maybe they are forced to be on the cert-manager namespace?

apps/production/traefik/certificates/fascinated-cc.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fascinated-cc
+  namespace: traefik
+spec:
+  secretName: fascinated-cc
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.fascinated.cc"
+  dnsNames:
+    - "fascinated.cc"
+    - "*.fascinated.cc"

apps/production/traefik/certificates/local-fascinated-cc.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: local-fascinated-cc
+  namespace: traefik
+spec:
+  secretName: local-fascinated-cc
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.local.fascinated.cc"
+  dnsNames:
+    - "*.local.fascinated.cc"

apps/production/traefik/certificates/mcutils-xyz.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mcutils-xyz
+  namespace: traefik
+spec:
+  secretName: mcutils-xyz
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.mcutils.xyz"
+  dnsNames:
+    - "mcutils.xyz"
+    - "*.mcutils.xyz"

apps/production/traefik/kustomization.yaml

@@ -5,5 +5,8 @@ namespace: traefik
 resources:
   - namespace.yaml
   - traefik.yaml
+  - ./certificates/fascinated-cc.yaml
+  - ./certificates/local-fascinated-cc.yaml
+  - ./certificates/mcutils-xyz.yaml
   #- ./external-services
   # for some stupid fucking reason kustomize doesn't support wildcards or globs?!?!?!??!?