It seems terraform passing a null for the spec may be tricky.  If the issuer is a kind of ClusterIssuer, or anything other than Issuer we should treat it as a reference no matter what spec is.  I can also make sure that spec: {} works as well as spec: null for the potential case where we want to refer to an external resource that is of kind "Issuer" which we can't simply ignore.