code: func IssuerFromAPIRootCA(rootCA *api.RootCA) (*IssuerInfo, error) {
  	wantedIssuer := rootCA.CACert
  	if rootCA.RootRotation != nil {
  		wantedIssuer = rootCA.RootRotation.CACert
  	}
  	issuerCerts, err := helpers.ParseCertificatesPEM(wantedIssuer)
  	if err != nil {
  		return nil, errors.Wrap(err, "invalid certificate in cluster root CA object")
  	}
  	if len(issuerCerts) == 0 {
  		return nil, errors.New("invalid certificate in cluster root CA object")
  	}
  	return &IssuerInfo{
  		Subject:   issuerCerts[0].RawSubject,
  		PublicKey: issuerCerts[0].RawSubjectPublicKeyInfo,
  	}, nil
  }
docs: // IssuerFromAPIRootCA returns the desired issuer given an API root CA object