$ git clone https://github.com/jetstack/cert-manager
$ git checkout release-0.11
$ ls deploy/manifest

00-crds.yaml
01-namespace.yaml
BUILD.bazel	
README.md	
helm-values.yaml

// 這邊使用的是 v1beta1 的 API (deprecated at v1.16) ，新版開發建議使用 apiextension.k8s.io/v1 的 api
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  creationTimestamp: null
  name: certificates.cert-manager.io
spec:
  // 使用 kubectl 會額外顯示的資訊內容，透過 jsonpath 去 parse 顯示
  additionalPrinterColumns:
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .spec.secretName
    name: Secret
    type: string
  - JSONPath: .spec.issuerRef.name
    name: Issuer
    priority: 1
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].message
    name: Status
    priority: 1
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: CreationTimestamp is a timestamp representing the server time when
      this object was created. It is not guaranteed to be set in happens-before order
      across separate operations. Clients may not set this value. It is represented
      in RFC3339 form and is in UTC.
    name: Age
    type: date
  group: cert-manager.io
  // 定義 CRD 在不同情境下使用的名稱
  names:
    kind: Certificate
    listKind: CertificateList
    plural: certificates
    shortNames:
    - cert
    - certs
    singular: certificate
  scope: Namespaced
  subresources:
    status: {}
  validation:
    // openAPIV3Schema 中是 custom resource 實際操作會使用的內容
    // properties 使用 . .description .type ，分別定義名稱，描述，檢查型別
    openAPIV3Schema:
      description: Certificate is a type to represent a Certificate from ACME
      properties:
        apiVersion:
          description: 'APIVersion defines the versioned schema of this representation
            of an object. Servers should convert recognized schemas to the latest
            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
          type: string
        kind:
          description: 'Kind is a string value representing the REST resource this
            object represents. Servers may infer this from the endpoint the client
            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
          type: string
        // custom resource runtime 中的 metadata
        metadata:
          type: object
        // custom resource 使用時的 spec，定義 custom resoure 的 desired status
        spec:
          ...
        // custom controller 監測 custom resource 的 current status，這邊的資料完全視 controller 實作來產生，如果沒有實作 sync status，也可以沒有資料
        status:
          ...
      type: object
  // 這個是 CRD 物件的 version，可以定義多個不同 version 的 CRD，調用時需要註明版本
  version: v1alpha2
  versions:
  - name: v1alpha2
    served: true
    storage: true
// 這個是 CRD 物件的 status，描述 CRD 部署到 API server 的狀態，例如 CRD 儲存適用 configmap 的儲存空間，這邊顯示在 API server 上的儲存狀態。不要跟 custom resource 的 status 弄混了
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []

kubectl get certificates.certmanager.k8s.io
kubectl get certificates
kubectl get certs --all-namespaces
kubectl get cert -n cert-manager

NAMESPACE          NAME                READY   SECRET              AGE
cert-manager       ingress-nginx-tls   True    ingress-nginx-tls   221d

$ kubectl describe cert ingress-nginx-tls

Name:         ingress-nginx-tls
Namespace:    cert-manager
API Version:  certmanager.k8s.io/v1alpha1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2019-03-06T06:48:26Z
  Generation:          4
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  ingress-nginx
  Self Link:               /apis/certmanager.k8s.io/v1alpha1/namespaces/default/certificates/ingress-nginx-tls
Spec:
  Acme:
    Config:
      Domains:
        chechiachang.com
      Http 01:
        Ingress:
        Ingress Class:  nginx
  Dns Names:
    chechiachang.com
  Issuer Ref:
    Kind:       ClusterIssuer
    Name:       letsencrypt-prod
  Secret Name:  ingress-nginx-tls
// 當前的 status，controller sync 上來
// controller 會比對 .spec 與 .status，判斷是否需要做事，ex. renew
Status:
  Acme:
    Order:
      URL:  https://acme-v02.api.letsencrypt.org/acme/order/*
  Conditions:
    Last Transition Time:  2019-09-02T03:52:03Z
    Message:               Certificate renewed successfully
    Reason:                CertRenewed
    Status:                True
    Type:                  Ready
    Last Transition Time:  2019-09-02T03:52:01Z
    Message:               Order validated
    Reason:                OrderValidated
    Status:                False
    Type:                  ValidateFailed
Events:                    <none>

$ kubectl delete cert ingress-nginx-tls -n cert-manager