docs: fix user/tls-cert-manager Issuer/ClusterIssuer

[tommie]

Based on feedback from @irbekrm of cert-manager.

[codecov]

Codecov Report

Merging #1473 (689d34a) into main (35e6166) will increase coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #1473      +/-   ##
==========================================
+ Coverage   61.65%   61.67%   +0.01%     
==========================================
  Files          79       79              
  Lines       11490    11490              
==========================================
+ Hits         7084     7086       +2     
+ Misses       3947     3945       -2     
  Partials      459      459              

see 2 files with indirect coverage changes

[irbekrm]

Thanks for writing the awesome tutorial and thanks for making the changes @tommie !

I've added a nit.

Apart from that I have two optional suggestions:

• we really don't recommend using self-signed issuer for any other case except for quick testing of things and for bootstrapping a root CA cert. In our own example setups we typically use a selfsigned issuer to issue a CA cert for a CA issuer that can then be used to issue certs for applications like so. I understand that you may not want to make the setup too complex here, but perhaps would be nice to add an additional warning that the self signed issuer should not be used beyond a quick test of things

• In the garbage collection section it mentions that Certificates will be garbage collected when Secrets are removed - this is not quite the case, for gateway-shim/ingress-shim they will be deleted because if the relevant TLS block has been removed from Gateway or Ingress. If a Secret was deleted (i.e by a user) that is referenced by a Certificate, cert-manager would actually re-create the Secret

[tommie]

• we really don't recommend using self-signed issuer for any other case except for quick testing of things and for bootstrapping a root CA cert. In our own example setups we typically use a selfsigned issuer to issue a CA cert for a CA issuer that can then be used to issue certs for applications like so. I understand that you may not want to make the setup too complex here, but perhaps would be nice to add an additional warning that the self signed issuer should not be used beyond a quick test of things

Yes, I want something that is simple to start with. selfSigned has no configuration, and doesn't require access to external services, which makes it an ideal thing to start with. Difficult to screw up. I've added a note.

• In the garbage collection section it mentions that Certificates will be garbage collected when Secrets are removed - this is not quite the case, for gateway-shim/ingress-shim they will be deleted because if the relevant TLS block has been removed from Gateway or Ingress. If a Secret was deleted (i.e by a user) that is referenced by a Certificate, cert-manager would actually re-create the Secret

Nice catch. Updated.

[irbekrm]

Thanks for making the changes! Looks great from cert-manager perspective 😄

/lgtm

[arkodg]

thanks for the updates @tommie and @irbekrm for the review