Egress MTLS Documentation - Creating CA Secret

[gloorfindel]

Looking at the documentation here: https://docs.nginx.com/nginx-ingress-controller/configuration/policy-resource/

The trustedCertSecret notes:

The name of the Kubernetes secret that stores the CA certificate. It must be in the same namespace as the Policy resource. The secret must be of the type nginx.org/ca, and the certificate must be stored in the secret under the key ca.crt, otherwise the secret will be rejected as invalid.

The above description notes the secret must be of type nginx.org/ca, which I can't find any documentation on how to create.

Attempted to use the documentation here to create a ca secret: https://kubernetes.github.io/ingress-nginx/examples/auth/client-certs/#creating-certificate-secrets

kubectl create secret generic ca-secret --from-file=ca.crt=ca.crt

Which when referenced by the trustedCertSecret: ca-secret under egressMTLS results in a 500 error when attempting to access the application (which seems to mean the secret is not configured correctly).

Could more clarification on how the secret is created in type nginx.org/ca format be provided?

[gloorfindel]

Nevermind, found an example here:
https://github.com/nginxinc/kubernetes-ingress/blob/main/examples/custom-resources/ingress-mtls/ingress-mtls-secret.yaml