ProDisco

# cert-manager resources for TLS certificate management
# Prerequisites: cert-manager must be installed in the cluster
# Install: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml

# Step 1: Self-signed issuer for bootstrapping the CA
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
# Step 2: Root CA certificate (self-signed)
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: sandbox-ca
  namespace: prodisco
spec:
  isCA: true
  commonName: sandbox-ca
  secretName: sandbox-ca-secret
  duration: 87600h # 10 years
  renewBefore: 8760h # 1 year before expiry
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
---
# Step 3: CA Issuer that uses the root CA to sign certificates
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: sandbox-ca-issuer
  namespace: prodisco
spec:
  ca:
    secretName: sandbox-ca-secret