BUG: issuerRef `group: "cert-manager.io"` does not match CertificateRequest with no group.

[inteon]

approver-policy does not seem to be issuerRef group defaulting aware.

eg. the following policy will not match the example certificate request

apiVersion: policy.cert-manager.io/v1alpha1
kind: CertificateRequestPolicy
metadata:
  name: selfsigned-policy
spec:
  ...
  selector:
    issuerRef:
      name: "internal-ca"
      kind: "ClusterIssuer"
      group: "cert-manager.io"
---
apiVersion: cert-manager.io/v1
kind: CertificateRequest
metadata:
  name: test123
spec:
  ...
  issuerRef:
    kind: ClusterIssuer
    name: internal-ca

[erikgb]

We have also been hit by this. As an alternative solution, we could set the group default (cert-manager.io) in cert-manager resources. IMO this would be a cleaner solution - instead of duplicating the cert-manager group default in approver-policy.

[hawksight]

Related code that @inteon mentioned in today's standup