deployments/tls/certificate.yaml

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: istio-ingressgateway-certs
  namespace: istio-system
spec:
  # Secret names are always required.
  secretName: istio-ingressgateway-certs
  # At least one of a DNS Name, URI, or IP address is required.
  #dnsNames:
  #  - uniquednsname.eastus.cloudapp.azure.com
  ipAddresses:
    - {{ IP_ADDRESS }}
  isCA: true
  # Issuer references are always required.
  issuerRef:
    name: kubeflow-self-signing-issuer
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    # This is optional since cert-manager will default to this value however
    # if you are using an external issuer, change this to that issuer group.
    group: cert-manager.io