apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hubble-relay-client-certs
  namespace: kube-system
spec:
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: ca-issuer
  secretName: hubble-relay-client-certs
  commonName: "*.hubble-relay.cilium.io"
  dnsNames:
    - "*.hubble-relay.cilium.io"
  duration: 8760h0m0s
  privateKey:
    rotationPolicy: Always
  isCA: false
  usages:
    - signing
    - key encipherment
    - client auth