ProDisco

# cert-manager resources for TLS certificate management # Prerequisites: cert-manager must be installed in the cluster # Install: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml # Step 1: Self-signed issuer for bootstrapping the CA apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: selfsigned-issuer spec: selfSigned: {} --- # Step 2: Root CA certificate (self-signed) apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: sandbox-ca namespace: prodisco spec: isCA: true commonName: sandbox-ca secretName: sandbox-ca-secret duration: 87600h # 10 years renewBefore: 8760h # 1 year before expiry privateKey: algorithm: ECDSA size: 256 issuerRef: name: selfsigned-issuer kind: ClusterIssuer --- # Step 3: CA Issuer that uses the root CA to sign certificates apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: sandbox-ca-issuer namespace: prodisco spec: ca: secretName: sandbox-ca-secret