New try of cert manager with cnpg

apps/postgres/ca.yaml

@@ -0,0 +1,25 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-ca
+  namespace: postgres
+spec:
+  isCA: true
+  commonName: postgres-ca
+  secretName: postgres-ca
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: postgres-ca
+  namespace: postgres
+spec:
+  ca:
+    secretName: postgres-ca

apps/postgres/certs.yaml

@@ -1,36 +1,10 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: postgres-ca
+  name: postgres-server-cert
   namespace: postgres
 spec:
-  isCA: true
-  commonName: postgres-ca
-  secretName: postgres-ca
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned
-    kind: ClusterIssuer
-    group: cert-manager.io
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: postgres-ca
-  namespace: postgres
-spec:
-  ca:
-    secretName: postgres-ca
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: postgres-replication-cert
-  namespace: postgres
-spec:
-  secretName: postgres-replication-cert
+  secretName: postgres-server-cert
   secretTemplate:
     labels:
       cnpg.io/reload: ""
@@ -50,3 +24,17 @@ spec:
     name: postgres-ca
     kind: Issuer
     group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-replication-cert
+spec:
+  secretName: postgres-replication-cert
+  usages:
+    - client auth
+  commonName: streaming_replica
+  issuerRef:
+    name: postgres-ca
+    kind: Issuer
+    group: cert-manager.io

apps/postgres/cluster.yaml

@@ -10,7 +10,9 @@ spec:
     size: 10Gi
 
   certificates:
-    clientCASecret: postgres-ca
+    serverTLSSecret: postgres-ca
+    serverCASecret: postgres-ca
+    clientCASecret: postgres-server-cert
     replicationTLSSecret: postgres-replication-cert
 
   # this is here because no `Role` crd exsists yet.