// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manager/zero-trust-manager-plugins.adoc

:_mod-docs-content-type: PROCEDURE
[id="zero-trust-manager-preparing-plugin-use_{context}"]
= Preparing cert-manager for SPIRE Server

[role="_abstract"]
Install {cert-manager-operator} and create an `Issuer` or `ClusterIssuer` that can sign SPIRE intermediate certificates. After you complete this procedure, configure `spec.upstreamAuthority.certManager` on the `SpireServer` CR.

.Prerequisites

* You are logged in to the cluster with the `cluster-admin` role.
* You have installed {zero-trust-full} or plan to install it after {cert-manager-operator} is ready.

.Procedure

. Create a self-signed bootstrap `ClusterIssuer`:

.. Save the following manifest as `selfsigned-bootstrap.yaml`:
+
[source,yaml]
----
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-bootstrap
spec:
  selfSigned: {}
----

.. Apply the `ClusterIssuer` by running the following command:
+
[source,terminal]
----
$ oc apply -f selfsigned-bootstrap.yaml
----

. Use the bootstrap `ClusterIssuer` to issue a root CA certificate into a Secret:

.. Save the following manifest as `spire-root-ca.yaml`:
+
[source,yaml]
----
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: spire-root-ca
  namespace: cert-manager
spec:
  isCA: true
  secretName: spire-root-ca-secret
  issuerRef:
    name: selfsigned-bootstrap
    kind: ClusterIssuer
  commonName: "SPIRE Root CA"
  duration: 87600h
----

.. Apply the `Certificate` by running the following command:
+
[source,terminal]
----
$ oc apply -f spire-root-ca.yaml
----

. Create a CA `Issuer` that references the root CA Secret:

.. Save the following manifest as `spire-ca-issuer.yaml`:
+
[source,yaml]
----
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: spire-ca
  namespace: cert-manager
spec:
  ca:
    secretName: spire-root-ca-secret
----

.. Apply the `Issuer` by running the following command:
+
[source,terminal]
----
$ oc apply -f spire-ca-issuer.yaml
----

.Verification

* Confirm that the bootstrap `ClusterIssuer`, root CA `Certificate`, and signing `Issuer` are ready by running the following commands:
+
[source,terminal]
----
$ oc get clusterissuer selfsigned-bootstrap
----
+
[source,terminal]
----
$ oc get certificate spire-root-ca -n cert-manager
----
+
[source,terminal]
----
$ oc get issuer spire-ca -n cert-manager
----

