apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: dedicated-api-server
spec:
  secretName: dedicated-api-server
  duration: 86700h
  renewBefore: 720h
  commonName: "kube-apiserver"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages: # both for server and client usages
    - server auth
    - client auth
  dnsNames:
    - "localhost"
    - "kubernetes"
    - "kubernetes.default"
    - "kubernetes.default.svc"
    - "kubernetes.default.svc.cluster"
    - "kubernetes.default.svc.cluster.local"
    - "api-server"
    - "api-server.infra"
    - "api-server.infra.svc"
    - "api-server.infra.svc.cluster.local"
    - "*.api-server"
    - "*.api-server.infra"
    - "*.api-server.infra.svc"
    - "*.api-server.infra.svc.cluster.local"
    - "us-west-2.infra.prod.aws.tidbcloud.com"
    # New DNS for migration
    - "dedicated-api-server"
    - "dedicated-api-server.infra"
    - "dedicated-api-server.infra.svc"
    - "dedicated-api-server.infra.svc.cluster.local"
    - "*.dedicated-api-server"
    - "*.dedicated-api-server.infra"
    - "*.dedicated-api-server.infra.svc"
    - "*.dedicated-api-server.infra.svc.cluster.local"
    - "dedicated-api-server.prod.aws.tidbcloud.com"
  ipAddresses:
    - 127.0.0.1
    - ::1
  issuerRef:
    name: api-server-issuer
    kind: Issuer
    group: cert-manager.io