x509-certificate-exporter

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# -- Partially override x509-certificate-exporter.fullname template (will prepend the release name)

nameOverride: ""

# -- Fully override x509-certificate-exporter.fullname template

fullnameOverride: ""

# -- Override the deployment namespace

namespaceOverride: ""

# @schema

# type: array

# items: {type: [object, string]}

# @schema

# -- Additional objects to deploy with the release

extraDeploy: []

# @schema

# type: array

# items: {type: [object, string]}

# @schema

# -- Same as `extraDeploy` but objects won't go through the templating engine

extraDeployVerbatim: []

# @schema

# type: array

# items: {type: object}

# @schema

# -- Specify docker-registry secret names as an array

imagePullSecrets: []

image:

# -- Exporter image registry. Empty string opts out of the registry prefix and lets the CRI fall back to its configured default (typically docker.io).

registry: cgr.dev

# @schema

# type: string

# minLength: 1

# @schema

# -- Exporter image repository

repository: scratch-images/test-tmp/x509-certificate-exporter-fips

# -- Exporter image tag (defaults to Chart appVersion)

tag: 4.2.0-r4

# -- Appended to the image tag to select a container flavor. Use `-busybox` for a shell-enabled image

tagSuffix: ""

# -- Exporter image digest. When set, takes precedence over `tag` (immutable reference)

digest: sha256:4c614542f017ca7538478a362663c1e10f837b352f46a95e3ad3854f7abc8a82

# @schema

# enum: [Always, IfNotPresent, Never]

# @schema

# -- Exporter image pull policy

pullPolicy: IfNotPresent

migration:

image:

# -- kubectl image registry

registry: cgr.dev

# -- kubectl image repository

repository: scratch-images/test-tmp/kubectl-fips

# -- kubectl image tag. When set, takes precedence over the auto-detected cluster version.

tag: 1.36.4-r3

# -- kubectl image digest. When set, takes precedence over `tag` (immutable reference)

digest: sha256:e6277609e7a52d8a60b59ec460b5011d04ca11c261f63f344b16e30c5b31e5db

# @schema

# enum: [Always, IfNotPresent, Never]

# @schema

# -- kubectl image pull policy

pullPolicy: IfNotPresent

# @schema

# type: object

# additionalProperties: {type: string}

# @schema

# -- Annotations added to Helm hook Pods

annotations: {}

# @schema

# type: object

# additionalProperties: {type: string}

# @schema

# -- Additional labels added to Helm hook Pods

extraLabels: {}

# @schema

# type: object

# additionalProperties: true

# properties: {}

# @schema

# -- ResourceRequirements for containers of Helm hooks

# @default -- see `values.yaml`

resources:

limits:

cpu: 1

memory: 150Mi

requests:

cpu: 20m

memory: 20Mi

# @schema

# type: object

# additionalProperties: true

# properties: {}

# @schema

# -- PodSecurityContext for Pods of Helm hooks

# @default -- see `values.yaml`

podSecurityContext:

runAsNonRoot: true

seccompProfile:

type: RuntimeDefault

# @schema

# type: object

# additionalProperties: true

100

# properties: {}

101

# @schema

102

# -- SecurityContext for containers of Helm hooks

103

# @default -- see `values.yaml`

104

securityContext:

105

runAsUser: 65534

106

runAsGroup: 65534

107

readOnlyRootFilesystem: true

108

allowPrivilegeEscalation: false

109

capabilities:

110

drop:

111

- ALL

112

# -- Enable additional metrics to report per-certificate errors ; helps with identifying the origin of read errors without having to look at exporter logs, at the expense of additional storage on Prometheus

113

exposePerCertificateErrorMetrics: false

114

# -- Enable additional metrics with relative durations instead of absolute timestamps ; not recommended with Prometheus

115

exposeRelativeMetrics: false

116

# -- Expose `x509_cert_not_before` (Unix timestamp of the certificate's NotBefore). Off by default — most users only alert on expiry; enable if you specifically need to detect "issued in the future" misconfigurations or clock skew.

117

exposeNotBeforeMetric: false

118

# -- Expose `x509_cert_expired` (1 if the certificate is expired, 0 otherwise). On by default ; turn off to halve the per-cert series count if you only alert on `x509_cert_not_after - time()`.

119

exposeExpiredMetric: true

120

# -- Expose self-introspection metrics for debugging the exporter itself (`x509_parse_duration_seconds`, `x509_kube_request_duration_seconds`, `x509_kube_informer_scope`, `x509_informer_queue_depth`). Off by default ; enable when you actually need to look inside.

121

exposeDiagnosticMetrics: false

122

# @schema

123

# type: [array, 'null']

124

# items: {type: string}

125

# @schema

126

# -- (list) Restrict metric labels to this list if set. **Warning** : use with caution as reducing cardinality may yield metrics collisions and force the exporter to ignore certificates. This will also degrade the usability of the Grafana dashboard. This list should always include at least `filepath`, `secret_namespace` and `secret_name`. Also `subject_CN` is highly recommended for when a file contains multiple certificates.

127

metricLabelsFilterList: null

128

grafana:

129

# -- Should the Grafana dashboard be deployed as a ConfigMap (requires Grafana sidecar)

130

createDashboard: false

131

# -- ConfigMap label name the Grafana sidecar is looking for

132

sidecarLabel: grafana_dashboard

133

# -- ConfigMap label value the Grafana sidecar is looking for

134

sidecarLabelValue: "1"

135

# @schema

136

# type: object

137

# additionalProperties: {type: string}

138

# @schema

139

# -- Annotations added to the Grafana dashboard ConfigMap (example in `values.yaml`)

140

annotations: {}

141

# k8s-sidecar-target-directory: "/tmp/dashboards/Example"

142

# @schema

143

# type: object

144

# additionalProperties: {type: string}

145

# @schema

146

# -- Additional labels added to the Grafana dashboard ConfigMap

147

extraLabels: {}

148

secretsExporter:

149

# -- Should the TLS Secrets exporter be running

150

enabled: true

151

# @schema

152

# type: object

153

# additionalProperties: {type: string}

154

# @schema

155

# -- Additional Deployment annotations

156

annotations: {}

157

# -- Should debug messages be produced by the TLS Secrets exporter

158

debugMode: false

159

# @schema

160

# type: integer

161

# minimum: 1

162

# @schema

163

# -- Desired number of TLS Secrets exporter Pods

164

replicas: 1

165

# @schema

166

# enum: [Always]

167

# @schema

168

# -- restartPolicy for Pods of the TLS Secrets exporter

169

restartPolicy: Always

170

# @schema

171

# type: object

172

# additionalProperties: true

173

# @schema

174

# -- DeploymentStrategy for the TLS Secrets exporter

175

strategy: {}

176

# @schema

177

# type: [integer, 'null']

178

# @schema

179

# -- (int) Number of old ReplicaSets to retain for rollback

180

revisionHistoryLimit:

181

# @schema

182

# type: object

183

# additionalProperties: true

184

# properties: {}

185

# @schema

186

# -- ResourceRequirements for containers of the TLS Secrets exporter

187

# @default -- see `values.yaml`

188

resources:

189

limits:

190

cpu: 1

191

memory: 150Mi

192

requests:

193

cpu: 20m

194

memory: 20Mi

195

# @schema

196

# type: object

197

# additionalProperties: true

198

# properties: {}

199

# @schema

200

# -- Readiness probe definition for the secrets exporter (.httpGet cannot be changed)

201

# @default -- see `values.yaml`

202

readinessProbe:

203

initialDelaySeconds: 5

204

periodSeconds: 3

205

# @schema

206

# type: object

207

# additionalProperties: true

208

# properties: {}

209

# @schema

210

# -- Liveness probe definition for the secrets exporter (.httpGet cannot be changed)

211

# @default -- see `values.yaml`

212

livenessProbe:

213

initialDelaySeconds: 5

214

periodSeconds: 3

215

# @schema

216

# type: object

217

# additionalProperties: {type: string}

218

# @schema

219

# -- Node selector for Pods of the TLS Secrets exporter

220

nodeSelector: {}

221

# @schema

222

# type: array

223

# items: {type: object}

224

# @schema

225

# -- Tolerations for Pods of the TLS Secrets exporter

226

tolerations: []

227

# @schema

228

# type: object

229

# additionalProperties: true

230

# @schema

231

# -- Affinity for Pods of the TLS Secrets exporter

232

affinity: {}

233

# -- PriorityClassName for Pods of the TLS Secrets exporter

234

priorityClassName: ""

235

# @schema

236

# type: object

237

# additionalProperties: {type: string}

238

# @schema

239

# -- Additional labels added to Pods of the TLS Secrets exporter

240

podExtraLabels: {}

241

# @schema

242

# type: object

243

# additionalProperties: {type: string}

244

# @schema

245

# -- Annotations added to Pods of the TLS Secrets exporter

246

podAnnotations: {}

247

# @schema

248

# type: object

249

# additionalProperties: true

250

# properties: {}

251

# @schema

252

# -- PodSecurityContext for Pods of the TLS Secrets exporter

253

# @default -- see `values.yaml`

254

podSecurityContext:

255

runAsNonRoot: true

256

seccompProfile:

257

type: RuntimeDefault

258

# @schema

259

# type: object

260

# additionalProperties: true

261

# properties: {}

262

# @schema

263

# -- SecurityContext for containers of the TLS Secrets exporter

264

# @default -- see `values.yaml`

265

securityContext:

266

runAsUser: 65534

267

runAsGroup: 65534

268

readOnlyRootFilesystem: true

269

allowPrivilegeEscalation: false

270

capabilities:

271

drop:

272

- ALL

273

# @schema

274

# type: array

275

# items: {type: object}

276

# @schema

277

# -- Additional volumes added to Pods of the TLS Secrets exporter (combined with global `extraVolumes`)

278

extraVolumes: []

279

# @schema

280

# type: array

281

# items: {type: object}

282

# @schema

283

# -- Additional volume mounts added to Pod containers of the TLS Secrets exporter (combined with global `extraVolumeMounts`)

284

extraVolumeMounts: []

285

# @schema

286

# type: array

287

# items:

288

# type: object

289

# additionalProperties: false

290

# required: [type]

291

# properties:

292

# type: {type: string, minLength: 1}

293

# key: {type: string}

294

# keyPatterns:

295

# type: array

296

# items: {type: string}

297

# format: {enum: [pem, pkcs12, der, jks]}

298

# pkcs12:

299

# type: object

300

# additionalProperties: false

301

# properties:

302

# passphrase: {type: string}

303

# passphraseKey: {type: string}

304

# passphraseFile: {type: string}

305

# passphraseSecretRef:

306

# type: object

307

# additionalProperties: false

308

# required: [name, key]

309

# properties:

310

# namespace: {type: string}

311

# name: {type: string}

312

# key: {type: string}

313

# tryEmptyPassphrase: {type: boolean}

314

# jks:

315

# type: object

316

# additionalProperties: false

317

# properties:

318

# passphrase: {type: string}

319

# passphraseKey: {type: string}

320

# passphraseFile: {type: string}

321

# passphraseSecretRef:

322

# type: object

323

# additionalProperties: false

324

# required: [name, key]

325

# properties:

326

# namespace: {type: string}

327

# name: {type: string}

328

# key: {type: string}

329

# tryEmptyPassphrase: {type: boolean}

330

# oneOf:

331

# - required: [key]

332

# - required: [keyPatterns]

333

# @schema

334

# -- Which type of Secrets should be watched. Each entry takes either `key`

335

# (a single Secret data key — the matching regex `^<key>$` is built for

336

# you) or `keyPatterns` (a list of regexes, full control). Optional

337

# `format` is `pem` (default), `pkcs12`, `der`, or `jks` (Java KeyStore);

338

# `pkcs12` and `jks` blocks accept the same passphrase options:

339

# `passphrase`, `passphraseKey` (read passphrase from a sibling key in

340

# the same Secret), `passphraseFile`, `passphraseSecretRef` (read from a

341

# separate Secret, optionally in another namespace), `tryEmptyPassphrase`.

342

# @default -- see `values.yaml`

343

secretTypes:

344

- type: kubernetes.io/tls

345

key: tls.crt

346

# @schema

347

# type: array

348

# items: {type: string}

349

# @schema

350

# -- If the exporter should watch for certificates in ConfigMaps, just specify the keys it needs to watch. E.g.: `configMapKeys: ["tls.crt"]`

351

# @default -- see `values.yaml`

352

configMapKeys: []

353

# @schema

354

# type: [array, 'null']

355

# items: {type: string}

356

# @schema

357

# -- Restrict the list of namespaces the TLS Secrets exporter should scan for certificates to watch (all namespaces if empty). Each entry is a shell-glob pattern (`*`, `?`, `[abc]`) or a literal name — e.g. `team-*` matches `team-alpha` and `team-beta`.

358

includeNamespaces: []

359

# @schema

360

# type: [array, 'null']

361

# items: {type: string}

362

# @schema

363

# -- Exclude namespaces from being scanned by the TLS Secrets exporter (evaluated after `includeNamespaces`). Same shell-glob syntax as `includeNamespaces`.

364

excludeNamespaces: []

365

# @schema

366

# type: [array, 'null']

367

# items: {type: string}

368

# @schema

369

# -- Only watch namespaces having these labels (all namespaces if empty). Items can be keys such as `my-label` or also require a value with syntax `my-label=my-value`.

370

includeNamespaceLabels: []

371

# @schema

372

# type: [array, 'null']

373

# items: {type: string}

374

# @schema

375

# -- Exclude namespaces having these labels. Items can be keys such as `my-label` or also require a value with syntax `my-label=my-value`.

376

excludeNamespaceLabels: []

377

# @schema

378

# type: [array, 'null']

379

# items: {type: string}

380

# @schema

381

# -- Only watch Secrets whose name matches one of these entries (all matching Secrets if empty). Each entry is a shell-glob pattern (`*`, `?`, `[abc]`) or a literal name — e.g. `tls-*` matches `tls-prod` and `tls-dev`.

382

includeSecrets: []

383

# @schema

384

# type: [array, 'null']

385

# items: {type: string}

386

# @schema

387

# -- Exclude Secrets whose name matches one of these entries (evaluated after `includeSecrets`). Same shell-glob syntax as `includeSecrets`.

388

excludeSecrets: []

389

# @schema

390

# type: [array, 'null']

391

# items: {type: string}

392

# @schema

393

# -- Only watch ConfigMaps whose name matches one of these entries (all matching ConfigMaps if empty). Same shell-glob syntax as `includeSecrets`.

394

includeConfigMaps: []

395

# @schema

396

# type: [array, 'null']

397

# items: {type: string}

398

# @schema

399

# -- Exclude ConfigMaps whose name matches one of these entries (evaluated after `includeConfigMaps`). Same shell-glob syntax as `includeSecrets`.

400

excludeConfigMaps: []

401

# @schema

402

# type: [array, 'null']

403

# items: {type: string}

404

# @schema

405

# -- Only watch TLS Secrets having these labels (all secrets if empty). Items can be keys such as `my-label` or also require a value with syntax `my-label=my-value`.

406

includeLabels: []

407

# @schema

408

# type: [array, 'null']

409

# items: {type: string}

410

# @schema

411

# -- Exclude TLS Secrets having these labels. Items can be keys such as `my-label` or also require a value with syntax `my-label=my-value`.

412

excludeLabels: []

413

# @schema

414

# type: [array, 'null']

415

# items: {type: string}

416

# @schema

417

# -- Expose selected labels from Kubernetes Secrets as Prometheus labels. **Beware of high-cardinality labels** (e.g. `pod-template-hash`, `controller-revision-hash`, build/git SHAs, timestamps, request IDs): each unique value adds a fresh series for every certificate metric, which can quickly explode the Prometheus index. Stick to slow-changing identifiers (app, team, environment, owner).

418

exposeSecretLabels: []

419

# @schema

420

# type: [array, 'null']

421

# items: {type: string}

422

# @schema

423

# -- Expose selected labels from Kubernetes ConfigMaps as Prometheus labels. Same caveat as `exposeSecretLabels` — keep the list to slow-changing identifiers and avoid high-cardinality values.

424

exposeConfigMapLabels: []

425

# @schema

426

# type: array

427

# items: {type: string}

428

# @schema

429

# -- Additional arguments to append to the exporter command line. E.g.: `--watch-file="/extra-cert/tls.crt"`.

430

extraArgs: []

431

cache:

432

# -- Enable caching of Kubernetes objects to prevent scraping timeouts

433

enabled: true

434

# @schema

435

# type: integer

436

# minimum: 1

437

# @schema

438

# -- Maximum time an object can stay in cache unrefreshed (seconds) - it will be at least half of that

439

maxDuration: 300

440

kubeApiRateLimits:

441

# -- Should requests to the Kubernetes API server be rate-limited

442

enabled: false

443

# @schema

444

# type: number

445

# minimum: 0

446

# @schema

447

# -- Maximum rate of queries sent to the API server (per second)

448

queriesPerSecond: 5

449

# @schema

450

# type: integer

451

# minimum: 1

452

# @schema

453

# -- Burst bucket size for queries sent to the API server

454

burstQueries: 10

455

# @schema

456

# type: integer

457

# minimum: 0

458

# @schema

459

# -- Page size used by the paginated initial LIST against the

460

# Kubernetes API. The exporter processes each page inline and

461

# releases it to the GC before fetching the next, so peak memory

462

# during sync is roughly proportional to this × average secret

463

# size. Default `50` is conservative enough to keep the pod under

464

# 100 Mi even on clusters with many large Helm release secrets;

465

# raise it for faster sync on smaller objects, lower it on

466

# memory-constrained pods. `0` keeps the built-in default.

467

listPageSize: 0

468

# @schema

469

# type: array

470

# items: {type: object}

471

# @schema

472

# -- Additional environment variables for containers

473

env: []

474

# - name: GOMAXPROCS

475

# value: "1"

476

cabundlesExporter:

477

# -- Should the cluster-wide caBundle exporter be active. Watches inline `caBundle` PEM fields of admission resources (and other API discovery resources) cluster-wide and emits one series per (resource, webhook entry). Opt-in because it requires cluster-scoped get+list+watch on the corresponding API groups.

478

enabled: false

479

# @schema

480

# type: object

481

# additionalProperties: false

482

# @schema

483

# -- Per-resource opt-in. Each true flag adds the corresponding rule to the ClusterRole and starts the matching informer. Toggle off the resource kinds you don't use to keep the RBAC scope minimal.

484

resources:

485

# -- Watch `MutatingWebhookConfiguration` resources (admissionregistration.k8s.io/v1).

486

mutating: true

487

# -- Watch `ValidatingWebhookConfiguration` resources (admissionregistration.k8s.io/v1).

488

validating: true

489

# -- Watch `APIService` resources (apiregistration.k8s.io/v1) — surfaces caBundle expiry on aggregated APIs (metrics-server, prometheus-adapter, etc.).

490

apiservice: false

491

# -- Watch `CustomResourceDefinition` resources with a conversion webhook (apiextensions.k8s.io/v1). CRDs with `conversion.strategy: None` are skipped silently — the vast majority — so enabling this is cheap.

492

crdConversion: false

493

# @schema

494

# type: [array, 'null']

495

# items: {type: string}

496

# @schema

497

# -- Only watch caBundle-bearing resources whose name matches one of these entries (all matching if empty). Each entry is a shell-glob pattern (`*`, `?`, `[abc]`) or a literal name.

498

includeNames: []

499

# @schema

500

# type: [array, 'null']

501

# items: {type: string}

502

# @schema

503

# -- Exclude caBundle-bearing resources whose name matches one of these entries (evaluated after `includeNames`). Same shell-glob syntax as `includeNames`.

504

excludeNames: []

505

# @schema

506

# type: [array, 'null']

507

# items: {type: string}

508

# @schema

509

# -- Only watch caBundle-bearing resources having these labels (all if empty). Items can be keys such as `my-label` or also require a value with syntax `my-label=my-value`.

510

includeLabels: []

511

# @schema

512

# type: [array, 'null']

513

# items: {type: string}

514

# @schema

515

# -- Exclude caBundle-bearing resources having these labels. Items can be keys such as `my-label` or also require a value with syntax `my-label=my-value`.

516

excludeLabels: []

517

# @schema

518

# type: [array, 'null']

519

# items: {type: string}

520

# @schema

521

# -- Expose selected labels from caBundle-bearing resources as Prometheus labels (prefix `cabundle_label_`). Same caveat as `exposeSecretLabels` — keep the list to slow-changing identifiers and avoid high-cardinality values.

522

exposeLabels: []

523

hostPathsExporter:

524

# @schema

525

# type: object

526

# additionalProperties: {type: string}

527

# @schema

528

# -- Additional DaemonSet annotations

529

annotations: {}

530

# -- Should debug messages be produced by hostPath exporters (default for all hostPathsExporter.daemonSets)

531

debugMode: false

532

# -- Skip symlinks when scanning files and directories. Does not apply to Kubernetes secrets.

533

skipSymlinks: false

534

# -- Polling interval at which the file source re-walks watched paths and re-parses changed files. Accepts a Go duration (e.g. `30s`, `5m`). Default is suited for slowly-rotated PKI; lower it for tests or fast-rotation flows.

535

refreshInterval: "300s"

536

# @schema

537

# enum: [Always]

538

# @schema

539

# -- restartPolicy for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

540

restartPolicy: Always

541

# @schema

542

# type: object

543

# additionalProperties: true

544

# @schema

545

# -- updateStrategy for DaemonSets of hostPath exporters (default for all hostPathsExporter.daemonSets)

546

updateStrategy: {}

547

# @schema

548

# type: [integer, 'null']

549

# @schema

550

# -- (int) Number of old ReplicaSets to retain for rollback (default for all hostPathsExporter.daemonSets)

551

revisionHistoryLimit:

552

# @schema

553

# type: object

554

# additionalProperties: true

555

# properties: {}

556

# @schema

557

# -- ResourceRequirements for containers of hostPath exporters (default for all hostPathsExporter.daemonSets)

558

# @default -- see `values.yaml`

559

resources:

560

limits:

561

cpu: 1

562

memory: 40Mi

563

requests:

564

cpu: 10m

565

memory: 20Mi

566

# @schema

567

# type: object

568

# additionalProperties: true

569

# properties: {}

570

# @schema

571

# -- Readiness probe definition for the host paths exporter (.httpGet cannot be changed)

572

# @default -- see `values.yaml`

573

readinessProbe:

574

initialDelaySeconds: 5

575

periodSeconds: 3

576

# @schema

577

# type: object

578

# additionalProperties: true

579

# properties: {}

580

# @schema

581

# -- Liveness probe definition for the host paths exporter (.httpGet cannot be changed)

582

# @default -- see `values.yaml`

583

livenessProbe:

584

initialDelaySeconds: 5

585

periodSeconds: 3

586

# @schema

587

# type: object

588

# additionalProperties: {type: string}

589

# @schema

590

# -- Node selector for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

591

nodeSelector: {}

592

# @schema

593

# type: array

594

# items: {type: object}

595

# @schema

596

# -- Tolerations for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

597

tolerations: []

598

# @schema

599

# type: object

600

# additionalProperties: true

601

# @schema

602

# -- Affinity for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

603

affinity: {}

604

# -- PriorityClassName for Pods of hostPath exporters

605

priorityClassName: ""

606

# @schema

607

# type: object

608

# additionalProperties: {type: string}

609

# @schema

610

# -- Additional labels added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

611

podExtraLabels: {}

612

# @schema

613

# type: object

614

# additionalProperties: {type: string}

615

# @schema

616

# -- Annotations added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

617

podAnnotations: {}

618

# @schema

619

# type: object

620

# additionalProperties: true

621

# properties: {}

622

# @schema

623

# -- PodSecurityContext for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)

624

# @default -- see `values.yaml`

625

podSecurityContext:

626

seccompProfile:

627

type: RuntimeDefault

628

# @schema

629

# type: object

630

# additionalProperties: true

631

# properties: {}

632

# @schema

633

# -- SecurityContext for containers of hostPath exporters (default for all hostPathsExporter.daemonSets)

634

# @default -- see `values.yaml`

635

securityContext:

636

runAsUser: 0

637

runAsGroup: 0

638

readOnlyRootFilesystem: true

639

allowPrivilegeEscalation: false

640

capabilities:

641

drop:

642

- ALL

643

# @schema

644

# type: array

645

# items: {type: object}

646

# @schema

647

# -- Additional volumes added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets ; combined with global `extraVolumes`)

648

extraVolumes: []

649

# @schema

650

# type: array

651

# items: {type: object}

652

# @schema

653

# -- Additional volume mounts added to Pod containers of hostPath exporters (default for all hostPathsExporter.daemonSets ; combined with global `extraVolumeMounts`)

654

extraVolumeMounts: []

655

# @schema

656

# type: [string, 'null']

657

# enum: ['', Directory, DirectoryOrCreate, null]

658

# @schema

659

# -- Type for HostPath volumes used with watched paths. Can be set to `""` or null to use Kubernetes defaults. May be required with RKE if Pods don't start.

660

hostPathVolumeType: Directory

661

# @schema

662

# type: array

663

# items: {type: string}

664

# @schema

665

# -- [SEE README] List of directory paths of the host to scan for PEM encoded certificate files to be watched and exported as metrics. Each entry is a literal directory (scanned one level deep, default) or a shell-glob pattern with `**` for recursion — e.g. `/var/lib/kubelet/pods/**/*.crt` walks every Pod's volume subtree. The static prefix before any `*`/`?`/`[`/`**` is what gets mounted from the host, so a recursive pattern still binds the smallest containing directory rather than the whole filesystem.

666

watchDirectories: []

667

# @schema

668

# type: array

669

# items: {type: string}

670

# @schema

671

# -- [SEE README] List of directory paths of the host to scan for specific extension files to be watched and exported as metrics (one level deep)

672

watchSpecificExtensionDirectories: []

673

# @schema

674

# type: array

675

# items: {type: string}

676

# @schema

677

# -- [SEE README] List of file paths of the host for PEM encoded certificates to be watched and exported as metrics (one level deep)

678

watchFiles: []

679

# @schema

680

# type: array

681

# items: {type: string}

682

# @schema

683

# -- [SEE README] List of Kubeconf file paths of the host to scan for embedded certificates to export metrics about

684

watchKubeconfFiles: []

685

# @schema

686

# type: array

687

# items: {type: object}

688

# @schema

689

# -- Additional environment variables for containers

690

env: []

691

# - name: GOMAXPROCS

692

# value: "1"

693

694

# @schema

695

# type: object

696

# additionalProperties: {type: object}

697

# @schema

698

# -- [SEE README] Map to define one or many DaemonSets running hostPath exporters. Key is used as a name ; value is a map to override all default settings set by `hostPathsExporter.*`.

699

daemonSets: {}

700

# @schema

701

# type: integer

702

# minimum: 1

703

# maximum: 65535

704

# @schema

705

# -- TCP port to expose Pods on (whether kube-rbac-proxy is enabled or not)

706

podListenPort: 9793

707

# @schema

708

# type: integer

709

# minimum: 0

710

# maximum: 65535

711

# @schema

712

# -- TCP port for a separate plain-HTTP server exposing only `/healthz`

713

# and `/readyz`, used as the kubelet probe target. `0` disables it; the

714

# chart auto-enables `8080` when the main `/metrics` port is auth-gated

715

# (`webConfiguration` set or `rbacProxy.enabled`), so kubelet probes

716

# can succeed without a TLS / mTLS / Bearer credential. Set explicitly

717

# to override the auto-default.

718

probeListenPort: 0

719

# -- Enable hostNetwork mode. Useful when Prometheus is deployed outside of the Kubernetes cluster

720

hostNetwork: false

721

web:

722

# -- Expose internal cache statistics via HTML on the root endpoint (/)

723

enableStats: true

724

# -- HTTP server configuration for enabling TLS and authentication (password, mTLS) ; see [documentation at Exporter Toolkit](https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md)

725

webConfiguration: ""

726

# -- Load the HTTP server configuration from an existing Secret instead of `webConfiguration`. Key must be `webconfig.yaml`.

727

webConfigurationExistingSecret: ""

728

service:

729

# -- Should a Service be installed, targeting all Deployment and DaemonSet instances (required for ServiceMonitor)

730

create: true

731

# -- Should the Service be headless (`clusterIP: None`).

732

headless: true

733

# @schema

734

# type: integer

735

# minimum: 1

736

# maximum: 65535

737

# @schema

738

# -- TCP port to expose the Service on

739

port: 9793

740

# @schema

741

# type: object

742

# additionalProperties: {type: string}

743

# @schema

744

# -- Annotations to add to the Service

745

annotations: {}

746

# @schema

747

# type: object

748

# additionalProperties: {type: string}

749

# @schema

750

# -- Additional labels to add to the Service

751

extraLabels: {}

752

# @schema

753

# type: object

754

# additionalProperties: false

755

# @schema

756

prometheusServiceMonitor:

757

# -- Should a ServiceMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users.

758

create: true

759

# -- Target scrape interval set in the ServiceMonitor

760

scrapeInterval: 60s

761

# -- Target scrape timeout set in the ServiceMonitor

762

scrapeTimeout: 30s

763

# @schema

764

# type: object

765

# additionalProperties: {type: string}

766

# @schema

767

# -- Additional labels to add to ServiceMonitor objects

768

extraLabels: {}

769

# @schema

770

# type: object

771

# additionalProperties: {type: string}

772

# @schema

773

# -- Additional annotations to add to ServiceMonitor objects

774

extraAnnotations: {}

775

# @schema

776

# type: array

777

# items: {type: object}

778

# @schema

779

# -- Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint

780

metricRelabelings: []

781

# @schema

782

# type: array

783

# items: {type: object}

784

# @schema

785

# -- Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint

786

relabelings: []

787

# @schema

788

# enum: [http, https]

789

# @schema

790

# -- Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint

791

scheme: http

792

# @schema

793

# type: object

794

# additionalProperties: true

795

# @schema

796

# -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`). Requires `scheme: https` (the chart refuses to render credentials over plaintext HTTP) and is mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth

797

basicAuth: {}

798

# @schema

799

# type: object

800

# additionalProperties: true

801

# @schema

802

# -- Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig

803

tlsConfig: {}

804

# @schema

805

# type: object

806

# additionalProperties: false

807

# @schema

808

prometheusPodMonitor:

809

# -- Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users.

810

create: false

811

# -- Target scrape interval set in the PodMonitor

812

scrapeInterval: 60s

813

# -- Target scrape timeout set in the PodMonitor

814

scrapeTimeout: 30s

815

# @schema

816

# type: object

817

# additionalProperties: {type: string}

818

# @schema

819

# -- Additional labels to add to PodMonitor objects

820

extraLabels: {}

821

# @schema

822

# type: array

823

# items: {type: object}

824

# @schema

825

# -- Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint

826

metricRelabelings: []

827

# @schema

828

# type: array

829

# items: {type: object}

830

# @schema

831

# -- Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint

832

relabelings: []

833

# @schema

834

# enum: [http, https]

835

# @schema

836

# -- Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint

837

scheme: http

838

# @schema

839

# type: object

840

# additionalProperties: true

841

# @schema

842

# -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`). Requires `scheme: https` (the chart refuses to render credentials over plaintext HTTP) and is mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth

843

basicAuth: {}

844

# @schema

845

# type: object

846

# additionalProperties: true

847

# @schema

848

# -- Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig

849

tlsConfig: {}

850

prometheusRules:

851

# -- Should a PrometheusRule object be installed to alert on certificate expiration. For prometheus-operator (kube-prometheus) users.

852

create: true

853

# -- Prefix prepended to the alert rule names of PrometheusRule rules

854

rulePrefix: ""

855

# @schema

856

# type: object

857

# additionalProperties: {type: string}

858

# @schema

859

# -- Additional labels to add to PrometheusRule objects

860

extraLabels: {}

861

# @schema

862

# type: object

863

# additionalProperties: {type: string}

864

# @schema

865

# -- Additional labels to add to PrometheusRule rules

866

alertExtraLabels: {}

867

# @schema

868

# type: object

869

# additionalProperties: {type: string}

870

# @schema

871

# -- Additional annotations to add to PrometheusRule rules

872

alertExtraAnnotations: {}

873

# ─── Source health alerts ──────────────────────────────────────────────

874

# -- Should the SourceErrors / SourceErrorsSustained alerting rules be created to notify when a source produces decode or transport errors. Two bands share one toggle and one expression: warning fires after >5 errors in 15 minutes (aggregated across reasons, so a single malformed cert won't page), critical fires once that condition has held continuously for 30 minutes.

875

alertOnSourceErrors: true

876

# @schema

877

# enum: [info, warning, critical]

878

# @schema

879

# -- Severity for the SourceErrors alerting rule (warning band — >5 errors in 15min)

880

sourceErrorsSeverity: warning

881

# @schema

882

# enum: [info, warning, critical]

883

# @schema

884

# -- Severity for the SourceErrorsSustained alerting rule (critical band — warning condition has held for ≥30min)

885

sourceErrorsSustainedSeverity: critical

886

# -- Should the SourceDown alerting rule be created to notify when a source fails its initial sync or stops reporting (`x509_source_up == 0`). A source that is down means every certificate it normally watches has stopped being checked — a silently expired cert is then possible.

887

alertOnSourceDown: true

888

# @schema

889

# enum: [info, warning, critical]

890

# @schema

891

# -- Severity for the SourceDown alerting rule

892

sourceDownSeverity: critical

893

# -- Should the KubeTransportErrors / KubeTransportErrorsSustained alerting rules be created to notify when the Kubernetes source records LIST/WATCH/informer-level failures (auth rotation drift, apiserver throttling, persistent network issues). The two share one toggle and one expression but two severities: warning fires after >5 errors in 15 minutes (filters out the 1–3 events a rolling control-plane upgrade typically produces), critical fires once that condition has held continuously for 30 minutes. Independent from SourceErrors: this one is scoped to Kubernetes API transport state (watch flapping, list backoff, namespace informer sync timeouts), the other covers decode-level errors across all source kinds.

894

alertOnKubeTransportErrors: true

895

# @schema

896

# enum: [info, warning, critical]

897

# @schema

898

# -- Severity for the KubeTransportErrors alerting rule (warning band — >5 events in 15min)

899

kubeTransportErrorsSeverity: warning

900

# @schema

901

# enum: [info, warning, critical]

902

# @schema

903

# -- Severity for the KubeTransportErrorsSustained alerting rule (critical band — warning condition has held for ≥30min)

904

kubeTransportErrorsSustainedSeverity: critical

905

# -- Should the KeystorePassphraseFailures alerting rule be created to notify when PKCS#12 or JKS/JCEKS decoding fails with `bad_passphrase`. A misconfigured passphraseKey/passphraseSecretRef would otherwise leak only into logs and a counter that no one watches.

906

alertOnKeystorePassphraseFailures: true

907

# @schema

908

# enum: [info, warning, critical]

909

# @schema

910

# -- Severity for the KeystorePassphraseFailures alerting rule

911

keystorePassphraseFailuresSeverity: warning

912

# ─── Certificate lifecycle alerts ──────────────────────────────────────

913

# CertificateRenewal and CertificateExpiration have no toggle: expiration

914

# monitoring is the exporter's core value, disabling them would defeat

915

# the purpose of the chart. The remaining rules guard against specific

916

# operational failure modes and are individually opt-out.

917

# -- Should the CertificateError alerting rule be created to notify when the exporter can't decode or process a certificate. Depends on `exposePerCertificateErrorMetrics: true` — without it the underlying `x509_cert_error` series isn't emitted and the rule is a silent no-op.

918

alertOnCertificateError: true

919

# @schema

920

# enum: [info, warning, critical]

921

# @schema

922

# -- Severity for the CertificateError alerting rule

923

certificateErrorSeverity: warning

924

# @schema

925

# enum: [info, warning, critical]

926

# @schema

927

# -- Severity for the CertificateRenewal alerting rule

928

certificateRenewalsSeverity: warning

929

# @schema

930

# enum: [info, warning, critical]

931

# @schema

932

# -- Severity for the CertificateExpiration alerting rule

933

certificateExpirationsSeverity: critical

934

# @schema

935

# type: integer

936

# minimum: 0

937

# @schema

938

# -- Raise a warning alert when fewer than this many days are left before a certificate expiration (cert-manager would renew Let's Encrypt certs before day 29)

939

warningDaysLeft: 28

940

# @schema

941

# type: integer

942

# minimum: 0

943

# @schema

944

# -- Raise a critical alert when fewer than this many days are left before a certificate expiration (two weeks to deal with ACME rate limiting should this be an issue)

945

criticalDaysLeft: 14

946

# -- Should the CertificateNotYetValid alerting rule be created to notify when a certificate's `notBefore` is in the future. Depends on `exposeNotBeforeMetric: true` — without it the underlying `x509_cert_not_before` series isn't emitted and the rule is a silent no-op.

947

alertOnCertificateNotYetValid: true

948

# @schema

949

# enum: [info, warning, critical]

950

# @schema

951

# -- Severity for the CertificateNotYetValid alerting rule

952

certificateNotYetValidSeverity: warning

953

# -- Should the CertificateCollision alerting rule be created to notify when at least one certificate was dropped because of a label collision (registry `Collision=Never` policy). The detect-only counter `x509_cert_collision_total` keeps ticking under the default `Collision=Auto` policy where the discriminator label resolves the overlap — that signal stays on dashboards but does not page.

954

alertOnCertificateCollision: true

955

# @schema

956

# enum: [info, warning, critical]

957

# @schema

958

# -- Severity for the CertificateCollision alerting rule

959

certificateCollisionSeverity: warning

960

# ─── CRL lifecycle alerts ──────────────────────────────────────────────

961

# No toggle: same rationale as CertificateRenewal/Expiration. The

962

# underlying `x509_crl_*` series only exist when a CRL is actually

963

# observed, so installations that don't watch any CRL get no alerts.

964

# @schema

965

# type: integer

966

# minimum: 0

967

# @schema

968

# -- Raise a warning alert when fewer than this many days are left before a CRL reaches its nextUpdate. CRLs are typically refreshed daily to weekly; 7 days gives a comfortable margin for a publisher running on a weekly cadence.

969

crlWarningDaysLeft: 7

970

# @schema

971

# enum: [info, warning, critical]

972

# @schema

973

# -- Severity for the CRLNeedsRefresh alerting rule

974

crlNeedsRefreshSeverity: warning

975

# @schema

976

# enum: [info, warning, critical]

977

# @schema

978

# -- Severity for the CRLStale alerting rule (fires once `x509_crl_stale > 0`, i.e. the CRL's nextUpdate is in the past)

979

crlStaleSeverity: critical

980

# -- Skip all built-in alerts when using extraAlertGroups

981

disableBuiltinAlertGroup: false

982

# @schema

983

# type: array

984

# items: {type: object}

985

# @schema

986

# -- Additional alert groups for custom configuration (example in `values.yaml`)

987

extraAlertGroups: []

988

# - name: x509-certificate-exporter.custom

989

# rules:

990

# # Flag certificates that have been past their NotAfter for more

991

# # than 24 hours. The built-in CertificateExpiration keeps firing

992

# # once a cert crosses its expiry, but doesn't distinguish

993

# # "expired today" from "expired three weeks ago and nobody renewed".

994

# - alert: CertificateExpiredForTooLong

995

# expr: (time() - x509_cert_not_after) > 86400

996

# for: 15m

997

# labels:

998

# severity: critical

999

# annotations:

1000

# summary: Certificate is expired and has not been renewed

1001

# # extraAlertGroups content is run through Helm's `tpl` with

1002

# # the chart root as context, so AlertManager template actions

1003

# # ({{ $labels.X }}, {{ humanizeDuration $value }}) must be

1004

# # backtick-escaped to survive Helm's pass unchanged.

1005

# description: Certificate for `{{`{{ $labels.subject_CN }}`}}` has been expired for {{`{{ humanizeDuration $value }}`}}.

1006

1007

# ─── Per-alert overrides ───────────────────────────────────────────────

1008

# Targeted escape hatches when an environment needs to tweak a single

1009

# alert without disabling the whole built-in group via

1010

# `disableBuiltinAlertGroup` + reproducing everything in

1011

# `extraAlertGroups`. Keys are the bare alert names (no `rulePrefix`).

1012

# Overrides are taken whole — there's no merge with the default; if

1013

# you override CertificateRenewal's `expr`, you must reproduce any

1014

# threshold or conjunction the default value contains.

1015

# @schema

1016

# type: object

1017

# additionalProperties: {type: string}

1018

# @schema

1019

# -- Map of alertName -> Prometheus expression that replaces the default `expr:` of the built-in rule with the same name. Useful for adding label filters in multi-cluster setups (`max by (cluster, …) (x509_cert_not_after - time()) < …`), swapping in aggregation functions, or anything else that doesn't fit through the existing knobs.

1020

alertExprOverrides: {}

1021

# CertificateRenewal: |-

1022

# max by (cluster, subject_CN, secret_namespace, secret_name, filepath) (

1023

# x509_cert_not_after - time()

1024

# ) < (28 * 86400) and (x509_cert_not_after - time()) > 0

1025

# @schema

1026

# type: object

1027

# additionalProperties: {type: string, pattern: '^([0-9]+\.[0-9]+(ms|s|m|h|d|w|y)|([0-9]+(ms|s|m|h|d|w|y))+)$'}

1028

# @schema

1029

# -- Map of alertName -> `for:` duration that replaces the default. The shipped defaults are 5m for operational signals (Source*, KubeTransport*), 15m for state-based ones (Certificate*, CRL*, Keystore*), and 30m for the Sustained critical bands. Override values must be valid Prometheus duration strings (e.g. `30s`, `5m`, `1h`).

1030

alertForOverrides: {}

1031

# KubeTransportErrorsSustained: "1h"

1032

# CertificateError: "1m"

1033

# @schema

1034

# type: object

1035

# additionalProperties: {type: string}

1036

# @schema

1037

# -- Additional labels added to all chart objects

1038

extraLabels: {}

1039

# @schema

1040

# type: object

1041

# additionalProperties: {type: string}

1042

# @schema

1043

# -- Additional labels added to all Pods

1044

podExtraLabels: {}

1045

# @schema

1046

# type: object

1047

# additionalProperties: {type: string}

1048

# @schema

1049

# -- Annotations added to all Pods

1050

podAnnotations: {}

1051

# prometheus.io/port: "9793"

1052

# prometheus.io/scrape: "true"

1053

1054

# -- PriorityClassName set for all Pods by default (can be overridden with `secretsExporter` and `hostPathsExporter` specific values)

1055

priorityClassName: ""

1056

# @schema

1057

# type: array

1058

# items: {type: object}

1059

# @schema

1060

# -- Additional volumes added to all Pods (see also the `secretsExporter` and `hostPathsExporter` variants)

1061

extraVolumes: []

1062

# @schema

1063

# type: array

1064

# items: {type: object}

1065

# @schema

1066

# -- Additional volume mounts added to all Pod containers (see also the `secretsExporter` and `hostPathsExporter` variants)

1067

extraVolumeMounts: []

1068

psp:

1069

# -- Should Pod Security Policy objects be created

1070

create: false

1071

rbac:

1072

# -- Should RBAC objects be created

1073

create: true

1074

secretsExporter:

1075

# @schema

1076

# type: [string, 'null']

1077

# @schema

1078

# -- Name of the ServiceAccount for the Secrets exporter (required if `rbac.create=false`)

1079

serviceAccountName:

1080

# @schema

1081

# type: object

1082

# additionalProperties: {type: string}

1083

# @schema

1084

# -- Annotations added to the ServiceAccount for the Secrets exporter

1085

serviceAccountAnnotations: {}

1086

# @schema

1087

# type: object

1088

# additionalProperties: {type: string}

1089

# @schema

1090

# -- Annotations added to the ClusterRole for the Secrets exporter

1091

clusterRoleAnnotations: {}

1092

# @schema

1093

# type: object

1094

# additionalProperties: {type: string}

1095

# @schema

1096

# -- Annotations added to the ClusterRoleBinding for the Secrets exporter

1097

clusterRoleBindingAnnotations: {}

1098

hostPathsExporter:

1099

# @schema

1100

# type: [string, 'null']

1101

# @schema

1102

# -- Name of the ServiceAccount for hostPath exporters (required if `rbac.create=false`)

1103

serviceAccountName:

1104

# @schema

1105

# type: object

1106

# additionalProperties: {type: string}

1107

# @schema

1108

# -- Annotations added to the ServiceAccount for the hostPath exporters

1109

serviceAccountAnnotations: {}

1110

# @schema

1111

# type: object

1112

# additionalProperties: {type: string}

1113

# @schema

1114

# -- Annotations added to the ClusterRole for the hostPath exporters

1115

clusterRoleAnnotations: {}

1116

# @schema

1117

# type: object

1118

# additionalProperties: {type: string}

1119

# @schema

1120

# -- Annotations added to the ClusterRoleBinding for the hostPath exporters

1121

clusterRoleBindingAnnotations: {}

1122

rbacProxy:

1123

# -- Should kube-rbac-proxy be used to expose exporters

1124

enabled: false

1125

tls:

1126

# -- Pre-provisioned Secret carrying `tls.crt` + `tls.key` for the

1127

# kube-rbac-proxy serving cert. When empty, the chart auto-generates

1128

# a self-signed cert at install time and reuses it across upgrades

1129

# via `lookup`. Set this to a cert-manager-managed Secret (or

1130

# similar) for a cert with a real chain you can rotate independently.

1131

existingSecretName: ""

1132

image:

1133

# -- kube-rbac-proxy image registry. Empty string opts out of the registry prefix and lets the CRI fall back to its configured default (typically docker.io).

1134

registry: cgr.dev

1135

# @schema

1136

# type: string

1137

# minLength: 1

1138

# @schema

1139

# -- kube-rbac-proxy image repository

1140

repository: scratch-images/test-tmp/kube-rbac-proxy-fips

1141

# -- kube-rbac-proxy image tag

1142

tag: 0.22.1-r10

1143

# -- kube-rbac-proxy image digest. When set, takes precedence over `tag` (immutable reference)

1144

digest: sha256:8547dfc680fd0028022bd46093be64142bc9fe5d0a3d7c1317733a34ca135935

1145

# @schema

1146

# enum: [Always, IfNotPresent, Never]

1147

# @schema

1148

# -- kube-rbac-proxy image pull policy

1149

pullPolicy: IfNotPresent

1150

# @schema

1151

# type: integer

1152

# minimum: 1

1153

# maximum: 65535

1154

# @schema

1155

# -- Listen port for the exporter running inside kube-rbac-proxy exposed Pods

1156

upstreamListenPort: 9091

1157

# @schema

1158

# type: object

1159

# additionalProperties: true

1160

# properties: {}

1161

# @schema

1162

# -- ResourceRequirements for all containers of kube-rbac-proxy

1163

# @default -- see `values.yaml`

1164

resources:

1165

limits:

1166

cpu: 100m

1167

memory: 40Mi

1168

requests:

1169

cpu: 10m

1170

memory: 20Mi

1171

# @schema

1172

# type: object

1173

# additionalProperties: true

1174

# properties: {}

1175

# @schema

1176

# -- SecurityContext for all containers of kube-rbac-proxy

1177

# @default -- see `values.yaml`

1178

securityContext:

1179

runAsUser: 65534

1180

runAsGroup: 65534

1181

runAsNonRoot: true

1182

readOnlyRootFilesystem: true

1183

allowPrivilegeEscalation: false

1184

capabilities:

1185

drop:

1186

- ALL

1187

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

x509-certificate-exporter

The trusted source for open source

Product

Solutions

Customers

Resources

Company