInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *challengeInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&acmev1alpha3.Challenge{}, f.defaultInformer)
+}
+
+func (f *challengeInformer) Lister() v1alpha3.ChallengeLister {
+	return v1alpha3.NewChallengeLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/acme/v1alpha3/interface.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// Challenges returns a ChallengeInformer.
+	Challenges() ChallengeInformer
+	// Orders returns a OrderInformer.
+	Orders() OrderInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// Challenges returns a ChallengeInformer.
+func (v *version) Challenges() ChallengeInformer {
+	return &challengeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// Orders returns a OrderInformer.
+func (v *version) Orders() OrderInformer {
+	return &orderInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}

pkg/client/informers/externalversions/acme/v1alpha3/order.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	acmev1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	versioned "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/listers/acme/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// OrderInformer provides access to a shared informer and lister for
+// Orders.
+type OrderInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.OrderLister
+}
+
+type orderInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewOrderInformer constructs a new informer for Order type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewOrderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredOrderInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredOrderInformer constructs a new informer for Order type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredOrderInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AcmeV1alpha3().Orders(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AcmeV1alpha3().Orders(namespace).Watch(options)
+			},
+		},
+		&acmev1alpha3.Order{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *orderInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredOrderInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *orderInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&acmev1alpha3.Order{}, f.defaultInformer)
+}
+
+func (f *orderInformer) Lister() v1alpha3.OrderLister {
+	return v1alpha3.NewOrderLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/certmanager/BUILD.bazel

@@ -7,6 +7,7 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/client/informers/externalversions/certmanager/v1alpha2:go_default_library",
+        "//pkg/client/informers/externalversions/certmanager/v1alpha3:go_default_library",
         "//pkg/client/informers/externalversions/internalinterfaces:go_default_library",
     ],
 )
@@ -23,6 +24,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//pkg/client/informers/externalversions/certmanager/v1alpha2:all-srcs",
+        "//pkg/client/informers/externalversions/certmanager/v1alpha3:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],

pkg/client/informers/externalversions/certmanager/interface.go

@@ -20,6 +20,7 @@ package certmanager
 
 import (
 	v1alpha2 "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/certmanager/v1alpha2"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/certmanager/v1alpha3"
 	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
 )
 
@@ -27,6 +28,8 @@ import (
 type Interface interface {
 	// V1alpha2 provides access to shared informers for resources in V1alpha2.
 	V1alpha2() v1alpha2.Interface
+	// V1alpha3 provides access to shared informers for resources in V1alpha3.
+	V1alpha3() v1alpha3.Interface
 }
 
 type group struct {
@@ -44,3 +47,8 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 func (g *group) V1alpha2() v1alpha2.Interface {
 	return v1alpha2.New(g.factory, g.namespace, g.tweakListOptions)
 }
+
+// V1alpha3 returns a new v1alpha3.Interface.
+func (g *group) V1alpha3() v1alpha3.Interface {
+	return v1alpha3.New(g.factory, g.namespace, g.tweakListOptions)
+}

pkg/client/informers/externalversions/certmanager/v1alpha3/BUILD.bazel

@@ -0,0 +1,38 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "certificate.go",
+        "certificaterequest.go",
+        "clusterissuer.go",
+        "interface.go",
+        "issuer.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/certmanager/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
+        "//pkg/client/clientset/versioned:go_default_library",
+        "//pkg/client/informers/externalversions/internalinterfaces:go_default_library",
+        "//pkg/client/listers/certmanager/v1alpha3:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/watch:go_default_library",
+        "@io_k8s_client_go//tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/informers/externalversions/certmanager/v1alpha3/certificate.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	versioned "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/listers/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// CertificateInformer provides access to a shared informer and lister for
+// Certificates.
+type CertificateInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.CertificateLister
+}
+
+type certificateInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewCertificateInformer constructs a new informer for Certificate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewCertificateInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredCertificateInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredCertificateInformer constructs a new informer for Certificate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredCertificateInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().Certificates(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().Certificates(namespace).Watch(options)
+			},
+		},
+		&certmanagerv1alpha3.Certificate{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *certificateInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredCertificateInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *certificateInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&certmanagerv1alpha3.Certificate{}, f.defaultInformer)
+}
+
+func (f *certificateInformer) Lister() v1alpha3.CertificateLister {
+	return v1alpha3.NewCertificateLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/certmanager/v1alpha3/certificaterequest.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	versioned "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/listers/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// CertificateRequestInformer provides access to a shared informer and lister for
+// CertificateRequests.
+type CertificateRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.CertificateRequestLister
+}
+
+type certificateRequestInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewCertificateRequestInformer constructs a new informer for CertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewCertificateRequestInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredCertificateRequestInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredCertificateRequestInformer constructs a new informer for CertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredCertificateRequestInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().CertificateRequests(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().CertificateRequests(namespace).Watch(options)
+			},
+		},
+		&certmanagerv1alpha3.CertificateRequest{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *certificateRequestInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredCertificateRequestInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *certificateRequestInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&certmanagerv1alpha3.CertificateRequest{}, f.defaultInformer)
+}
+
+func (f *certificateRequestInformer) Lister() v1alpha3.CertificateRequestLister {
+	return v1alpha3.NewCertificateRequestLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/certmanager/v1alpha3/clusterissuer.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	versioned "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/listers/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// ClusterIssuerInformer provides access to a shared informer and lister for
+// ClusterIssuers.
+type ClusterIssuerInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.ClusterIssuerLister
+}
+
+type clusterIssuerInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterIssuerInformer constructs a new informer for ClusterIssuer type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewClusterIssuerInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredClusterIssuerInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredClusterIssuerInformer constructs a new informer for ClusterIssuer type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredClusterIssuerInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().ClusterIssuers().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().ClusterIssuers().Watch(options)
+			},
+		},
+		&certmanagerv1alpha3.ClusterIssuer{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *clusterIssuerInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredClusterIssuerInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *clusterIssuerInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&certmanagerv1alpha3.ClusterIssuer{}, f.defaultInformer)
+}
+
+func (f *clusterIssuerInformer) Lister() v1alpha3.ClusterIssuerLister {
+	return v1alpha3.NewClusterIssuerLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/certmanager/v1alpha3/interface.go

@@ -0,0 +1,66 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// Certificates returns a CertificateInformer.
+	Certificates() CertificateInformer
+	// CertificateRequests returns a CertificateRequestInformer.
+	CertificateRequests() CertificateRequestInformer
+	// ClusterIssuers returns a ClusterIssuerInformer.
+	ClusterIssuers() ClusterIssuerInformer
+	// Issuers returns a IssuerInformer.
+	Issuers() IssuerInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// Certificates returns a CertificateInformer.
+func (v *version) Certificates() CertificateInformer {
+	return &certificateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// CertificateRequests returns a CertificateRequestInformer.
+func (v *version) CertificateRequests() CertificateRequestInformer {
+	return &certificateRequestInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// ClusterIssuers returns a ClusterIssuerInformer.
+func (v *version) ClusterIssuers() ClusterIssuerInformer {
+	return &clusterIssuerInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// Issuers returns a IssuerInformer.
+func (v *version) Issuers() IssuerInformer {
+	return &issuerInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}

pkg/client/informers/externalversions/certmanager/v1alpha3/issuer.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	versioned "github.com/jetstack/cert-manager/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/jetstack/cert-manager/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/client/listers/certmanager/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// IssuerInformer provides access to a shared informer and lister for
+// Issuers.
+type IssuerInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.IssuerLister
+}
+
+type issuerInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewIssuerInformer constructs a new informer for Issuer type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewIssuerInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredIssuerInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredIssuerInformer constructs a new informer for Issuer type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredIssuerInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().Issuers(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertmanagerV1alpha3().Issuers(namespace).Watch(options)
+			},
+		},
+		&certmanagerv1alpha3.Issuer{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *issuerInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredIssuerInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *issuerInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&certmanagerv1alpha3.Issuer{}, f.defaultInformer)
+}
+
+func (f *issuerInformer) Lister() v1alpha3.IssuerLister {
+	return v1alpha3.NewIssuerLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/generic.go

@@ -22,7 +22,9 @@ import (
 	"fmt"
 
 	v1alpha2 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha2"
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
 	certmanagerv1alpha2 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
+	certmanagerv1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	cache "k8s.io/client-go/tools/cache"
 )
@@ -59,6 +61,12 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case v1alpha2.SchemeGroupVersion.WithResource("orders"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Acme().V1alpha2().Orders().Informer()}, nil
 
+		// Group=acme.cert-manager.io, Version=v1alpha3
+	case v1alpha3.SchemeGroupVersion.WithResource("challenges"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Acme().V1alpha3().Challenges().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("orders"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Acme().V1alpha3().Orders().Informer()}, nil
+
 		// Group=cert-manager.io, Version=v1alpha2
 	case certmanagerv1alpha2.SchemeGroupVersion.WithResource("certificates"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Certmanager().V1alpha2().Certificates().Informer()}, nil
@@ -69,6 +77,16 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case certmanagerv1alpha2.SchemeGroupVersion.WithResource("issuers"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Certmanager().V1alpha2().Issuers().Informer()}, nil
 
+		// Group=cert-manager.io, Version=v1alpha3
+	case certmanagerv1alpha3.SchemeGroupVersion.WithResource("certificates"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Certmanager().V1alpha3().Certificates().Informer()}, nil
+	case certmanagerv1alpha3.SchemeGroupVersion.WithResource("certificaterequests"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Certmanager().V1alpha3().CertificateRequests().Informer()}, nil
+	case certmanagerv1alpha3.SchemeGroupVersion.WithResource("clusterissuers"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Certmanager().V1alpha3().ClusterIssuers().Informer()}, nil
+	case certmanagerv1alpha3.SchemeGroupVersion.WithResource("issuers"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Certmanager().V1alpha3().Issuers().Informer()}, nil
+
 	}
 
 	return nil, fmt.Errorf("no informer found for %v", resource)

pkg/client/listers/acme/v1alpha3/BUILD.bazel

@@ -0,0 +1,32 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "challenge.go",
+        "expansion_generated.go",
+        "order.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/listers/acme/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/acme/v1alpha3:go_default_library",
+        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
+        "@io_k8s_apimachinery//pkg/labels:go_default_library",
+        "@io_k8s_client_go//tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/listers/acme/v1alpha3/challenge.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// ChallengeLister helps list Challenges.
+type ChallengeLister interface {
+	// List lists all Challenges in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha3.Challenge, err error)
+	// Challenges returns an object that can list and get Challenges.
+	Challenges(namespace string) ChallengeNamespaceLister
+	ChallengeListerExpansion
+}
+
+// challengeLister implements the ChallengeLister interface.
+type challengeLister struct {
+	indexer cache.Indexer
+}
+
+// NewChallengeLister returns a new ChallengeLister.
+func NewChallengeLister(indexer cache.Indexer) ChallengeLister {
+	return &challengeLister{indexer: indexer}
+}
+
+// List lists all Challenges in the indexer.
+func (s *challengeLister) List(selector labels.Selector) (ret []*v1alpha3.Challenge, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Challenge))
+	})
+	return ret, err
+}
+
+// Challenges returns an object that can list and get Challenges.
+func (s *challengeLister) Challenges(namespace string) ChallengeNamespaceLister {
+	return challengeNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// ChallengeNamespaceLister helps list and get Challenges.
+type ChallengeNamespaceLister interface {
+	// List lists all Challenges in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha3.Challenge, err error)
+	// Get retrieves the Challenge from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha3.Challenge, error)
+	ChallengeNamespaceListerExpansion
+}
+
+// challengeNamespaceLister implements the ChallengeNamespaceLister
+// interface.
+type challengeNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Challenges in the indexer for a given namespace.
+func (s challengeNamespaceLister) List(selector labels.Selector) (ret []*v1alpha3.Challenge, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Challenge))
+	})
+	return ret, err
+}
+
+// Get retrieves the Challenge from the indexer for a given namespace and name.
+func (s challengeNamespaceLister) Get(name string) (*v1alpha3.Challenge, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha3.Resource("challenge"), name)
+	}
+	return obj.(*v1alpha3.Challenge), nil
+}

pkg/client/listers/acme/v1alpha3/expansion_generated.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// ChallengeListerExpansion allows custom methods to be added to
+// ChallengeLister.
+type ChallengeListerExpansion interface{}
+
+// ChallengeNamespaceListerExpansion allows custom methods to be added to
+// ChallengeNamespaceLister.
+type ChallengeNamespaceListerExpansion interface{}
+
+// OrderListerExpansion allows custom methods to be added to
+// OrderLister.
+type OrderListerExpansion interface{}
+
+// OrderNamespaceListerExpansion allows custom methods to be added to
+// OrderNamespaceLister.
+type OrderNamespaceListerExpansion interface{}

pkg/client/listers/acme/v1alpha3/order.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/acme/v1alpha3"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// OrderLister helps list Orders.
+type OrderLister interface {
+	// List lists all Orders in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha3.Order, err error)
+	// Orders returns an object that can list and get Orders.
+	Orders(namespace string) OrderNamespaceLister
+	OrderListerExpansion
+}
+
+// orderLister implements the OrderLister interface.
+type orderLister struct {
+	indexer cache.Indexer
+}
+
+// NewOrderLister returns a new OrderLister.
+func NewOrderLister(indexer cache.Indexer) OrderLister {
+	return &orderLister{indexer: indexer}
+}
+
+// List lists all Orders in the indexer.
+func (s *orderLister) List(selector labels.Selector) (ret []*v1alpha3.Order, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Order))
+	})
+	return ret, err
+}
+
+// Orders returns an object that can list and get Orders.
+func (s *orderLister) Orders(namespace string) OrderNamespaceLister {
+	return orderNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// OrderNamespaceLister helps list and get Orders.
+type OrderNamespaceLister interface {
+	// List lists all Orders in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha3.Order, err error)
+	// Get retrieves the Order from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha3.Order, error)
+	OrderNamespaceListerExpansion
+}
+
+// orderNamespaceLister implements the OrderNamespaceLister
+// interface.
+type orderNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Orders in the indexer for a given namespace.
+func (s orderNamespaceLister) List(selector labels.Selector) (ret []*v1alpha3.Order, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Order))
+	})
+	return ret, err
+}
+
+// Get retrieves the Order from the indexer for a given namespace and name.
+func (s orderNamespaceLister) Get(name string) (*v1alpha3.Order, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha3.Resource("order"), name)
+	}
+	return obj.(*v1alpha3.Order), nil
+}

pkg/client/listers/certmanager/v1alpha3/BUILD.bazel

@@ -0,0 +1,34 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "certificate.go",
+        "certificaterequest.go",
+        "clusterissuer.go",
+        "expansion_generated.go",
+        "issuer.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/client/listers/certmanager/v1alpha3",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/apis/certmanager/v1alpha3:go_default_library",
+        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
+        "@io_k8s_apimachinery//pkg/labels:go_default_library",
+        "@io_k8s_client_go//tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/client/listers/certmanager/v1alpha3/certificate.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// CertificateLister helps list Certificates.
+type CertificateLister interface {
+	// List lists all Certificates in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha3.Certificate, err error)
+	// Certificates returns an object that can list and get Certificates.
+	Certificates(namespace string) CertificateNamespaceLister
+	CertificateListerExpansion
+}
+
+// certificateLister implements the CertificateLister interface.
+type certificateLister struct {
+	indexer cache.Indexer
+}
+
+// NewCertificateLister returns a new CertificateLister.
+func NewCertificateLister(indexer cache.Indexer) CertificateLister {
+	return &certificateLister{indexer: indexer}
+}
+
+// List lists all Certificates in the indexer.
+func (s *certificateLister) List(selector labels.Selector) (ret []*v1alpha3.Certificate, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Certificate))
+	})
+	return ret, err
+}
+
+// Certificates returns an object that can list and get Certificates.
+func (s *certificateLister) Certificates(namespace string) CertificateNamespaceLister {
+	return certificateNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// CertificateNamespaceLister helps list and get Certificates.
+type CertificateNamespaceLister interface {
+	// List lists all Certificates in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha3.Certificate, err error)
+	// Get retrieves the Certificate from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha3.Certificate, error)
+	CertificateNamespaceListerExpansion
+}
+
+// certificateNamespaceLister implements the CertificateNamespaceLister
+// interface.
+type certificateNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Certificates in the indexer for a given namespace.
+func (s certificateNamespaceLister) List(selector labels.Selector) (ret []*v1alpha3.Certificate, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Certificate))
+	})
+	return ret, err
+}
+
+// Get retrieves the Certificate from the indexer for a given namespace and name.
+func (s certificateNamespaceLister) Get(name string) (*v1alpha3.Certificate, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha3.Resource("certificate"), name)
+	}
+	return obj.(*v1alpha3.Certificate), nil
+}

pkg/client/listers/certmanager/v1alpha3/certificaterequest.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// CertificateRequestLister helps list CertificateRequests.
+type CertificateRequestLister interface {
+	// List lists all CertificateRequests in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha3.CertificateRequest, err error)
+	// CertificateRequests returns an object that can list and get CertificateRequests.
+	CertificateRequests(namespace string) CertificateRequestNamespaceLister
+	CertificateRequestListerExpansion
+}
+
+// certificateRequestLister implements the CertificateRequestLister interface.
+type certificateRequestLister struct {
+	indexer cache.Indexer
+}
+
+// NewCertificateRequestLister returns a new CertificateRequestLister.
+func NewCertificateRequestLister(indexer cache.Indexer) CertificateRequestLister {
+	return &certificateRequestLister{indexer: indexer}
+}
+
+// List lists all CertificateRequests in the indexer.
+func (s *certificateRequestLister) List(selector labels.Selector) (ret []*v1alpha3.CertificateRequest, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.CertificateRequest))
+	})
+	return ret, err
+}
+
+// CertificateRequests returns an object that can list and get CertificateRequests.
+func (s *certificateRequestLister) CertificateRequests(namespace string) CertificateRequestNamespaceLister {
+	return certificateRequestNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// CertificateRequestNamespaceLister helps list and get CertificateRequests.
+type CertificateRequestNamespaceLister interface {
+	// List lists all CertificateRequests in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha3.CertificateRequest, err error)
+	// Get retrieves the CertificateRequest from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha3.CertificateRequest, error)
+	CertificateRequestNamespaceListerExpansion
+}
+
+// certificateRequestNamespaceLister implements the CertificateRequestNamespaceLister
+// interface.
+type certificateRequestNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all CertificateRequests in the indexer for a given namespace.
+func (s certificateRequestNamespaceLister) List(selector labels.Selector) (ret []*v1alpha3.CertificateRequest, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.CertificateRequest))
+	})
+	return ret, err
+}
+
+// Get retrieves the CertificateRequest from the indexer for a given namespace and name.
+func (s certificateRequestNamespaceLister) Get(name string) (*v1alpha3.CertificateRequest, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha3.Resource("certificaterequest"), name)
+	}
+	return obj.(*v1alpha3.CertificateRequest), nil
+}

pkg/client/listers/certmanager/v1alpha3/clusterissuer.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// ClusterIssuerLister helps list ClusterIssuers.
+type ClusterIssuerLister interface {
+	// List lists all ClusterIssuers in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha3.ClusterIssuer, err error)
+	// Get retrieves the ClusterIssuer from the index for a given name.
+	Get(name string) (*v1alpha3.ClusterIssuer, error)
+	ClusterIssuerListerExpansion
+}
+
+// clusterIssuerLister implements the ClusterIssuerLister interface.
+type clusterIssuerLister struct {
+	indexer cache.Indexer
+}
+
+// NewClusterIssuerLister returns a new ClusterIssuerLister.
+func NewClusterIssuerLister(indexer cache.Indexer) ClusterIssuerLister {
+	return &clusterIssuerLister{indexer: indexer}
+}
+
+// List lists all ClusterIssuers in the indexer.
+func (s *clusterIssuerLister) List(selector labels.Selector) (ret []*v1alpha3.ClusterIssuer, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.ClusterIssuer))
+	})
+	return ret, err
+}
+
+// Get retrieves the ClusterIssuer from the index for a given name.
+func (s *clusterIssuerLister) Get(name string) (*v1alpha3.ClusterIssuer, error) {
+	obj, exists, err := s.indexer.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha3.Resource("clusterissuer"), name)
+	}
+	return obj.(*v1alpha3.ClusterIssuer), nil
+}

pkg/client/listers/certmanager/v1alpha3/expansion_generated.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// CertificateListerExpansion allows custom methods to be added to
+// CertificateLister.
+type CertificateListerExpansion interface{}
+
+// CertificateNamespaceListerExpansion allows custom methods to be added to
+// CertificateNamespaceLister.
+type CertificateNamespaceListerExpansion interface{}
+
+// CertificateRequestListerExpansion allows custom methods to be added to
+// CertificateRequestLister.
+type CertificateRequestListerExpansion interface{}
+
+// CertificateRequestNamespaceListerExpansion allows custom methods to be added to
+// CertificateRequestNamespaceLister.
+type CertificateRequestNamespaceListerExpansion interface{}
+
+// ClusterIssuerListerExpansion allows custom methods to be added to
+// ClusterIssuerLister.
+type ClusterIssuerListerExpansion interface{}
+
+// IssuerListerExpansion allows custom methods to be added to
+// IssuerLister.
+type IssuerListerExpansion interface{}
+
+// IssuerNamespaceListerExpansion allows custom methods to be added to
+// IssuerNamespaceLister.
+type IssuerNamespaceListerExpansion interface{}

pkg/client/listers/certmanager/v1alpha3/issuer.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha3"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// IssuerLister helps list Issuers.
+type IssuerLister interface {
+	// List lists all Issuers in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha3.Issuer, err error)
+	// Issuers returns an object that can list and get Issuers.
+	Issuers(namespace string) IssuerNamespaceLister
+	IssuerListerExpansion
+}
+
+// issuerLister implements the IssuerLister interface.
+type issuerLister struct {
+	indexer cache.Indexer
+}
+
+// NewIssuerLister returns a new IssuerLister.
+func NewIssuerLister(indexer cache.Indexer) IssuerLister {
+	return &issuerLister{indexer: indexer}
+}
+
+// List lists all Issuers in the indexer.
+func (s *issuerLister) List(selector labels.Selector) (ret []*v1alpha3.Issuer, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Issuer))
+	})
+	return ret, err
+}
+
+// Issuers returns an object that can list and get Issuers.
+func (s *issuerLister) Issuers(namespace string) IssuerNamespaceLister {
+	return issuerNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// IssuerNamespaceLister helps list and get Issuers.
+type IssuerNamespaceLister interface {
+	// List lists all Issuers in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha3.Issuer, err error)
+	// Get retrieves the Issuer from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha3.Issuer, error)
+	IssuerNamespaceListerExpansion
+}
+
+// issuerNamespaceLister implements the IssuerNamespaceLister
+// interface.
+type issuerNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Issuers in the indexer for a given namespace.
+func (s issuerNamespaceLister) List(selector labels.Selector) (ret []*v1alpha3.Issuer, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha3.Issuer))
+	})
+	return ret, err
+}
+
+// Get retrieves the Issuer from the indexer for a given namespace and name.
+func (s issuerNamespaceLister) Get(name string) (*v1alpha3.Issuer, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha3.Resource("issuer"), name)
+	}
+	return obj.(*v1alpha3.Issuer), nil
+}

pkg/controller/certificaterequests/BUILD.bazel

@@ -18,11 +18,12 @@ go_library(
         "//pkg/client/listers/certmanager/v1alpha2:go_default_library",
         "//pkg/controller:go_default_library",
         "//pkg/controller/certificaterequests/util:go_default_library",
-        "//pkg/internal/apis/certmanager/validation:go_default_library",
+        "//pkg/internal/apis/certmanager:go_default_library",
         "//pkg/issuer:go_default_library",
         "//pkg/logs:go_default_library",
         "//pkg/metrics:go_default_library",
         "//pkg/util/pki:go_default_library",
+        "//pkg/webhook:go_default_library",
         "@com_github_go_logr_logr//:go_default_library",
         "@com_github_kr_pretty//:go_default_library",
         "@io_k8s_apimachinery//pkg/api/errors:go_default_library",

pkg/controller/certificaterequests/sync.go

@@ -30,9 +30,10 @@ import (
 	"github.com/jetstack/cert-manager/pkg/apis/certmanager"
 	"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
 	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
-	"github.com/jetstack/cert-manager/pkg/internal/apis/certmanager/validation"
+	internalapi "github.com/jetstack/cert-manager/pkg/internal/apis/certmanager"
 	logf "github.com/jetstack/cert-manager/pkg/logs"
 	"github.com/jetstack/cert-manager/pkg/util/pki"
+	"github.com/jetstack/cert-manager/pkg/webhook"
 )
 
 var (
@@ -112,7 +113,7 @@ func (c *Controller) Sync(ctx context.Context, cr *v1alpha2.CertificateRequest)
 
 	dbg.Info("validating CertificateRequest resource object")
 
-	el := validation.ValidateCertificateRequest(crCopy)
+	el := webhook.ValidationRegistry.Validate(crCopy, internalapi.SchemeGroupVersion.WithKind("CertificateRequest"))
 	if len(el) > 0 {
 		c.reporter.Failed(crCopy, el.ToAggregate(), "BadConfig",
 			"Resource validation failed")

pkg/controller/clusterissuers/BUILD.bazel

@@ -16,10 +16,11 @@ go_library(
         "//pkg/client/clientset/versioned:go_default_library",
         "//pkg/client/listers/certmanager/v1alpha2:go_default_library",
         "//pkg/controller:go_default_library",
-        "//pkg/internal/apis/certmanager/validation:go_default_library",
+        "//pkg/internal/apis/certmanager:go_default_library",
         "//pkg/issuer:go_default_library",
         "//pkg/logs:go_default_library",
         "//pkg/metrics:go_default_library",
+        "//pkg/webhook:go_default_library",
         "@com_github_go_logr_logr//:go_default_library",
         "@io_k8s_api//core/v1:go_default_library",
         "@io_k8s_apimachinery//pkg/api/errors:go_default_library",

pkg/controller/clusterissuers/sync.go

@@ -27,9 +27,10 @@ import (
 	apiutil "github.com/jetstack/cert-manager/pkg/api/util"
 	"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
 	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
-	"github.com/jetstack/cert-manager/pkg/internal/apis/certmanager/validation"
+	internalapi "github.com/jetstack/cert-manager/pkg/internal/apis/certmanager"
 	logf "github.com/jetstack/cert-manager/pkg/logs"
 	"github.com/jetstack/cert-manager/pkg/metrics"
+	"github.com/jetstack/cert-manager/pkg/webhook"
 )
 
 const (
@@ -51,7 +52,7 @@ func (c *controller) Sync(ctx context.Context, iss *v1alpha2.ClusterIssuer) (err
 		}
 	}()
 
-	el := validation.ValidateClusterIssuer(issuerCopy)
+	el := webhook.ValidationRegistry.Validate(issuerCopy, internalapi.SchemeGroupVersion.WithKind("ClusterIssuer"))
 	if len(el) > 0 {
 		msg := fmt.Sprintf("Resource validation failed: %v", el.ToAggregate())
 		apiutil.SetIssuerCondition(issuerCopy, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorConfig, msg)

pkg/controller/issuers/BUILD.bazel

@@ -16,10 +16,11 @@ go_library(
         "//pkg/client/clientset/versioned:go_default_library",
         "//pkg/client/listers/certmanager/v1alpha2:go_default_library",
         "//pkg/controller:go_default_library",
-        "//pkg/internal/apis/certmanager/validation:go_default_library",
+        "//pkg/internal/apis/certmanager:go_default_library",
         "//pkg/issuer:go_default_library",
         "//pkg/logs:go_default_library",
         "//pkg/metrics:go_default_library",
+        "//pkg/webhook:go_default_library",
         "@com_github_go_logr_logr//:go_default_library",
         "@io_k8s_api//core/v1:go_default_library",
         "@io_k8s_apimachinery//pkg/api/errors:go_default_library",

pkg/controller/issuers/sync.go

@@ -27,9 +27,10 @@ import (
 	apiutil "github.com/jetstack/cert-manager/pkg/api/util"
 	"github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
 	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
-	"github.com/jetstack/cert-manager/pkg/internal/apis/certmanager/validation"
+	internalapi "github.com/jetstack/cert-manager/pkg/internal/apis/certmanager"
 	logf "github.com/jetstack/cert-manager/pkg/logs"
 	"github.com/jetstack/cert-manager/pkg/metrics"
+	"github.com/jetstack/cert-manager/pkg/webhook"
 )
 
 const (
@@ -51,7 +52,7 @@ func (c *controller) Sync(ctx context.Context, iss *v1alpha2.Issuer) (err error)
 		}
 	}()
 
-	el := validation.ValidateIssuer(issuerCopy)
+	el := webhook.ValidationRegistry.Validate(issuerCopy, internalapi.SchemeGroupVersion.WithKind("Issuer"))
 	if len(el) > 0 {
 		msg := fmt.Sprintf("Resource validation failed: %v", el.ToAggregate())
 		apiutil.SetIssuerCondition(issuerCopy, v1alpha2.IssuerConditionReady, cmmeta.ConditionFalse, errorConfig, msg)

pkg/internal/BUILD.bazel

@@ -9,6 +9,7 @@ filegroup(
     name = "all-srcs",
     srcs = [
         ":package-srcs",
+        "//pkg/internal/api/validation:all-srcs",
         "//pkg/internal/apis/acme:all-srcs",
         "//pkg/internal/apis/certmanager:all-srcs",
         "//pkg/internal/apis/meta:all-srcs",

pkg/internal/api/validation/BUILD.bazel

@@ -0,0 +1,42 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["registry.go"],
+    importpath = "github.com/jetstack/cert-manager/pkg/internal/api/validation",
+    visibility = ["//pkg:__subpackages__"],
+    deps = [
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+        "@io_k8s_apimachinery//pkg/util/validation/field:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["registry_test.go"],
+    embed = [":go_default_library"],
+    deps = [
+        "//pkg/apis/certmanager/v1alpha2:go_default_library",
+        "//pkg/internal/apis/certmanager:go_default_library",
+        "//pkg/webhook:go_default_library",
+        "@io_k8s_api//core/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/util/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/util/validation/field:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/internal/api/validation/registry.go

@@ -0,0 +1,220 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package validation allows a caller to automatically register, lookup and
+// call API validation functions.
+// It is similar to runtime.Scheme and is designed to make writing and
+// consuming API validation functions easier.
+package validation
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Registry is used to store and lookup references to validation functions for
+// given Kubernetes API types.
+type Registry struct {
+	scheme                 *runtime.Scheme
+	validateRegister       map[schema.GroupVersionKind]ValidateFunc
+	validateUpdateRegister map[schema.GroupVersionKind]ValidateUpdateFunc
+}
+
+type ValidateFunc func(obj runtime.Object) field.ErrorList
+type ValidateUpdateFunc func(oldObj, obj runtime.Object) field.ErrorList
+
+// NewRegistry creates a new empty registry, backed by the provided Scheme.
+func NewRegistry(scheme *runtime.Scheme) *Registry {
+	return &Registry{
+		scheme:                 scheme,
+		validateRegister:       make(map[schema.GroupVersionKind]ValidateFunc),
+		validateUpdateRegister: make(map[schema.GroupVersionKind]ValidateUpdateFunc),
+	}
+}
+
+// AddValidateFunc will add a new validation function to the register.
+// The function will be run whenever Validate is called with a requestVersion
+// set to any recognised GroupVersionKinds for this object.
+// If obj is part of an internal API version, the validation function will be
+// called on all calls to Validate regardless of version.
+// If obj cannot be recognised using the registry's scheme, an error will be
+// returned.
+func (r *Registry) AddValidateFunc(obj runtime.Object, fn ValidateFunc) error {
+	gvks, _, err := r.scheme.ObjectKinds(obj)
+	if err != nil {
+		return err
+	}
+
+	for _, gvk := range gvks {
+		r.appendValidate(gvk, fn)
+	}
+
+	return nil
+}
+
+// AddValidateUpdateFunc will add a new validation function to the register.
+// The function will be run whenever ValidateUpdate is called with a
+// requestVersion set to any recognised GroupVersionKinds for this object.
+// If obj is part of an internal API version, the validation function will be
+// called on all calls to Validate regardless of version.
+// If obj cannot be recognised using the registry's scheme, an error will be
+// returned.
+func (r *Registry) AddValidateUpdateFunc(obj runtime.Object, fn ValidateUpdateFunc) error {
+	gvks, _, err := r.scheme.ObjectKinds(obj)
+	if err != nil {
+		return err
+	}
+
+	for _, gvk := range gvks {
+		r.appendValidateUpdate(gvk, fn)
+	}
+
+	return nil
+}
+
+// Validate will run all validation functions registered for the given object.
+// If the passed obj is *not* of the same version as the provided
+// requestVersion, the registry will attempt to convert the object before
+// calling the validation functions.
+// Any validation functions registered for the objects internal API version
+// will be run against the object regardless of version.
+func (r *Registry) Validate(obj runtime.Object, requestVersion schema.GroupVersionKind) field.ErrorList {
+	versioned, internal := r.lookupValidateFuncs(requestVersion)
+	if versioned == nil && internal == nil {
+		return nil
+	}
+
+	targetObj, internalObj, err := r.convert(obj, requestVersion)
+	if err != nil {
+		return internalError(err)
+	}
+
+	el := field.ErrorList{}
+	if versioned != nil {
+		el = append(el, versioned(targetObj)...)
+	}
+	if internal != nil {
+		el = append(el, internal(internalObj)...)
+	}
+
+	return el
+}
+
+// ValidateUpdate will run all update validation functions registered for the
+// given object.
+// If the passed objects are *not* of the same version as the provided
+// requestVersion, the registry will attempt to convert the objects before
+// calling the validation functions.
+// Any validation functions registered for the objects internal API version
+// will be run against the object regardless of version.
+func (r *Registry) ValidateUpdate(oldObj, obj runtime.Object, requestVersion schema.GroupVersionKind) field.ErrorList {
+	versioned, internal := r.lookupValidateUpdateFuncs(requestVersion)
+	if versioned == nil && internal == nil {
+		return nil
+	}
+
+	targetOldObj, internalOldObj, err := r.convert(oldObj, requestVersion)
+	if err != nil {
+		return internalError(err)
+	}
+
+	targetObj, internalObj, err := r.convert(obj, requestVersion)
+	if err != nil {
+		return internalError(err)
+	}
+
+	el := field.ErrorList{}
+	if versioned != nil {
+		el = append(el, versioned(targetOldObj, targetObj)...)
+	}
+	if internal != nil {
+		el = append(el, internal(internalOldObj, internalObj)...)
+	}
+
+	return el
+}
+
+func (r *Registry) lookupValidateFuncs(gvk schema.GroupVersionKind) (versioned ValidateFunc, internal ValidateFunc) {
+	versioned = r.validateRegister[gvk]
+	gvk.Version = runtime.APIVersionInternal
+	internal = r.validateRegister[gvk]
+	return versioned, internal
+}
+
+func (r *Registry) lookupValidateUpdateFuncs(gvk schema.GroupVersionKind) (versioned ValidateUpdateFunc, internal ValidateUpdateFunc) {
+	versioned = r.validateUpdateRegister[gvk]
+	gvk.Version = runtime.APIVersionInternal
+	internal = r.validateUpdateRegister[gvk]
+	return versioned, internal
+}
+
+func (r *Registry) appendValidate(gvk schema.GroupVersionKind, fn ValidateFunc) {
+	existing, ok := r.validateRegister[gvk]
+	if !ok {
+		r.validateRegister[gvk] = fn
+		return
+	}
+
+	r.validateRegister[gvk] = func(obj runtime.Object) field.ErrorList {
+		return append(existing(obj), fn(obj)...)
+	}
+}
+
+func (r *Registry) appendValidateUpdate(gvk schema.GroupVersionKind, fn ValidateUpdateFunc) {
+	existing, ok := r.validateUpdateRegister[gvk]
+	if !ok {
+		r.validateUpdateRegister[gvk] = fn
+		return
+	}
+
+	r.validateUpdateRegister[gvk] = func(oldObj, obj runtime.Object) field.ErrorList {
+		return append(existing(oldObj, obj), fn(oldObj, obj)...)
+	}
+}
+
+// convert will convert the given obj into the requestVersion as well as
+// returning the internal representation of the object.
+func (r *Registry) convert(obj runtime.Object, requestVersion schema.GroupVersionKind) (targetObj, internalObj runtime.Object, err error) {
+	// create a new object in the desired version
+	targetObj, err = r.scheme.New(requestVersion)
+	if err != nil {
+		return nil, nil, err
+	}
+	// create a new object in the 'internal' version
+	internalVersion := requestVersion
+	internalVersion.Version = runtime.APIVersionInternal
+	internalObj, err = r.scheme.New(internalVersion)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// convert the obj into the internalVersion first
+	if err := r.scheme.Convert(obj, internalObj, nil); err != nil {
+		return nil, nil, err
+	}
+
+	// convert the internalObj into the requestVersion
+	if err := r.scheme.Convert(internalObj, targetObj, nil); err != nil {
+		return nil, nil, err
+	}
+
+	return targetObj, internalObj, nil
+}
+
+func internalError(err error) field.ErrorList {
+	return field.ErrorList{field.InternalError(nil, err)}
+}

pkg/internal/api/validation/registry_test.go

@@ -0,0 +1,199 @@
+/*
+Copyright 2020 The Jetstack cert-manager contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation_test
+
+import (
+	"fmt"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+
+	cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
+	"github.com/jetstack/cert-manager/pkg/internal/api/validation"
+	cmapiinternal "github.com/jetstack/cert-manager/pkg/internal/apis/certmanager"
+	"github.com/jetstack/cert-manager/pkg/webhook"
+)
+
+var (
+	// use the webhook's Scheme during test fixtures as it has all internal and
+	// external cert-manager kinds registered
+	scheme = webhook.Scheme
+)
+
+func TestValidateType(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	called := false
+	utilruntime.Must(reg.AddValidateFunc(&cmapi.Certificate{}, func(obj runtime.Object) field.ErrorList {
+		called = true
+		return nil
+	}))
+	errs := reg.Validate(&cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+	if !called {
+		t.Errorf("expected registered validation function to run but it did not")
+	}
+}
+
+func TestValidateTypeMultiple(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	called1 := false
+	called2 := false
+	calledInternal := false
+	utilruntime.Must(reg.AddValidateFunc(&cmapi.Certificate{}, func(obj runtime.Object) field.ErrorList {
+		called1 = true
+		return nil
+	}))
+	utilruntime.Must(reg.AddValidateFunc(&cmapi.Certificate{}, func(obj runtime.Object) field.ErrorList {
+		called2 = true
+		return nil
+	}))
+	utilruntime.Must(reg.AddValidateFunc(&cmapiinternal.Certificate{}, func(obj runtime.Object) field.ErrorList {
+		calledInternal = true
+		return nil
+	}))
+	errs := reg.Validate(&cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+	if !called1 || !called2 {
+		t.Errorf("expected registered validation function to run but it did not")
+	}
+	if !calledInternal {
+		t.Errorf("expected registered internal validation function to run against external type but it did not")
+	}
+}
+
+func TestValidateUpdateTypeMultiple(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	called1 := false
+	called2 := false
+	calledInternal := false
+	utilruntime.Must(reg.AddValidateUpdateFunc(&cmapi.Certificate{}, func(_, _ runtime.Object) field.ErrorList {
+		called1 = true
+		return nil
+	}))
+	utilruntime.Must(reg.AddValidateUpdateFunc(&cmapi.Certificate{}, func(_, _ runtime.Object) field.ErrorList {
+		called2 = true
+		return nil
+	}))
+	utilruntime.Must(reg.AddValidateUpdateFunc(&cmapiinternal.Certificate{}, func(_, _ runtime.Object) field.ErrorList {
+		calledInternal = true
+		return nil
+	}))
+	errs := reg.ValidateUpdate(&cmapi.Certificate{}, &cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+	if !called1 || !called2 {
+		t.Errorf("expected registered validation function to run but it did not")
+	}
+	if !calledInternal {
+		t.Errorf("expected registered internal validation function to run against external type but it did not")
+	}
+}
+
+func TestValidateUpdateType(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	called := false
+	utilruntime.Must(reg.AddValidateUpdateFunc(&cmapi.Certificate{}, func(oldObj, obj runtime.Object) field.ErrorList {
+		called = true
+		return nil
+	}))
+	errs := reg.ValidateUpdate(&cmapi.Certificate{}, &cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+	if !called {
+		t.Errorf("expected registered validation function to run but it did not")
+	}
+}
+
+func TestValidateTypeReturnsErrors(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	called := false
+	expectedErr := field.InternalError(nil, fmt.Errorf("failed"))
+	utilruntime.Must(reg.AddValidateFunc(&cmapi.Certificate{}, func(obj runtime.Object) field.ErrorList {
+		called = true
+		return field.ErrorList{expectedErr}
+	}))
+	errs := reg.Validate(&cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) != 1 {
+		t.Error("expected to get an error but got none")
+	} else if err := errs[0]; err.Error() != expectedErr.Error() {
+		t.Errorf("expected error to be %q but got %q", expectedErr.Error(), err.Error())
+	}
+	if !called {
+		t.Errorf("expected registered validation function to run but it did not")
+	}
+}
+
+func TestValidateInternalType(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	called := false
+	utilruntime.Must(reg.AddValidateFunc(&cmapiinternal.Certificate{}, func(obj runtime.Object) field.ErrorList {
+		called = true
+		return nil
+	}))
+	errs := reg.Validate(&cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+	if !called {
+		t.Errorf("expected registered internal validation function to run for external type but it did not")
+	}
+}
+
+func TestValidateNoErrorNoneRegistered(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	errs := reg.Validate(&cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+}
+
+func TestValidateUpdateNoErrorNoneRegistered(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	errs := reg.ValidateUpdate(&cmapi.Certificate{}, &cmapi.Certificate{}, cmapi.SchemeGroupVersion.WithKind("Certificate"))
+	if len(errs) > 0 {
+		t.Errorf("expected to not get an error but got: %v", errs.ToAggregate())
+	}
+}
+
+func TestValidateUnrecognisedType(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	err := reg.AddValidateFunc(&corev1.Pod{}, func(obj runtime.Object) field.ErrorList {
+		return nil
+	})
+	if err == nil {
+		t.Errorf("expected to get an error but did not")
+	}
+}
+
+func TestValidateUpdateUnrecognisedType(t *testing.T) {
+	reg := validation.NewRegistry(scheme)
+	err := reg.AddValidateUpdateFunc(&corev1.Pod{}, func(oldObj, obj runtime.Object) field.ErrorList {
+		return nil
+	})
+	if err == nil {
+		t.Errorf("expected to get an error but did not")
+	}
+}

pkg/internal/apis/acme/BUILD.bazel

@@ -37,6 +37,7 @@ filegroup(
         "//pkg/internal/apis/acme/fuzzer:all-srcs",
         "//pkg/internal/apis/acme/install:all-srcs",
         "//pkg/internal/apis/acme/v1alpha2:all-srcs",
+        "//pkg/internal/apis/acme/v1alpha3:all-srcs",
         "//pkg/internal/apis/acme/validation:all-srcs",
     ],
     tags = ["automanaged"],

pkg/internal/apis/acme/install/BUILD.bazel

@@ -6,8 +6,11 @@ go_library(
     importpath = "github.com/jetstack/cert-manager/pkg/internal/apis/acme/install",
     visibility = ["//visibility:public"],
     deps = [
+        "//pkg/internal/api/validation:go_default_library",
         "//pkg/internal/apis/acme:go_default_library",
         "//pkg/internal/apis/acme/v1alpha2:go_default_library",
+        "//pkg/internal/apis/acme/v1alpha3:go_default_library",
+        "//pkg/internal/apis/acme/validation:go_default_library",
         "@io_k8s_apimachinery//pkg/runtime:go_default_library",
         "@io_k8s_apimachinery//pkg/util/runtime:go_default_library",
     ],

pkg/internal/apis/acme/install/install.go

@@ -22,12 +22,22 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 
+	"github.com/jetstack/cert-manager/pkg/internal/api/validation"
 	"github.com/jetstack/cert-manager/pkg/internal/apis/acme"
 	"github.com/jetstack/cert-manager/pkg/internal/apis/acme/v1alpha2"
+	"github.com/jetstack/cert-manager/pkg/internal/apis/acme/v1alpha3"
+	acmevalidation "github.com/jetstack/cert-manager/pkg/internal/apis/acme/validation"
 )
 
 // Install registers the API group and adds types to a scheme
 func Install(scheme *runtime.Scheme) {
 	utilruntime.Must(acme.AddToScheme(scheme))
 	utilruntime.Must(v1alpha2.AddToScheme(scheme))
+	utilruntime.Must(v1alpha3.AddToScheme(scheme))
+}
+
+// InstallValidation registers validation functions for the API group with a
+// validation registry
+func InstallValidation(registry *validation.Registry) {
+	utilruntime.Must(acmevalidation.AddToValidationRegistry(registry))
 }

pkg/internal/apis/acme/v1alpha3/BUILD.bazel

@@ -0,0 +1,41 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "defaults.go",
+        "doc.go",
+        "register.go",
+        "zz_generated.conversion.go",
+        "zz_generated.defaults.go",
+    ],
+    importpath = "github.com/jetstack/cert-manager/pkg/internal/apis/acme/v1alpha3",
+    visibility = ["//pkg:__subpackages__"],
+    deps = [
+        "//pkg/apis/acme:go_default_library",
+        "//pkg/apis/acme/v1alpha3:go_default_library",
+        "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/internal/apis/acme:go_default_library",
+        "//pkg/internal/apis/meta:go_default_library",
+        "@io_k8s_api//core/v1:go_default_library",
+        "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_apimachinery//pkg/conversion:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)