func newCertificate(cert CertParam) (*unstructured.Unstructured, error) {
	cn := names.TruncateMD5(fmt.Sprintf("%s.%s", cert.Name, cert.Domain), 64)
	data := fmt.Sprintf(`{
		"apiVersion": "cert-manager.io/v1",
		"kind": "Certificate",
		"metadata": {
			"name": "%[1]s"
		},
		"spec": {
			"commonName" : "%[2]s",
			"secretName" : "%[1]s-tls",
			"dnsNames": [
				"%[1]s.%[3]s"
			],
			"issuerRef" : {
				"name" : "%[4]s",
				"kind" : "ClusterIssuer"
			}
		}
        }`, cert.Name, cn, cert.Domain, cert.Issuer)
	decoderUnstructured := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
	obj := &unstructured.Unstructured{}
	_, _, err := decoderUnstructured.Decode([]byte(data), nil, obj)
	if err != nil {
		return nil, err
	}
	return obj, err
}
newCertificate creates a proper certificate resource from the
specified parameters. The result is suitable for upload to the
cluster.
package auth
import (
	"context"
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"net/http"
	"github.com/gorilla/websocket"
	"github.com/pkg/errors"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
	"github.com/epinio/epinio/helpers/kubernetes"
	"github.com/epinio/epinio/internal/names"
)
func ExtendLocalTrust(certs string) {
	rootCAs, _ := x509.SystemCertPool()
	if rootCAs == nil {
		rootCAs = x509.NewCertPool()
	}
	rootCAs.AppendCertsFromPEM([]byte(certs))
	config := &tls.Config{
		MinVersion: tls.VersionTLS12,
		RootCAs:    rootCAs,
	}
	http.DefaultTransport.(*http.Transport).TLSClientConfig = config
	websocket.DefaultDialer.TLSClientConfig = config
	http.DefaultTransport.(*http.Transport).ForceAttemptHTTP2 = false
}
type CertParam struct {
	Name      string
	Namespace string
	Domain    string
	Issuer    string
}
func CreateCertificate(
	ctx context.Context,
	cluster *kubernetes.Cluster,
	cert CertParam,
	owner *metav1.OwnerReference,
) error {
	obj, err := newCertificate(cert)
	if err != nil {
		return errors.Wrap(err, fmt.Sprintf("creation of ssl certificate for issuer '%s' failed", cert.Issuer))
	}
	client, err := cluster.ClientCertificate()
	if err != nil {
		return err
	}
	if owner != nil {
		obj.SetOwnerReferences([]metav1.OwnerReference{*owner})
	}
	_, err = client.Namespace(cert.Namespace).Create(ctx, obj, metav1.CreateOptions{})
	if err != nil && !apierrors.IsAlreadyExists(err) {
		return err
	}
	return nil
}