apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned-ca-issuer
  namespace: cert-manager
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-ca
  namespace: cert-manager
spec:
  secretName: selfsigned-ca
  commonName: "TiDBCloud"
  isCA: true
  duration: 87600h # 10yrs
  renewBefore: 720h # 30d
  issuerRef:
    name: selfsigned-ca-issuer
    kind: Issuer
# The Issuer selfsigned-ca-issuer and Certificate selfsigned-ca are used to generate a selfsigned-ca Secret
# And the Secret is used for ClusterIssuer ca-issuer
# Since ca-issuer is a self-signed issuer, it's used to provision k8s in-cluster certifcate, such as webhook certificate
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: ca-issuer
spec:
  ca:
    secretName: selfsigned-ca