---
apiVersion: anthos-cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned-system-issuer
spec:
  selfSigned: {}
apiVersion: anthos-cert-manager.io/v1
kind: Certificate
metadata:
  name: system-cert
spec:
  # Secret names are always required.
  secretName: system-issued-cert

  # secretTemplate is optional. If set, these annotations and labels will be
  # copied to the Secret named anthos-example-cert. These labels and annotations will
  # be re-reconciled if the Certificate's secretTemplate changes. secretTemplate
  # is also enforced, so relevant label and annotation changes on the Secret by a
  # third party will be overwriten by cert-manager to match the secretTemplate.
  secretTemplate:
    annotations:
      my-secret-annotation-1: "foo"
      my-secret-annotation-2: "bar"
    labels:
      my-secret-label: foo
  duration: 1h # 90d
  renewBefore: 5m # 15d
  subject:
    organizations:
      - anthos-onprem
  # The use of the common name field has been deprecated since 2000 and is
  # discouraged from being used.
  commonName: example.com
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - server auth
    - client auth
  # At least one of a DNS Name, URI, or IP address is required.
  dnsNames:
    - anthos.google.com
    - anthos.onprem.google.com
  uris:
    - spiffe://cluster.local/ns/sandbox/sa/example
  ipAddresses:
    - 192.168.0.5
  # Issuer references are always required.
  issuerRef:
    name: selfsigned-system-issuer
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: Issuer
    # This is optional since cert-manager will default to this value however
    # if you are using an external issuer, change this to that issuer group.
    group: anthos-cert-manager.io