cert.yaml

apiVersion: v1
kind: Secret
metadata:
  name: vault-tls
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: vault-selfsigned
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: vault
spec:
  secretName: vault-tls
  issuerRef:
    kind: Issuer
    name: vault-selfsigned
  duration: 168h # 7 days
  renewBefore: 144h # 6 days
  subject:
    organizations:
      - uw
  privateKey:
    algorithm: Ed25519
    rotationPolicy: Always
  usages:
    - server auth
    - client auth
  ipAddresses:
    - 127.0.0.1 # required by vault initializer
  dnsNames:
    - vault
    - vault-0.vault
    - vault-0.vault-cluster
    - vault-0.vault-cluster.sys-vault
    - vault-0.vault.sys-vault
    - vault-1.vault
    - vault-1.vault-cluster
    - vault-1.vault-cluster.sys-vault
    - vault-1.vault.sys-vault
    - vault-2.vault
    - vault-2.vault-cluster
    - vault-2.vault-cluster.sys-vault
    - vault-2.vault.sys-vault
    - vault-cluster
    - vault-cluster.sys-vault
    - vault.sys-vault