Allow CA issuers to generate their own secrets

[jroper]

Is your feature request related to a problem? Please describe.
Currently, when creating a CA issuer, you have to manually generate a self signed cert for it (if that's what you want to use).

Describe the solution you'd like
Add an option to CA issuers to generate a self signed cert if its configured secret doesn't yet exist.

Additional context
If combined with #2478, CA issuers could be made to auto rotate their certificates when they are nearing expiration.

[retest-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[retest-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[meyskens]

/kind feature
/priority important-long-term
/remove-lifecycle stale

In meantime you can use this as an alternative bu using the SelfSigned Issuer to create the CA cert for you:

---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ca
spec:
  secretName: ca
  commonName: ca
  isCA: true
  issuerRef:
    name: selfsigned-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: ca-issuer
spec:
  ca:
    secretName: ca

[jetstack-bot]

@meyskens: The label(s) priority/important-long-term cannot be applied, because the repository doesn't have them

In response to this:

/kind feature
/priority important-long-term
/remove-lifecycle stale

In meantime you can use this as an alternative bu using the SelfSigned Issuer to create the CA cert for you:

---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
 name: selfsigned-issuer
spec:
 selfSigned: {}
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
 name: ca
spec:
 secretName: ca
 commonName: ca
 isCA: true
 issuerRef:
   name: selfsigned-issuer
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
 name: ca-issuer
spec:
 ca:
   secretName: ca

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[meyskens]

/remove-lifecycle rotten

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[jetstack-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[jetstack-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

[jetstack-bot]

@jetstack-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.