// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manager/zero-trust-manager-plugins.adoc

:_mod-docs-content-type: REFERENCE
[id="zero-trust-manager-cert-manager-plugin-ref_{context}"]
= cert-manager upstream authority plugin reference

[role="_abstract"]
This reference describes `spec.upstreamAuthority.certManager` fields on the `SpireServer` custom resource and how {zero-trust-full} uses them to request intermediate certificates from {cert-manager-operator}. Use it when you configure or troubleshoot the {cert-manager-operator} UpstreamAuthority plugin and need field descriptions or defaults.

[id="cert-manager-plugin-spireserver-cr-reference_{context}"]
== SpireServer CR fields

Configure {cert-manager-operator} upstream authority under `spec.upstreamAuthority.certManager`. {zero-trust-full} generates the SPIRE Server configuration from these fields.

[cols="2,5",options="header"]
|===
| Field | Description

| `namespace`
| Required. Namespace where SPIRE Server creates `CertificateRequest` resources.

| `issuerName`
| Required. Name of the Issuer or ClusterIssuer.

| `issuerKind`
| Optional. `Issuer` or `ClusterIssuer`. The default is `Issuer`.

| `issuerGroup`
| Optional. API group of the issuer. The default is `cert-manager.io`.
|===

[NOTE]
====
On {product-title}, SPIRE Server uses its in-cluster `ServiceAccount`. {zero-trust-full} grants permissions to create, get, list, and delete `CertificateRequest` resources when `spec.upstreamAuthority.certManager` is configured.
====
