cert-manager
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# +docs:section=Global
2
3
# Default values for cert-manager.
4
# This is a YAML-formatted file.
5
# Declare variables to be passed into your templates.
6
global:
7
# Reference to one or more secrets to be used when pulling images.
8
# For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
9
#
10
# For example:
11
# imagePullSecrets:
12
# - name: "image-pull-secret"
13
imagePullSecrets: []
14
# Global node selector
15
#
16
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
17
# matching labels.
18
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
19
#
20
# If a component-specific nodeSelector is also set, it will be merged and take precedence.
21
# +docs:property
22
nodeSelector: {}
23
# Labels to apply to all resources.
24
# These labels are also applied to dynamically-created ACME HTTP01 solver resources
25
# (pods, services, ingresses, or Gateway API HTTPRoutes).
26
# The following ACME identity label keys are reserved and will be
27
# silently ignored on dynamically-created resources: acme.cert-manager.io/http-domain,
28
# acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver.
29
# For per-Issuer-specific labels, use the HTTP01 ingress solver podTemplate and
30
# ingressTemplate fields for pod/ingress resources, or the gatewayHTTPRoute
31
# solver labels field for Gateway API HTTPRoute resources.
32
commonLabels: {}
33
# The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
34
# +docs:property
35
# revisionHistoryLimit: 1
36
37
# The optional priority class to be used for the cert-manager pods.
38
priorityClassName: ""
39
# Set all pods to run in a user namespace without host access.
40
# Experimental: may be removed once the Kubernetes User Namespaces feature is GA.
41
#
42
# Requirements:
43
# - Kubernetes ≥ 1.33, or
44
# - Kubernetes 1.27–1.32 with UserNamespacesSupport feature gate enabled.
45
#
46
# Set to false to run pods in a user namespace without host access.
47
#
48
# See [limitations](https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/#limitations) for details.
49
# +docs:property
50
# hostUsers: false
51
rbac:
52
# Create required ClusterRoles and ClusterRoleBindings for cert-manager.
53
create: true
54
# Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles)
55
aggregateClusterRoles: true
56
podSecurityPolicy:
57
# Create PodSecurityPolicy for cert-manager.
58
#
59
# Note that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25.
60
enabled: false
61
# Configure the PodSecurityPolicy to use AppArmor.
62
useAppArmor: true
63
# Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose.
64
logLevel: 2
65
leaderElection:
66
# Override the namespace used for the leader election lease.
67
namespace: "kube-system"
68
# The duration that non-leader candidates will wait after observing a
69
# leadership renewal until attempting to acquire leadership of a led but
70
# unrenewed leader slot. This is effectively the maximum duration that a
71
# leader can be stopped before it is replaced by another candidate.
72
# +docs:property
73
# leaseDuration: 60s
74
# The interval between attempts by the acting master to renew a leadership
75
# slot before it stops leading. This must be less than or equal to the
76
# lease duration.
77
# +docs:property
78
# renewDeadline: 40s
79
80
# The duration the clients should wait between attempting acquisition and
81
# renewal of a leadership.
82
# +docs:property
83
# retryPeriod: 15s
84
85
# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
86
#
87
# For example:
88
# runtimeClassName: gvisor
89
# +docs:property
90
runtimeClassName: ""
91
# This option is equivalent to setting crds.enabled=true and crds.keep=true.
92
# Deprecated: use crds.enabled and crds.keep instead.
93
installCRDs: false
94
crds:
95
# This option decides if the CRDs should be installed
96
# as part of the Helm installation.
97
enabled: false
98
# This option makes it so that the "helm.sh/resource-policy": keep
99
# annotation is added to the CRD. This will prevent Helm from uninstalling
100
# the CRD when the Helm release is uninstalled.
101
# WARNING: when the CRDs are removed, all cert-manager custom resources
102
# (Certificates, Issuers, ...) will be removed too by the garbage collector.
103
keep: true
104
# +docs:section=Controller
105
106
# The number of replicas of the cert-manager controller to run.
107
#
108
# The default is 1, but in production set this to 2 or 3 to provide high
109
# availability.
110
#
111
# If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.
112
#
113
# Note that cert-manager uses leader election to ensure that there can
114
# only be a single instance active at a time.
115
replicaCount: 1
116
# Deployment update strategy for the cert-manager controller deployment.
117
# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
118
#
119
# For example:
120
# strategy:
121
# type: RollingUpdate
122
# rollingUpdate:
123
# maxSurge: 0
124
# maxUnavailable: 1
125
strategy: {}
126
podDisruptionBudget:
127
# Enable or disable the PodDisruptionBudget resource.
128
#
129
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
130
# For example, the PodDisruptionBudget will block `kubectl drain`
131
# if it is used on the Node where the only remaining cert-manager
132
# Pod is currently running.
133
enabled: false
134
# This configures the minimum available pods for disruptions. It can either be set to
135
# an integer (e.g., 1) or a percentage value (e.g., 25%).
136
# It cannot be used if `maxUnavailable` is set.
137
# +docs:property
138
# +docs:type=unknown
139
# minAvailable: 1
140
# This configures the maximum unavailable pods for disruptions. It can either be set to
141
# an integer (e.g., 1) or a percentage value (e.g., 25%).
142
# it cannot be used if `minAvailable` is set.
143
# +docs:property
144
# +docs:type=unknown
145
# maxUnavailable: 1
146
147
# This configures how to act with unhealthy pods during eviction
148
# Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
149
# the cluster to work.
150
# +docs:property
151
# +docs:type=string
152
# unhealthyPodEvictionPolicy: AlwaysAllow
153
154
# A comma-separated list of feature gates that should be enabled on the
155
# controller pod.
156
featureGates: ""
157
# The maximum number of challenges that can be scheduled as 'processing' at once.
158
maxConcurrentChallenges: 60
159
# The container registry used for all cert-manager images by default.
160
# This can include path prefixes (e.g. `artifactory.example.com/docker`).
161
# +docs:property
162
imageRegistry: quay.io
163
# The repository namespace used for all cert-manager images by default.
164
# Examples:
165
# - jetstack
166
# - cert-manager
167
# +docs:property
168
imageNamespace: jetstack
169
image:
170
# Deprecated: per-component registry prefix.
171
#
172
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
173
# This applies both when `image.repository` is set and when the repository is computed from
174
# `imageRegistry` + `imageNamespace` + `image.name`.
175
#
176
# This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
177
# Prefer using the global `imageRegistry`/`imageNamespace` values.
178
# +docs:property
179
# registry: ""
180
181
# The image name for the cert-manager controller.
182
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
183
# +docs:property
184
name: cert-manager-controller
185
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
186
# Example: quay.io/jetstack/cert-manager-controller
187
# +docs:property
188
repository: chainguard-private/cert-manager-controller
189
# Override the image tag to deploy by setting this variable.
190
# If no value is set, the chart's appVersion is used.
191
# +docs:property
192
# tag: vX.Y.Z
193
194
# Setting a digest pins the image. If a tag is also set, the rendered reference will include
195
# both ("image:tag@digest"), though only the digest will be used for pulling.
196
# +docs:property
197
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
198
199
# Kubernetes imagePullPolicy on Deployment.
200
pullPolicy: IfNotPresent
201
registry: cgr.dev
202
tag: "1.21"
203
digest: sha256:0836b4c2eed4fee0f48898926e648f1c0bba78731f2a5ee4ab5cebf515ae0fc0
204
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
205
# resources. By default, the same namespace as cert-manager is deployed within is
206
# used. This namespace will not be automatically created by the Helm chart.
207
clusterResourceNamespace: ""
208
# This namespace allows you to define where the services are installed into.
209
# If not set then they use the namespace of the release.
210
# This is helpful when installing cert manager as a chart dependency (sub chart).
211
namespace: ""
212
# Override the "cert-manager.fullname" value. This value is used as part of
213
# most of the names of the resources created by this Helm chart.
214
# +docs:property
215
# fullnameOverride: "my-cert-manager"
216
217
# Override the "cert-manager.name" value, which is used to annotate some of
218
# the resources that are created by this Chart (using "app.kubernetes.io/name").
219
# NOTE: There are some inconsistencies in the Helm chart when it comes to
220
# these annotations (some resources use, e.g., "cainjector.name" which resolves
221
# to the value "cainjector").
222
# +docs:property
223
# nameOverride: "my-cert-manager"
224
serviceAccount:
225
# Specifies whether a service account should be created.
226
create: true
227
# The name of the service account to use.
228
# If not set and create is true, a name is generated using the fullname template.
229
# +docs:property
230
# name: ""
231
232
# Optional additional annotations to add to the controller's Service Account. Templates are allowed for both keys and values.
233
# Example using templating:
234
# annotations:
235
# "{{ .Chart.Name }}-helm-chart/version": "{{ .Chart.Version }}"
236
# +docs:property
237
# annotations: {}
238
239
# Optional additional labels to add to the controller's Service Account.
240
# +docs:property
241
# labels: {}
242
243
# Automount API credentials for a Service Account.
244
automountServiceAccountToken: true
245
# Automounting API credentials for a particular pod.
246
# +docs:property
247
# automountServiceAccountToken: true
248
249
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted.
250
enableCertificateOwnerRef: false
251
# This property is used to configure options for the controller pod.
252
# This allows setting options that would usually be provided using flags.
253
#
254
# If `apiVersion` and `kind` are unspecified they default to the current latest
255
# version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin
256
# the version by specifying the `apiVersion` yourself.
257
#
258
# For example:
259
# config:
260
# apiVersion: controller.config.cert-manager.io/v1alpha1
261
# kind: ControllerConfiguration
262
# logging:
263
# verbosity: 2
264
# format: text
265
# leaderElectionConfig:
266
# namespace: kube-system
267
# kubernetesAPIQPS: 9000
268
# kubernetesAPIBurst: 9000
269
# numberOfConcurrentWorkers: 200
270
# gatewayAPI:
271
# enable: true
272
# # Feature gates as of v1.20.0. Listed with their default values.
273
# # See https://cert-manager.io/docs/cli/controller/
274
# featureGates:
275
# AllAlpha: false # ALPHA - default=false
276
# AllBeta: false # BETA - default=false
277
# ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
278
# ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
279
# ExperimentalGatewayAPISupport: true # BETA - default=true
280
# LiteralCertificateSubject: true # BETA - default=true
281
# NameConstraints: true # BETA - default=true
282
# OtherNames: true # BETA - default=true
283
# SecretsFilteredCaching: true # BETA - default=true
284
# ServerSideApply: false # ALPHA - default=false
285
# StableCertificateRequestName: true # BETA - default=true
286
# UseCertificateRequestBasicConstraints: false # ALPHA - default=false
287
# # Configure the metrics server for TLS
288
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
289
# metricsTLSConfig:
290
# dynamic:
291
# secretNamespace: "cert-manager"
292
# secretName: "cert-manager-metrics-ca"
293
# dnsNames:
294
# - cert-manager-metrics
295
# # Configure PEM size limits for certificate validation
296
# # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
297
# pemSizeLimitsConfig:
298
# maxCertificateSize: 36500 # Maximum size in bytes for individual certificates (default: 36500)
299
# maxPrivateKeySize: 13000 # Maximum size in bytes for private keys (default: 13000)
300
# maxChainLength: 95000 # Maximum size in bytes for certificate chains (default: 95000)
301
# maxBundleSize: 330000 # Maximum size in bytes for certificate bundles (default: 330000)
302
# # Configure certificate request backoff durations
303
# certificateRequestMinimumBackoffDuration: 1h
304
# certificateRequestMaximumBackoffDuration: 32h
305
config: {}
306
# Setting Nameservers for DNS01 Self Check.
307
# For more information, see the [cert-manager documentation](https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check).
308
309
# A comma-separated string with the host and port of the recursive nameservers cert-manager should query.
310
dns01RecursiveNameservers: ""
311
# Forces cert-manager to use only the recursive nameservers for verification.
312
# Enabling this option could cause the DNS01 self check to take longer owing to caching performed by the recursive nameservers.
313
dns01RecursiveNameserversOnly: false
314
# Option to disable cert-manager's build-in auto-approver. The auto-approver
315
# approves all CertificateRequests that reference issuers matching the 'approveSignerNames'
316
# option. This 'disableAutoApproval' option is useful when you want to make all approval decisions
317
# using a different approver (like approver-policy - https://github.com/cert-manager/approver-policy).
318
disableAutoApproval: false
319
# List of signer names that cert-manager will approve by default. CertificateRequests
320
# referencing these signer names will be auto-approved by cert-manager. Defaults to just
321
# approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty
322
# array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval,
323
# because, e.g., you are using approver-policy, you can enable 'disableAutoApproval'.
324
# ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
325
# +docs:property
326
approveSignerNames:
327
- issuers.cert-manager.io/*
328
- clusterissuers.cert-manager.io/*
329
# Additional command line flags to pass to cert-manager controller binary.
330
# To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.
331
#
332
# Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.
333
#
334
# For example:
335
# extraArgs:
336
# - --controllers=*,-certificaterequests-approver
337
extraArgs: []
338
# Extra containers to add to the pod spec in the deployment of the cert-manager controller.
339
# For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
340
#
341
# extraEnv:
342
# - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
343
# - value: http://127.0.0.1:9911
344
# extraContainers:
345
# - name: rolesanywhere-credential-helper
346
# image: public.ecr.aws/rolesanywhere/credential-helper:latest
347
# command: [aws_signing_helper]
348
# args:
349
# - serve
350
# - --private-key
351
# - /etc/cert/tls.key
352
# - --certificate
353
# - /etc/cert/tls.crt
354
# - --role-arn
355
# - $ROLE_ARN
356
# - --profile-arn
357
# - $PROFILE_ARN
358
# - --trust-anchor-arn
359
# - $TRUST_ANCHOR_ARN
360
# volumeMounts:
361
# - name: cert
362
# mountPath: /etc/cert/
363
# readOnly: true
364
# volumes:
365
# - name: cert
366
# secret:
367
# secretName: cert
368
extraContainers: []
369
# Additional environment variables to pass to cert-manager controller binary.
370
# For example:
371
# extraEnv:
372
# - name: SOME_VAR
373
# value: 'some value'
374
extraEnv: []
375
# Resources to provide to the cert-manager controller pod.
376
#
377
# For example:
378
# requests:
379
# cpu: 10m
380
# memory: 32Mi
381
#
382
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
383
resources: {}
384
# Pod Security Context.
385
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
386
# +docs:property
387
securityContext:
388
runAsNonRoot: true
389
seccompProfile:
390
type: RuntimeDefault
391
# Container Security Context to be set on the controller component container.
392
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
393
# +docs:property
394
containerSecurityContext:
395
allowPrivilegeEscalation: false
396
capabilities:
397
drop:
398
- ALL
399
readOnlyRootFilesystem: true
400
# Additional volumes to add to the cert-manager controller pod.
401
volumes: []
402
# Additional volume mounts to add to the cert-manager controller container.
403
volumeMounts: []
404
# Optional additional annotations to add to the controller Deployment.
405
# +docs:property
406
# deploymentAnnotations: {}
407
408
# Optional additional annotations to add to the controller Pods.
409
# +docs:property
410
# podAnnotations: {}
411
412
# Optional additional labels to add to the controller Pods.
413
podLabels: {}
414
# Optional annotations to add to the controller Service.
415
# +docs:property
416
# serviceAnnotations: {}
417
418
# Optional additional labels to add to the controller Service.
419
# +docs:property
420
# serviceLabels: {}
421
422
# Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
423
# +docs:property
424
# serviceIPFamilyPolicy: ""
425
426
# Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
427
# +docs:property
428
# serviceIPFamilies: []
429
430
# Optional DNS settings. These are useful if you have a public and private DNS zone for
431
# the same domain on Route 53. The following is an example of ensuring
432
# cert-manager can access an ingress or DNS TXT records at all times.
433
# Note that this requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
434
# the cluster to work.
435
436
# Pod DNS policy.
437
# For more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
438
# +docs:property
439
# podDnsPolicy: "None"
440
441
# Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy
442
# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
443
# For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).
444
# +docs:property
445
# podDnsConfig:
446
# nameservers:
447
# - "1.1.1.1"
448
# - "8.8.8.8"
449
450
# Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks.
451
hostAliases: []
452
# - ip: 127.0.0.1
453
# hostnames:
454
# - foo.local
455
# - bar.local
456
# - ip: 10.1.2.3
457
# hostnames:
458
# - foo.remote
459
# - bar.remote
460
461
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
462
# matching labels.
463
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
464
#
465
# This default ensures that Pods are only scheduled to Linux nodes.
466
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
467
# +docs:property
468
nodeSelector:
469
kubernetes.io/os: linux
470
# Enables default network policies for cert-manager.
471
# This provides a way for you to restrict network traffic
472
# between cert-manager components and other pods.
473
# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
474
# NOTE: an incorrect networkPolicy will cause traffic to be dropped
475
networkPolicy:
476
# Create network policies for cert-manager.
477
enabled: false
478
# Ingress rule for the cert-manager network policy.
479
# By default all pods are allowed access to:
480
# http-metrics and http-healthz ports
481
# +docs:property
482
ingress:
483
- ports:
484
- port: http-metrics
485
protocol: TCP
486
- port: http-healthz
487
protocol: TCP
488
# Egress rule for the cert-manager network policy. By default, it allows all
489
# outbound traffic to ports 80 and 443, as well as DNS ports.
490
# +docs:property
491
egress:
492
- ports:
493
- port: 80
494
protocol: TCP
495
- port: 443
496
protocol: TCP
497
- port: 53
498
protocol: TCP
499
- port: 53
500
protocol: UDP
501
# On OpenShift and OKD, the Kubernetes API server listens on.
502
# port 6443.
503
- port: 6443
504
protocol: TCP
505
# +docs:ignore
506
ingressShim: {}
507
# Optional default issuer to use for ingress resources.
508
# +docs:property=ingressShim.defaultIssuerName
509
# defaultIssuerName: ""
510
511
# Optional default issuer kind to use for ingress resources.
512
# +docs:property=ingressShim.defaultIssuerKind
513
# defaultIssuerKind: ""
514
515
# Optional default issuer group to use for ingress resources.
516
# +docs:property=ingressShim.defaultIssuerGroup
517
# defaultIssuerGroup: ""
518
519
# Use these variables to configure the HTTP_PROXY environment variables.
520
521
# Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
522
# +docs:property
523
# http_proxy: "http://proxy:8080"
524
525
# Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
526
# +docs:property
527
# https_proxy: "https://proxy:8080"
528
529
# Configures the NO_PROXY environment variable where a HTTP proxy is required,
530
# but certain domains should be excluded.
531
# +docs:property
532
# no_proxy: 127.0.0.1,localhost
533
534
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
535
#
536
# For example:
537
# affinity:
538
# nodeAffinity:
539
# requiredDuringSchedulingIgnoredDuringExecution:
540
# nodeSelectorTerms:
541
# - matchExpressions:
542
# - key: foo.bar.com/role
543
# operator: In
544
# values:
545
# - master
546
affinity: {}
547
# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
548
#
549
# For example:
550
# runtimeClassName: gvisor
551
# +docs:property
552
runtimeClassName: ""
553
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
554
#
555
# For example:
556
# tolerations:
557
# - key: foo.bar.com/role
558
# operator: Equal
559
# value: master
560
# effect: NoSchedule
561
tolerations: []
562
# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
563
#
564
# For example:
565
# topologySpreadConstraints:
566
# - maxSkew: 2
567
# topologyKey: topology.kubernetes.io/zone
568
# whenUnsatisfiable: ScheduleAnyway
569
# labelSelector:
570
# matchLabels:
571
# app.kubernetes.io/instance: cert-manager
572
# app.kubernetes.io/component: controller
573
topologySpreadConstraints: []
574
# LivenessProbe settings for the controller container of the controller Pod.
575
#
576
# This is enabled by default, in order to enable the clock-skew liveness probe that
577
# restarts the controller in case of a skew between the system clock and the monotonic clock.
578
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
579
# controller-manager. For more information see the following on the
580
# [Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245)
581
# +docs:property
582
livenessProbe:
583
enabled: true
584
initialDelaySeconds: 10
585
periodSeconds: 10
586
timeoutSeconds: 15
587
successThreshold: 1
588
failureThreshold: 8
589
# enableServiceLinks indicates whether information about services should be
590
# injected into the pod's environment variables, matching the syntax of Docker
591
# links.
592
enableServiceLinks: false
593
# +docs:section=Prometheus
594
prometheus:
595
# Enable Prometheus monitoring for the cert-manager controller and webhook.
596
# If you use the Prometheus Operator, set prometheus.podmonitor.enabled or
597
# prometheus.servicemonitor.enabled, to create a PodMonitor or a
598
# ServiceMonitor resource.
599
# Otherwise, 'prometheus.io' annotations are added to the cert-manager and
600
# cert-manager-webhook Deployments.
601
# Note that you cannot enable both PodMonitor and ServiceMonitor as they are
602
# mutually exclusive. Enabling both will result in an error.
603
enabled: true
604
servicemonitor:
605
# Create a ServiceMonitor to add cert-manager to Prometheus.
606
enabled: false
607
# The namespace that the service monitor should live in, defaults
608
# to the cert-manager namespace.
609
# +docs:property
610
# namespace: cert-manager
611
612
# Specifies the `prometheus` label on the created ServiceMonitor. This is
613
# used when different Prometheus instances have label selectors matching
614
# different ServiceMonitors.
615
prometheusInstance: default
616
# The interval to scrape metrics.
617
interval: 60s
618
# The timeout before a metrics scrape fails.
619
scrapeTimeout: 30s
620
# Additional labels to add to the ServiceMonitor.
621
labels: {}
622
# Additional annotations to add to the ServiceMonitor.
623
annotations: {}
624
# Keep labels from scraped data, overriding server-side labels.
625
honorLabels: false
626
# EndpointAdditionalProperties allows setting additional properties on the
627
# endpoint such as relabelings, metricRelabelings etc.
628
#
629
# For example:
630
# endpointAdditionalProperties:
631
# relabelings:
632
# - action: replace
633
# sourceLabels:
634
# - __meta_kubernetes_pod_node_name
635
# targetLabel: instance
636
#
637
# +docs:property
638
endpointAdditionalProperties: {}
639
# Note that you cannot enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
640
podmonitor:
641
# Create a PodMonitor to add cert-manager to Prometheus.
642
enabled: false
643
# The namespace that the pod monitor should live in, defaults
644
# to the cert-manager namespace.
645
# +docs:property
646
# namespace: cert-manager
647
648
# Specifies the `prometheus` label on the created PodMonitor. This is
649
# used when different Prometheus instances have label selectors matching
650
# different PodMonitors.
651
prometheusInstance: default
652
# The interval to scrape metrics.
653
interval: 60s
654
# The timeout before a metrics scrape fails.
655
scrapeTimeout: 30s
656
# Additional labels to add to the PodMonitor.
657
labels: {}
658
# Additional annotations to add to the PodMonitor.
659
annotations: {}
660
# Keep labels from scraped data, overriding server-side labels.
661
honorLabels: false
662
# EndpointAdditionalProperties allows setting additional properties on the
663
# endpoint such as relabelings, metricRelabelings etc.
664
#
665
# For example:
666
# endpointAdditionalProperties:
667
# relabelings:
668
# - action: replace
669
# sourceLabels:
670
# - __meta_kubernetes_pod_node_name
671
# targetLabel: instance
672
# # Configure the PodMonitor for TLS connections
673
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
674
# scheme: https
675
# tlsConfig:
676
# serverName: cert-manager-metrics
677
# ca:
678
# secret:
679
# name: cert-manager-metrics-ca
680
# key: "tls.crt"
681
#
682
# +docs:property
683
endpointAdditionalProperties: {}
684
# +docs:section=Webhook
685
webhook:
686
# Number of replicas of the cert-manager webhook to run.
687
#
688
# The default is 1, but in production set this to 2 or 3 to provide high
689
# availability.
690
#
691
# If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.
692
replicaCount: 1
693
# The number of seconds the API server should wait for the webhook to respond before treating the call as a failure.
694
# The value must be between 1 and 30 seconds. For more information, see
695
# [Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).
696
#
697
# The default is set to the maximum value of 30 seconds as
698
# users sometimes report that the connection between the K8S API server and
699
# the cert-manager webhook server times out.
700
# If *this* timeout is reached, the error message will be "context deadline exceeded",
701
# which doesn't help the user diagnose what phase of the HTTPS connection timed out.
702
# For example, it could be during DNS resolution, TCP connection, TLS
703
# negotiation, HTTP negotiation, or slow HTTP response from the webhook
704
# server.
705
# By setting this timeout to its maximum value the underlying timeout error
706
# message has more chance of being returned to the end user.
707
timeoutSeconds: 30
708
# This is used to configure options for the webhook pod.
709
# This allows setting options that would usually be provided using flags.
710
#
711
# If `apiVersion` and `kind` are unspecified they default to the current latest
712
# version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin
713
# the version by specifying the `apiVersion` yourself.
714
#
715
# For example:
716
# apiVersion: webhook.config.cert-manager.io/v1alpha1
717
# kind: WebhookConfiguration
718
# # The port that the webhook listens on for requests.
719
# # In GKE private clusters, by default Kubernetes apiservers are allowed to
720
# # talk to the cluster nodes only on 443 and 10250. Configuring
721
# # securePort: 10250 therefore will work out-of-the-box without needing to add firewall
722
# # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.
723
# # This should be uncommented and set as a default by the chart once
724
# # the apiVersion of WebhookConfiguration graduates beyond v1alpha1.
725
# securePort: 10250
726
# # Configure the metrics server for TLS
727
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
728
# metricsTLSConfig:
729
# dynamic:
730
# secretNamespace: "cert-manager"
731
# secretName: "cert-manager-metrics-ca"
732
# dnsNames:
733
# - cert-manager-metrics
734
config: {}
735
# The update strategy for the cert-manager webhook deployment.
736
# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)
737
#
738
# For example:
739
# strategy:
740
# type: RollingUpdate
741
# rollingUpdate:
742
# maxSurge: 0
743
# maxUnavailable: 1
744
strategy: {}
745
# Pod Security Context to be set on the webhook component Pod.
746
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
747
# +docs:property
748
securityContext:
749
runAsNonRoot: true
750
seccompProfile:
751
type: RuntimeDefault
752
# Container Security Context to be set on the webhook component container.
753
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
754
# +docs:property
755
containerSecurityContext:
756
allowPrivilegeEscalation: false
757
capabilities:
758
drop:
759
- ALL
760
readOnlyRootFilesystem: true
761
podDisruptionBudget:
762
# Enable or disable the PodDisruptionBudget resource.
763
#
764
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
765
# For example, the PodDisruptionBudget will block `kubectl drain`
766
# if it is used on the Node where the only remaining cert-manager
767
# Pod is currently running.
768
enabled: false
769
# This property configures the minimum available pods for disruptions. Can either be set to
770
# an integer (e.g., 1) or a percentage value (e.g., 25%).
771
# It cannot be used if `maxUnavailable` is set.
772
# +docs:property
773
# +docs:type=unknown
774
# minAvailable: 1
775
# This property configures the maximum unavailable pods for disruptions. Can either be set to
776
# an integer (e.g., 1) or a percentage value (e.g., 25%).
777
# It cannot be used if `minAvailable` is set.
778
# +docs:property
779
# +docs:type=unknown
780
# maxUnavailable: 1
781
782
# This configures how to act with unhealthy pods during eviction
783
# Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
784
# the cluster to work.
785
# +docs:property
786
# +docs:type=string
787
# unhealthyPodEvictionPolicy: AlwaysAllow
788
789
# Optional additional annotations to add to the webhook Deployment.
790
# +docs:property
791
# deploymentAnnotations: {}
792
793
# Optional additional annotations to add to the webhook Pods.
794
# +docs:property
795
# podAnnotations: {}
796
797
# Optional additional annotations to add to the webhook Service.
798
# +docs:property
799
# serviceAnnotations: {}
800
801
# Optional additional annotations to add to the webhook MutatingWebhookConfiguration.
802
# +docs:property
803
# mutatingWebhookConfigurationAnnotations: {}
804
805
# Optional additional annotations to add to the webhook ValidatingWebhookConfiguration.
806
# +docs:property
807
# validatingWebhookConfigurationAnnotations: {}
808
validatingWebhookConfiguration:
809
# Configure spec.namespaceSelector for validating webhooks.
810
# +docs:property
811
namespaceSelector:
812
matchExpressions:
813
- key: "cert-manager.io/disable-validation"
814
operator: "NotIn"
815
values:
816
- "true"
817
mutatingWebhookConfiguration:
818
# Configure spec.namespaceSelector for mutating webhooks.
819
# +docs:property
820
namespaceSelector: {}
821
# matchLabels:
822
# key: value
823
# matchExpressions:
824
# - key: kubernetes.io/metadata.name
825
# operator: NotIn
826
# values:
827
# - kube-system
828
# Additional command line flags to pass to cert-manager webhook binary.
829
# To see all available flags run `docker run quay.io/jetstack/cert-manager-webhook:<version> --help`.
830
extraArgs: []
831
# Path to a file containing a WebhookConfiguration object used to configure the webhook.
832
# - --config=<path-to-config-file>
833
834
# Additional environment variables to pass to cert-manager webhook binary.
835
# For example:
836
# extraEnv:
837
# - name: SOME_VAR
838
# value: 'some value'
839
extraEnv: []
840
# Comma separated list of feature gates that should be enabled on the
841
# webhook pod.
842
featureGates: ""
843
# Resources to provide to the cert-manager webhook pod.
844
#
845
# For example:
846
# requests:
847
# cpu: 10m
848
# memory: 32Mi
849
#
850
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
851
resources: {}
852
# Liveness probe values.
853
# For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
854
#
855
# +docs:property
856
livenessProbe:
857
failureThreshold: 3
858
initialDelaySeconds: 60
859
periodSeconds: 10
860
successThreshold: 1
861
timeoutSeconds: 1
862
# Readiness probe values.
863
# For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
864
#
865
# +docs:property
866
readinessProbe:
867
failureThreshold: 3
868
initialDelaySeconds: 5
869
periodSeconds: 5
870
successThreshold: 1
871
timeoutSeconds: 1
872
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
873
# matching labels.
874
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
875
#
876
# This default ensures that Pods are only scheduled to Linux nodes.
877
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
878
# +docs:property
879
nodeSelector:
880
kubernetes.io/os: linux
881
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
882
#
883
# For example:
884
# affinity:
885
# nodeAffinity:
886
# requiredDuringSchedulingIgnoredDuringExecution:
887
# nodeSelectorTerms:
888
# - matchExpressions:
889
# - key: foo.bar.com/role
890
# operator: In
891
# values:
892
# - master
893
affinity: {}
894
# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
895
#
896
# For example:
897
# runtimeClassName: gvisor
898
# +docs:property
899
runtimeClassName: ""
900
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
901
#
902
# For example:
903
# tolerations:
904
# - key: foo.bar.com/role
905
# operator: Equal
906
# value: master
907
# effect: NoSchedule
908
tolerations: []
909
# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
910
#
911
# For example:
912
# topologySpreadConstraints:
913
# - maxSkew: 2
914
# topologyKey: topology.kubernetes.io/zone
915
# whenUnsatisfiable: ScheduleAnyway
916
# labelSelector:
917
# matchLabels:
918
# app.kubernetes.io/instance: cert-manager
919
# app.kubernetes.io/component: controller
920
topologySpreadConstraints: []
921
# Optional additional labels to add to the Webhook Pods.
922
podLabels: {}
923
# Optional additional labels to add to the Webhook Service.
924
serviceLabels: {}
925
# Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
926
serviceIPFamilyPolicy: ""
927
# Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
928
serviceIPFamilies: []
929
image:
930
# Deprecated: per-component registry prefix.
931
#
932
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
933
# This applies both when `webhook.image.repository` is set and when the repository is computed from
934
# `imageRegistry` + `imageNamespace` + `webhook.image.name`.
935
#
936
# This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
937
# Prefer using the global `imageRegistry`/`imageNamespace` values.
938
# +docs:property
939
# registry: ""
940
941
# The image name for the cert-manager webhook.
942
# +docs:property
943
name: cert-manager-webhook
944
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
945
# +docs:property
946
repository: chainguard-private/cert-manager-webhook
947
# Override the image tag to deploy by setting this variable.
948
# If no value is set, the chart's appVersion will be used.
949
# +docs:property
950
# tag: vX.Y.Z
951
952
# Setting a digest pins the image. If a tag is also set, the rendered reference will include
953
# both ("image:tag@digest"), though only the digest will be used for pulling.
954
# +docs:property
955
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
956
957
# Kubernetes imagePullPolicy on Deployment.
958
pullPolicy: IfNotPresent
959
registry: cgr.dev
960
tag: "1.21"
961
digest: sha256:101fb8d232526b4642fda783632f4bc0108cfbb0ed3ca37de49b749aa2cce3a7
962
serviceAccount:
963
# Specifies whether a service account should be created.
964
create: true
965
# The name of the service account to use.
966
# If not set and create is true, a name is generated using the fullname template.
967
# +docs:property
968
# name: ""
969
970
# Optional additional annotations to add to the webhook's Service Account.
971
# +docs:property
972
# annotations: {}
973
974
# Optional additional labels to add to the webhook's Service Account.
975
# +docs:property
976
# labels: {}
977
978
# Automount API credentials for a Service Account.
979
automountServiceAccountToken: true
980
# Automounting API credentials for a particular pod.
981
# +docs:property
982
# automountServiceAccountToken: true
983
984
# The port that the webhook listens on for requests.
985
# In GKE private clusters, by default Kubernetes apiservers are allowed to
986
# talk to the cluster nodes only on 443 and 10250. Configuring
987
# securePort: 10250, therefore will work out-of-the-box without needing to add firewall
988
# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
989
securePort: 10250
990
# Specifies if the webhook should be started in hostNetwork mode.
991
#
992
# Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
993
# CNI (such as calico), because control-plane managed by AWS cannot communicate
994
# with pods' IP CIDR and admission webhooks are not working
995
#
996
# Since the default port for the webhook conflicts with kubelet on the host
997
# network, `webhook.securePort` should be changed to an available port if
998
# running in hostNetwork mode.
999
hostNetwork: false
1000
# Specifies how the service should be handled. Useful if you want to expose the
1001
# webhook outside of the cluster. In some cases, the control plane cannot
1002
# reach internal services.
1003
serviceType: ClusterIP
1004
# Specify the load balancer IP for the created service.
1005
# +docs:property
1006
# loadBalancerIP: "10.10.10.10"
1007
1008
# Overrides the mutating webhook and validating webhook so they reach the webhook
1009
# service using the `url` field instead of a service.
1010
url: {}
1011
# host:
1012
1013
# Enables default network policies for webhooks.
1014
# This provides a way for you to restrict network traffic
1015
# between cert-manager components and other pods.
1016
# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
1017
# NOTE: an incorrect networkPolicy will cause traffic to be dropped
1018
networkPolicy:
1019
# Create network policies for the webhooks.
1020
enabled: false
1021
# Ingress rule for the webhook network policy.
1022
# By default all pods are allowed access to:
1023
# https, http-metrics, and http-healthz ports
1024
# +docs:property
1025
ingress:
1026
- ports:
1027
- port: https
1028
protocol: TCP
1029
- port: healthcheck
1030
protocol: TCP
1031
- port: http-metrics
1032
protocol: TCP
1033
# Egress rule for the webhook network policy. By default, it allows all
1034
# outbound traffic to ports 80 and 443, as well as DNS ports.
1035
# +docs:property
1036
egress:
1037
- ports:
1038
- port: 80
1039
protocol: TCP
1040
- port: 443
1041
protocol: TCP
1042
- port: 53
1043
protocol: TCP
1044
- port: 53
1045
protocol: UDP
1046
# On OpenShift and OKD, the Kubernetes API server listens on.
1047
# port 6443.
1048
- port: 6443
1049
protocol: TCP
1050
# Additional volumes to add to the cert-manager controller pod.
1051
volumes: []
1052
# Additional volume mounts to add to the cert-manager controller container.
1053
volumeMounts: []
1054
# enableServiceLinks indicates whether information about services should be
1055
# injected into the pod's environment variables, matching the syntax of Docker
1056
# links.
1057
enableServiceLinks: false
1058
# enableClientVerification turns on client verification of requests
1059
# made to the webhook server
1060
enableClientVerification: false
1061
# the client CA file to be used for verification
1062
clientCAFile: ""
1063
# Subject names to verify for the client certificate.
1064
# Multiple values may be supplied as a comma-separated list.
1065
apiserverClientCertSubjects: ""
1066
# +docs:section=CA Injector
1067
cainjector:
1068
# Create the CA Injector deployment
1069
enabled: true
1070
# The number of replicas of the cert-manager cainjector to run.
1071
#
1072
# The default is 1, but in production set this to 2 or 3 to provide high
1073
# availability.
1074
#
1075
# If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.
1076
#
1077
# Note that cert-manager uses leader election to ensure that there can
1078
# only be a single instance active at a time.
1079
replicaCount: 1
1080
# This is used to configure options for the cainjector pod.
1081
# It allows setting options that are usually provided via flags.
1082
#
1083
# If `apiVersion` and `kind` are unspecified they default to the current latest
1084
# version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin
1085
# the version by specifying the `apiVersion` yourself.
1086
#
1087
# For example:
1088
# apiVersion: cainjector.config.cert-manager.io/v1alpha1
1089
# kind: CAInjectorConfiguration
1090
# logging:
1091
# verbosity: 2
1092
# format: text
1093
# leaderElectionConfig:
1094
# namespace: kube-system
1095
# # Configure the metrics server for TLS
1096
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
1097
# metricsTLSConfig:
1098
# dynamic:
1099
# secretNamespace: "cert-manager"
1100
# secretName: "cert-manager-metrics-ca"
1101
# dnsNames:
1102
# - cert-manager-metrics
1103
config: {}
1104
# Deployment update strategy for the cert-manager cainjector deployment.
1105
# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
1106
#
1107
# For example:
1108
# strategy:
1109
# type: RollingUpdate
1110
# rollingUpdate:
1111
# maxSurge: 0
1112
# maxUnavailable: 1
1113
strategy: {}
1114
# Pod Security Context to be set on the cainjector component Pod
1115
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
1116
# +docs:property
1117
securityContext:
1118
runAsNonRoot: true
1119
seccompProfile:
1120
type: RuntimeDefault
1121
# Container Security Context to be set on the cainjector component container
1122
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
1123
# +docs:property
1124
containerSecurityContext:
1125
allowPrivilegeEscalation: false
1126
capabilities:
1127
drop:
1128
- ALL
1129
readOnlyRootFilesystem: true
1130
# Enables default network policies for cainjector.
1131
# This provides a way for you to restrict network traffic
1132
# between cert-manager components and other pods.
1133
# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
1134
# NOTE: an incorrect networkPolicy will cause traffic to be dropped
1135
networkPolicy:
1136
# Create network policies for the cainjector.
1137
enabled: false
1138
# Ingress rule for the webhook cainjector policy.
1139
# By default all pods are allowed access to:
1140
# http-metrics port
1141
# +docs:property
1142
ingress:
1143
- ports:
1144
- port: http-metrics
1145
protocol: TCP
1146
# Egress rule for the cainjector network policy. By default, it allows all
1147
# outbound traffic to ports 80 and 443, as well as DNS ports.
1148
# +docs:property
1149
egress:
1150
- ports:
1151
- port: 80
1152
protocol: TCP
1153
- port: 443
1154
protocol: TCP
1155
- port: 53
1156
protocol: TCP
1157
- port: 53
1158
protocol: UDP
1159
# On OpenShift and OKD, the Kubernetes API server listens on.
1160
# port 6443.
1161
- port: 6443
1162
protocol: TCP
1163
podDisruptionBudget:
1164
# Enable or disable the PodDisruptionBudget resource.
1165
#
1166
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
1167
# For example, the PodDisruptionBudget will block `kubectl drain`
1168
# if it is used on the Node where the only remaining cert-manager
1169
# Pod is currently running.
1170
enabled: false
1171
# `minAvailable` configures the minimum available pods for disruptions. It can either be set to
1172
# an integer (e.g., 1) or a percentage value (e.g., 25%).
1173
# Cannot be used if `maxUnavailable` is set.
1174
# +docs:property
1175
# +docs:type=unknown
1176
# minAvailable: 1
1177
# `maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to
1178
# an integer (e.g., 1) or a percentage value (e.g., 25%).
1179
# Cannot be used if `minAvailable` is set.
1180
# +docs:property
1181
# +docs:type=unknown
1182
# maxUnavailable: 1
1183
1184
# This configures how to act with unhealthy pods during eviction
1185
# Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
1186
# the cluster to work.
1187
# +docs:property
1188
# +docs:type=string
1189
# unhealthyPodEvictionPolicy: AlwaysAllow
1190
1191
# Optional additional annotations to add to the cainjector Deployment.
1192
# +docs:property
1193
# deploymentAnnotations: {}
1194
1195
# Optional additional annotations to add to the cainjector Pods.
1196
# +docs:property
1197
# podAnnotations: {}
1198
1199
# Optional additional annotations to add to the cainjector metrics Service.
1200
# +docs:property
1201
# serviceAnnotations: {}
1202
1203
# Additional command line flags to pass to cert-manager cainjector binary.
1204
# To see all available flags run `docker run quay.io/jetstack/cert-manager-cainjector:<version> --help`.
1205
extraArgs: []
1206
# Enable profiling for cainjector.
1207
# - --enable-profiling=true
1208
1209
# Additional environment variables to pass to cert-manager cainjector binary.
1210
# For example:
1211
# extraEnv:
1212
# - name: SOME_VAR
1213
# value: 'some value'
1214
extraEnv: []
1215
# Comma separated list of feature gates that should be enabled on the
1216
# cainjector pod.
1217
featureGates: ""
1218
# Resources to provide to the cert-manager cainjector pod.
1219
#
1220
# For example:
1221
# requests:
1222
# cpu: 10m
1223
# memory: 32Mi
1224
#
1225
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
1226
resources: {}
1227
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
1228
# matching labels.
1229
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
1230
#
1231
# This default ensures that Pods are only scheduled to Linux nodes.
1232
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
1233
# +docs:property
1234
nodeSelector:
1235
kubernetes.io/os: linux
1236
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
1237
#
1238
# For example:
1239
# affinity:
1240
# nodeAffinity:
1241
# requiredDuringSchedulingIgnoredDuringExecution:
1242
# nodeSelectorTerms:
1243
# - matchExpressions:
1244
# - key: foo.bar.com/role
1245
# operator: In
1246
# values:
1247
# - master
1248
affinity: {}
1249
# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
1250
#
1251
# For example:
1252
# runtimeClassName: gvisor
1253
# +docs:property
1254
runtimeClassName: ""
1255
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
1256
#
1257
# For example:
1258
# tolerations:
1259
# - key: foo.bar.com/role
1260
# operator: Equal
1261
# value: master
1262
# effect: NoSchedule
1263
tolerations: []
1264
# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
1265
#
1266
# For example:
1267
# topologySpreadConstraints:
1268
# - maxSkew: 2
1269
# topologyKey: topology.kubernetes.io/zone
1270
# whenUnsatisfiable: ScheduleAnyway
1271
# labelSelector:
1272
# matchLabels:
1273
# app.kubernetes.io/instance: cert-manager
1274
# app.kubernetes.io/component: controller
1275
topologySpreadConstraints: []
1276
# Optional additional labels to add to the CA Injector Pods.
1277
podLabels: {}
1278
# Optional additional labels to add to the CA Injector metrics Service.
1279
serviceLabels: {}
1280
image:
1281
# Deprecated: per-component registry prefix.
1282
#
1283
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
1284
# This applies both when `cainjector.image.repository` is set and when the repository is computed from
1285
# `imageRegistry` + `imageNamespace` + `cainjector.image.name`.
1286
#
1287
# This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
1288
# Prefer using the global `imageRegistry`/`imageNamespace` values.
1289
# +docs:property
1290
# registry: ""
1291
1292
# The image name for the cert-manager cainjector.
1293
# +docs:property
1294
name: cert-manager-cainjector
1295
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
1296
# +docs:property
1297
repository: chainguard-private/cert-manager-cainjector
1298
# Override the image tag to deploy by setting this variable.
1299
# If no value is set, the chart's appVersion will be used.
1300
# +docs:property
1301
# tag: vX.Y.Z
1302
1303
# Setting a digest pins the image. If a tag is also set, the rendered reference will include
1304
# both ("image:tag@digest"), though only the digest will be used for pulling.
1305
# +docs:property
1306
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
1307
1308
# Kubernetes imagePullPolicy on Deployment.
1309
pullPolicy: IfNotPresent
1310
registry: cgr.dev
1311
tag: "1.21"
1312
digest: sha256:1a02bffeeb9a86a857db57b55fb404a03301d2e41a456bca504bd1c28f7548d2
1313
serviceAccount:
1314
# Specifies whether a service account should be created.
1315
create: true
1316
# The name of the service account to use.
1317
# If not set and create is true, a name is generated using the fullname template
1318
# +docs:property
1319
# name: ""
1320
1321
# Optional additional annotations to add to the cainjector's Service Account.
1322
# +docs:property
1323
# annotations: {}
1324
1325
# Optional additional labels to add to the cainjector's Service Account.
1326
# +docs:property
1327
# labels: {}
1328
1329
# Automount API credentials for a Service Account.
1330
automountServiceAccountToken: true
1331
# Automounting API credentials for a particular pod.
1332
# +docs:property
1333
# automountServiceAccountToken: true
1334
1335
# Additional volumes to add to the cert-manager controller pod.
1336
volumes: []
1337
# Additional volume mounts to add to the cert-manager controller container.
1338
volumeMounts: []
1339
# enableServiceLinks indicates whether information about services should be
1340
# injected into the pod's environment variables, matching the syntax of Docker
1341
# links.
1342
enableServiceLinks: false
1343
# +docs:section=ACME Solver
1344
acmesolver:
1345
image:
1346
# Deprecated: per-component registry prefix.
1347
#
1348
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
1349
# This applies both when `acmesolver.image.repository` is set and when the repository is computed from
1350
# `imageRegistry` + `imageNamespace` + `acmesolver.image.name`.
1351
#
1352
# This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
1353
# Prefer using the global `imageRegistry`/`imageNamespace` values.
1354
# +docs:property
1355
# registry: ""
1356
1357
# The image name for the cert-manager acmesolver.
1358
# +docs:property
1359
name: cert-manager-acmesolver
1360
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
1361
# +docs:property
1362
repository: chainguard-private/cert-manager-acmesolver
1363
# Override the image tag to deploy by setting this variable.
1364
# If no value is set, the chart's appVersion is used.
1365
# +docs:property
1366
# tag: vX.Y.Z
1367
1368
# Setting a digest pins the image. If a tag is also set, the rendered reference will include
1369
# both ("image:tag@digest"), though only the digest will be used for pulling.
1370
# +docs:property
1371
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
1372
1373
# Kubernetes imagePullPolicy on Deployment.
1374
pullPolicy: IfNotPresent
1375
registry: cgr.dev
1376
tag: "1.21"
1377
digest: sha256:08b6708101f3522271e4012f8977f0a0de2c42a247be17d5fc21e24b258e390b
1378
# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
1379
#
1380
# For example:
1381
# runtimeClassName: gvisor
1382
# +docs:property
1383
runtimeClassName: ""
1384
# +docs:section=Startup API Check
1385
# This startupapicheck is a Helm post-install hook that waits for the webhook
1386
# endpoints to become available.
1387
# The check is implemented using a Kubernetes Job - if you are injecting mesh
1388
# sidecar proxies into cert-manager pods, ensure that they
1389
# are not injected into this Job's pod. Otherwise, the installation may time out
1390
# owing to the Job never being completed because the sidecar proxy does not exit.
1391
# For more information, see [this note](https://github.com/cert-manager/cert-manager/pull/4414).
1392
startupapicheck:
1393
# Enables the startup api check.
1394
enabled: true
1395
# Pod Security Context to be set on the startupapicheck component Pod.
1396
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
1397
# +docs:property
1398
securityContext:
1399
runAsNonRoot: true
1400
seccompProfile:
1401
type: RuntimeDefault
1402
# Container Security Context to be set on the controller component container.
1403
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
1404
# +docs:property
1405
containerSecurityContext:
1406
allowPrivilegeEscalation: false
1407
capabilities:
1408
drop:
1409
- ALL
1410
readOnlyRootFilesystem: true
1411
# Timeout for 'kubectl check api' command.
1412
timeout: 1m
1413
# Job backoffLimit
1414
backoffLimit: 4
1415
# Limits the lifetime of a Job that has finished execution (either Complete
1416
# or Failed). If this field is set, once the Job finishes, it will be
1417
# automatically cleaned up after ttlSecondsAfterFinished seconds. This is
1418
# disabled by default (field is not set) to preserve backward compatibility
1419
# and avoid issues with GitOps tools (e.g. Argo CD) that may attempt to
1420
# reconcile or recreate Jobs after they are automatically deleted.
1421
# For more information, see [Automatic Cleanup for Finished Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/).
1422
# +docs:property
1423
# +docs:type=integer
1424
# ttlSecondsAfterFinished:
1425
1426
# Optional additional annotations to add to the startupapicheck Job.
1427
# +docs:property
1428
jobAnnotations:
1429
helm.sh/hook: post-install
1430
helm.sh/hook-weight: "1"
1431
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
1432
# Optional additional annotations to add to the startupapicheck Pods.
1433
# +docs:property
1434
# podAnnotations: {}
1435
1436
# Additional command line flags to pass to startupapicheck binary.
1437
# To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.
1438
#
1439
# Verbose logging is enabled by default so that if startupapicheck fails, you
1440
# can know what exactly caused the failure. Verbose logs include details of
1441
# the webhook URL, IP address and TCP connect errors for example.
1442
# +docs:property
1443
extraArgs:
1444
- -v
1445
# Additional environment variables to pass to cert-manager startupapicheck binary.
1446
# For example:
1447
# extraEnv:
1448
# - name: SOME_VAR
1449
# value: 'some value'
1450
extraEnv: []
1451
# Resources to provide to the cert-manager startupapicheck pod.
1452
#
1453
# For example:
1454
# requests:
1455
# cpu: 10m
1456
# memory: 32Mi
1457
#
1458
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
1459
resources: {}
1460
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
1461
# matching labels.
1462
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
1463
#
1464
# This default ensures that Pods are only scheduled to Linux nodes.
1465
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
1466
# +docs:property
1467
nodeSelector:
1468
kubernetes.io/os: linux
1469
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
1470
# For example:
1471
# affinity:
1472
# nodeAffinity:
1473
# requiredDuringSchedulingIgnoredDuringExecution:
1474
# nodeSelectorTerms:
1475
# - matchExpressions:
1476
# - key: foo.bar.com/role
1477
# operator: In
1478
# values:
1479
# - master
1480
affinity: {}
1481
# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
1482
#
1483
# For example:
1484
# runtimeClassName: gvisor
1485
# +docs:property
1486
runtimeClassName: ""
1487
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
1488
#
1489
# For example:
1490
# tolerations:
1491
# - key: foo.bar.com/role
1492
# operator: Equal
1493
# value: master
1494
# effect: NoSchedule
1495
tolerations: []
1496
# Optional additional labels to add to the startupapicheck Pods.
1497
podLabels: {}
1498
image:
1499
# Deprecated: per-component registry prefix.
1500
#
1501
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
1502
# This applies both when `startupapicheck.image.repository` is set and when the repository is computed from
1503
# `imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.
1504
#
1505
# This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
1506
# Prefer using the global `imageRegistry`/`imageNamespace` values.
1507
# +docs:property
1508
# registry: ""
1509
1510
# The image name for the cert-manager startupapicheck.
1511
# +docs:property
1512
name: cert-manager-startupapicheck
1513
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
1514
# +docs:property
1515
repository: chainguard-private/cert-manager-startupapicheck
1516
# Override the image tag to deploy by setting this variable.
1517
# If no value is set, the chart's appVersion is used.
1518
# +docs:property
1519
# tag: vX.Y.Z
1520
1521
# Setting a digest pins the image. If a tag is also set, the rendered reference will include
1522
# both ("image:tag@digest"), though only the digest will be used for pulling.
1523
# +docs:property
1524
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
1525
1526
# Kubernetes imagePullPolicy on Deployment.
1527
pullPolicy: IfNotPresent
1528
registry: cgr.dev
1529
tag: "1.21"
1530
digest: sha256:2fb204e0a252e806572c62c93c931a6542cf24f9f9c4366719504c81899bde24
1531
rbac:
1532
# annotations for the startup API Check job RBAC and PSP resources.
1533
# +docs:property
1534
annotations:
1535
helm.sh/hook: post-install
1536
helm.sh/hook-weight: "-5"
1537
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
1538
# Automounting API credentials for a particular pod.
1539
# +docs:property
1540
# automountServiceAccountToken: true
1541
serviceAccount:
1542
# Specifies whether a service account should be created.
1543
create: true
1544
# The name of the service account to use.
1545
# If not set and create is true, a name is generated using the fullname template.
1546
# +docs:property
1547
# name: ""
1548
1549
# Optional additional annotations to add to the Job's Service Account.
1550
# +docs:property
1551
annotations:
1552
helm.sh/hook: post-install
1553
helm.sh/hook-weight: "-5"
1554
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
1555
# Automount API credentials for a Service Account.
1556
# +docs:property
1557
automountServiceAccountToken: true
1558
# Optional additional labels to add to the startupapicheck's Service Account.
1559
# +docs:property
1560
# labels: {}
1561
# Additional volumes to add to the cert-manager controller pod.
1562
volumes: []
1563
# Additional volume mounts to add to the cert-manager controller container.
1564
volumeMounts: []
1565
# enableServiceLinks indicates whether information about services should be
1566
# injected into pod's environment variables, matching the syntax of Docker
1567
# links.
1568
enableServiceLinks: false
1569
# Create dynamic manifests via values.
1570
#
1571
# For example:
1572
# extraObjects:
1573
# - |
1574
# apiVersion: v1
1575
# kind: ConfigMap
1576
# metadata:
1577
# name: '{{ template "cert-manager.fullname" . }}-extra-configmap'
1578
extraObjects: []
1579
# Field used by our release pipeline to produce the static manifests.
1580
# The field defaults to "helm" but is set to "static" when we render
1581
# the static YAML manifests.
1582
# +docs:hidden
1583
creator: "helm"
1584
# Field that can be used as a condition when cert-manager is a dependency.
1585
# This definition is only here as a placeholder such that it is included in
1586
# the json schema.
1587
# See https://helm.sh/docs/chart_best_practices/dependencies/#conditions-and-tags
1588
# for more info.
1589
# +docs:hidden
1590
enabled: true
1591
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.