apiVersion: v1
kind: Namespace
metadata:
  name: linkerd
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: linkerd-self-signed-issuer
  namespace: itrs
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: linkerd-trust-anchor
  namespace: itrs
spec:
  isCA: true
  commonName: root.linkerd.cluster.local
  secretName: linkerd-identity-trust-roots
  duration: 87600h # 10 years
  renewBefore: 78840h
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: linkerd-self-signed-issuer
    kind: ClusterIssuer
    group: cert-manager.io
  usages:
  - cert sign
  - crl sign
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: linkerd-trust-anchor
  namespace: itrs
spec:
  ca:
    secretName: linkerd-identity-trust-roots
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: linkerd-identity-issuer
  namespace: linkerd
spec:
  isCA: true
  commonName: identity.linkerd.cluster.local
  secretName: linkerd-identity-issuer
  duration: 48h
  renewBefore: 25h
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: linkerd-trust-anchor
    kind: ClusterIssuer
    group: cert-manager.io
  dnsNames:
  - identity.linkerd.cluster.local
  usages:
  - cert sign
  - crl sign
  - server auth
  - client auth
---
apiVersion: trust.cert-manager.io/v1alpha1
kind: Bundle
metadata:
    name: linkerd-identity-trust-roots
spec:
  sources:
  - secret:
      name: linkerd-identity-trust-roots
      key: "ca.crt"
  target:
    configMap:
      key: "ca-bundle.crt"
    namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: linkerd
