</code></pre><h2 id=export-root-certificates-for-each-cluster-issuer>Export root certificates for each cluster issuer</h2><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ export ISTIOCA=$(kubectl get clusterissuers istio-system -o jsonpath=&#39;{.spec.ca.secretName}&#39; | xargs kubectl get secret -n cert-manager -o jsonpath=&#39;{.data.ca\.crt}&#39; | base64 -d | sed &#39;s/^/        /&#39;)
$ export FOOCA=$(kubectl get clusterissuers foo -o jsonpath=&#39;{.spec.ca.secretName}&#39; | 