apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ns1-tidb-client-secret
  namespace: ns1
spec:
  secretName: ns1-tidb-client-secret
  duration: 8760h # 365d
  renewBefore: 360h # 15d
  organization:
    - PingCAP
  commonName: "TiDB Client"
  usages:
    - client auth
  issuerRef:
    name: ns1-tidb-issuer
    kind: Issuer
    group: cert-manager.io