apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-ca-cert
  namespace: cert-manager
spec:
  isCA: true          # CA 인증서임을 명시
  commonName: my-ca
  secretName: my-ca-secret
  issuerRef:
    name: my-selfsigned-ca
    kind: ClusterIssuer

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: $CERT_NAME
  namespace: $NAMESPACE
spec:
  secretName: $CERT_NAME #생성될 secret Name
  issuerRef:
    name: ca-issuer #cluster-issuer or issuer
    kind: ClusterIssuer
  dnsNames:
    - $DOMAIN1
    - $DOMAIN2

#client 인증서
  usages:
    - client auth
#server 인증서
  usages:
    - digital signature
    - key encipherment
#만료정책
  duration: 87600h  # 10년
  renewBefore: 360h # 만료 15일 전 갱신 시도