Fix cert-manager build error (cherry-pick)

Tested: erikgb reports that this works

config/certmanager/certificate.yaml

@@ -1,14 +1,14 @@
 # The following manifests contain a self-signed issuer CR and a certificate CR.
 # More document can be found at https://docs.cert-manager.io
-apiVersion: cert-manager.io/v1alpha2
+apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   name: selfsigned-issuer
   namespace: system
 spec:
   selfSigned: {}
 ---
-apiVersion: cert-manager.io/v1alpha2
+apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml

config/variants/default-cm/README

@@ -5,3 +5,15 @@ building the manifests ("made manifests" in the root directory).
 
 As of March 2022, I ([email protected]) have not actually tested this to see if
 it works.
+
+If/when we next need to use CRD conversion webhooks, add the following patches
+to this directory:
+
+# The following patch adds a directive for certmanager to inject CA into the CRD
+# CRD conversion requires k8s 1.13 or later.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+  name: hierarchies.hnc.x-k8s.io