apiVersion: cert-manager.io/v1
kind: Certificate
metadata: 
  name: tidb-session-cert
spec: 
  duration: 87600h
  renewBefore: 24000h
  issuerRef: 
    group: awspca.cert-manager.io
    kind: AWSPCAClusterIssuer
    name: aws-pca-issuer
  secretName: tidb-session-certificate-secret
  subject: 
    organizations: 
      - PingCAP
  dnsNames:
    - "*"