ClusterIssuer for cert-manager and Vault

cluster-issuer.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
    name: vault-issuer
    namespace: cert-manager
spec:
    vault:
        server: https://<vault address>:8200
        caBundle: <ca bundle>
        path: pki/sign/<role>
        auth:
            kubernetes:
                mountPath: /v1/auth/kubernetes
                role: issuer
                secretRef:
                    name: <vault-auth-token-name>
                    key: token

service-account-rbac.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: role-tokenreview-binding
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: vault-reviewer
  namespace: cert-manager

service-account-reviewer.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-reviewer

service-account.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-auth