yandexcloud-k3s/terraform/main/etc/certificate.tf

resource "yandex_cm_certificate" "default" {
  name                = replace(lower(var.domain), ".", "-")
  description         = "Default certificate for all resources"
  deletion_protection = true

  domains = tolist([var.domain, "*.${var.domain}"])

  managed {
    challenge_type = "DNS_CNAME"
  }
}