groupSearch.attributes.groupName
- DNs are more unique than CNs, so it feels like a safer default
spec.tls