kubelet-csr-approver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
global:
2
clusterDomain: cluster.local
3
# Required configuration item
4
providerRegex: ""
5
# optional, specified as a string (enclosed with ""). if left empty, defaults to 367 days
6
maxExpirationSeconds: ""
7
# optional, permits to bypass dns resolution checks. default: false
8
bypassDnsResolution: false
9
# number of DNS SAN names allowed in a certificate request. defaults to 1
10
allowedDnsNames: 1
11
# optional, permits ignoring CSRs with another Username than `system:node:...`
12
ignoreNonSystemNode: false
13
# optional, prevents csr denial, i.e. only lets kubelet-csr-approver approve valid CSRs but ignore other CSRs
14
skipDenyStep: false
15
# set this parameter to true to ignore mismatching DNS name and hostname
16
bypassHostnameCheck: false
17
# optional, list of IP (IPv4, IPv6) subnets that are allowed to submit CSRs
18
providerIpPrefixes: []
19
# - 192.168.8.0/22
20
# - fc00::/7
21
22
# logging level ranges from -5 (Fatal) to 10 (Verbose). default level is 0
23
loggingLevel: 0
24
leaderElection: true
25
replicas: 2
26
namespace: ""
27
image:
28
repository: cgr.dev/chainguard-private/kubelet-csr-approver
29
pullPolicy: IfNotPresent
30
# Overrides the image tag whose default is the chart appVersion.
31
tag: 1.2.15@sha256:de38c8bd5db66c8985e7d1c47fc9aa3cdf0f47425a71fbef780cb3096e722af0
32
imagePullSecrets: []
33
nameOverride: ""
34
fullnameOverride: ""
35
metrics:
36
enable: true
37
serviceType: ClusterIP
38
port: 8080
39
nodePort: ""
40
annotations: {}
41
serviceMonitor:
42
enabled: false
43
additionalLabels: {}
44
interval: 1m
45
scrapeTimeout: 10s
46
metricRelabelings: []
47
relabelings: []
48
serviceAccount:
49
# Specifies whether a service account should be created
50
create: true
51
# Annotations to add to the service account
52
annotations: {}
53
# The name of the service account to use.
54
# If not set and create is true, a name is generated using the fullname template
55
name: ""
56
podAnnotations: {}
57
podLabels: {}
58
# PriorityClass indicates the importance of a Pod relative to other Pods.
59
priorityClassName: ""
60
podSecurityContext: {}
61
# fsGroup: 65532
62
63
securityContext:
64
runAsUser: 65532
65
runAsGroup: 65532
66
runAsNonRoot: true
67
privileged: false
68
allowPrivilegeEscalation: false
69
readOnlyRootFilesystem: true
70
seccompProfile:
71
type: RuntimeDefault
72
capabilities:
73
drop: ["ALL"]
74
resources:
75
requests:
76
memory: "64Mi"
77
cpu: "100m"
78
limits:
79
memory: "128Mi"
80
cpu: "500m"
81
nodeSelector: {}
82
tolerations:
83
- effect: NoSchedule
84
key: node-role.kubernetes.io/control-plane
85
operator: Equal
86
affinity: {}
87
rbac:
88
manage: true
89
# Additional environment variables
90
env: []
91
# - name: FOO
92
# value: bar
93
94
dnsPolicy: ""
95
dnsConfig: {}
96
# Include additional objects within the chart
97
extraObjects: []
98
# - |
99
# apiVersion: v1
100
# kind: Secret
101
# metadata:
102
# name: my-special-secret
103
# data:
104
# key: value
105
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.