apiVersion: apps/v1
kind: Deployment
metadata:
  name: direct
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: direct
  template:
    metadata:
      labels:
        app: direct
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: projected
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: projected
  template:
    metadata:
      labels:
        app: projected
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        projected:
          sources:
          - secret:
              name: cert
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: environment
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: environment
  template:
    metadata:
      labels:
        app: environment
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        env:
        - name: CERT
          valueFrom:
            secretKeyRef:
              name: cert
              key: tls.crt
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: native
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: native
  template:
    metadata:
      labels:
        app: native
      annotations:
        keep: 'yes'
        certificates.quorate.internal/activation: '{"server":"native"}'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mixed
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: mixed
  template:
    metadata:
      labels:
        app: mixed
      annotations:
        keep: 'yes'
        certificates.quorate.internal/activation: '{"server":"native"}'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      - name: sidecar
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: unrelated
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: unrelated
  template:
    metadata:
      labels:
        app: unrelated
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: other
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: paused
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: paused
  template:
    metadata:
      labels:
        app: paused
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
  paused: true
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: daemon
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: daemon
  template:
    metadata:
      labels:
        app: daemon
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: stateful
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: stateful
  template:
    metadata:
      labels:
        app: stateful
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: on-delete
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: on-delete
  template:
    metadata:
      labels:
        app: on-delete
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
  updateStrategy:
    type: OnDelete
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: partition
  namespace: tls-test
spec:
  selector:
    matchLabels:
      app: partition
  template:
    metadata:
      labels:
        app: partition
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      partition: 1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wrong-ns
  namespace: elsewhere
spec:
  selector:
    matchLabels:
      app: wrong-ns
  template:
    metadata:
      labels:
        app: wrong-ns
      annotations:
        keep: 'yes'
    spec:
      containers:
      - name: server
        image: example.invalid/test:fake
        volumeMounts:
        - name: tls
          mountPath: /tls
      volumes:
      - name: tls
        secret:
          secretName: cert