cert-manager
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# +docs:section=Global
2
3
# Default values for cert-manager.
4
# This is a YAML-formatted file.
5
# Declare variables to be passed into your templates.
6
global:
7
# Reference to one or more secrets to be used when pulling images.
8
# For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
9
#
10
# For example:
11
# imagePullSecrets:
12
# - name: "image-pull-secret"
13
imagePullSecrets: []
14
# Labels to apply to all resources.
15
# Please note that this does not add labels to the resources created dynamically by the controllers.
16
# For these resources, you have to add the labels in the template in the cert-manager custom resource:
17
# For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
18
# For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).
19
# For example, secretTemplate in CertificateSpec
20
# For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
21
commonLabels: {}
22
# The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
23
# +docs:property
24
# revisionHistoryLimit: 1
25
26
# The optional priority class to be used for the cert-manager pods.
27
priorityClassName: ""
28
rbac:
29
# Create required ClusterRoles and ClusterRoleBindings for cert-manager.
30
create: true
31
# Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles)
32
aggregateClusterRoles: true
33
podSecurityPolicy:
34
# Create PodSecurityPolicy for cert-manager.
35
#
36
# Note that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25.
37
enabled: false
38
# Configure the PodSecurityPolicy to use AppArmor.
39
useAppArmor: true
40
# Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose.
41
logLevel: 2
42
leaderElection:
43
# Override the namespace used for the leader election lease.
44
namespace: "kube-system"
45
# The duration that non-leader candidates will wait after observing a
46
# leadership renewal until attempting to acquire leadership of a led but
47
# unrenewed leader slot. This is effectively the maximum duration that a
48
# leader can be stopped before it is replaced by another candidate.
49
# +docs:property
50
# leaseDuration: 60s
51
# The interval between attempts by the acting master to renew a leadership
52
# slot before it stops leading. This must be less than or equal to the
53
# lease duration.
54
# +docs:property
55
# renewDeadline: 40s
56
57
# The duration the clients should wait between attempting acquisition and
58
# renewal of a leadership.
59
# +docs:property
60
# retryPeriod: 15s
61
62
# This option is equivalent to setting crds.enabled=true and crds.keep=true.
63
# Deprecated: use crds.enabled and crds.keep instead.
64
installCRDs: false
65
crds:
66
# This option decides if the CRDs should be installed
67
# as part of the Helm installation.
68
enabled: false
69
# This option makes it so that the "helm.sh/resource-policy": keep
70
# annotation is added to the CRD. This will prevent Helm from uninstalling
71
# the CRD when the Helm release is uninstalled.
72
# WARNING: when the CRDs are removed, all cert-manager custom resources
73
# (Certificates, Issuers, ...) will be removed too by the garbage collector.
74
keep: true
75
# +docs:section=Controller
76
77
# The number of replicas of the cert-manager controller to run.
78
#
79
# The default is 1, but in production set this to 2 or 3 to provide high
80
# availability.
81
#
82
# If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.
83
#
84
# Note that cert-manager uses leader election to ensure that there can
85
# only be a single instance active at a time.
86
replicaCount: 1
87
# Deployment update strategy for the cert-manager controller deployment.
88
# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
89
#
90
# For example:
91
# strategy:
92
# type: RollingUpdate
93
# rollingUpdate:
94
# maxSurge: 0
95
# maxUnavailable: 1
96
strategy: {}
97
podDisruptionBudget:
98
# Enable or disable the PodDisruptionBudget resource.
99
#
100
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
101
# For example, the PodDisruptionBudget will block `kubectl drain`
102
# if it is used on the Node where the only remaining cert-manager
103
# Pod is currently running.
104
enabled: false
105
# This configures the minimum available pods for disruptions. It can either be set to
106
# an integer (e.g., 1) or a percentage value (e.g., 25%).
107
# It cannot be used if `maxUnavailable` is set.
108
# +docs:property
109
# +docs:type=unknown
110
# minAvailable: 1
111
# This configures the maximum unavailable pods for disruptions. It can either be set to
112
# an integer (e.g., 1) or a percentage value (e.g., 25%).
113
# it cannot be used if `minAvailable` is set.
114
# +docs:property
115
# +docs:type=unknown
116
# maxUnavailable: 1
117
118
# A comma-separated list of feature gates that should be enabled on the
119
# controller pod.
120
featureGates: ""
121
# The maximum number of challenges that can be scheduled as 'processing' at once.
122
maxConcurrentChallenges: 60
123
image:
124
# The container registry to pull the manager image from.
125
# +docs:property
126
# registry: quay.io
127
128
# The container image for the cert-manager controller.
129
# +docs:property
130
repository: chainguard-private/cert-manager-controller
131
# Override the image tag to deploy by setting this variable.
132
# If no value is set, the chart's appVersion is used.
133
# +docs:property
134
# tag: vX.Y.Z
135
136
# Setting a digest will override any tag.
137
# +docs:property
138
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
139
140
# Kubernetes imagePullPolicy on Deployment.
141
pullPolicy: IfNotPresent
142
registry: chainreg.biz
143
tag: "1.18"
144
digest: sha256:15aa0a7514e1b5aa7e25aa12a7c45fe5694b12c1356dc8559a3f3d93223b1f00
145
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
146
# resources. By default, the same namespace as cert-manager is deployed within is
147
# used. This namespace will not be automatically created by the Helm chart.
148
clusterResourceNamespace: ""
149
# This namespace allows you to define where the services are installed into.
150
# If not set then they use the namespace of the release.
151
# This is helpful when installing cert manager as a chart dependency (sub chart).
152
namespace: ""
153
# Override the "cert-manager.fullname" value. This value is used as part of
154
# most of the names of the resources created by this Helm chart.
155
# +docs:property
156
# fullnameOverride: "my-cert-manager"
157
158
# Override the "cert-manager.name" value, which is used to annotate some of
159
# the resources that are created by this Chart (using "app.kubernetes.io/name").
160
# NOTE: There are some inconsistencies in the Helm chart when it comes to
161
# these annotations (some resources use, e.g., "cainjector.name" which resolves
162
# to the value "cainjector").
163
# +docs:property
164
# nameOverride: "my-cert-manager"
165
serviceAccount:
166
# Specifies whether a service account should be created.
167
create: true
168
# The name of the service account to use.
169
# If not set and create is true, a name is generated using the fullname template.
170
# +docs:property
171
# name: ""
172
173
# Optional additional annotations to add to the controller's Service Account. Templates are allowed for both keys and values.
174
# Example using templating:
175
# annotations:
176
# "{{ .Chart.Name }}-helm-chart/version": "{{ .Chart.Version }}"
177
# +docs:property
178
# annotations: {}
179
180
# Optional additional labels to add to the controller's Service Account.
181
# +docs:property
182
# labels: {}
183
184
# Automount API credentials for a Service Account.
185
automountServiceAccountToken: true
186
# Automounting API credentials for a particular pod.
187
# +docs:property
188
# automountServiceAccountToken: true
189
190
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted.
191
enableCertificateOwnerRef: false
192
# This property is used to configure options for the controller pod.
193
# This allows setting options that would usually be provided using flags.
194
#
195
# If `apiVersion` and `kind` are unspecified they default to the current latest
196
# version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin
197
# the version by specifying the `apiVersion` yourself.
198
#
199
# For example:
200
# config:
201
# apiVersion: controller.config.cert-manager.io/v1alpha1
202
# kind: ControllerConfiguration
203
# logging:
204
# verbosity: 2
205
# format: text
206
# leaderElectionConfig:
207
# namespace: kube-system
208
# kubernetesAPIQPS: 9000
209
# kubernetesAPIBurst: 9000
210
# numberOfConcurrentWorkers: 200
211
# enableGatewayAPI: true
212
# # Feature gates as of v1.18.1. Listed with their default values.
213
# # See https://cert-manager.io/docs/cli/controller/
214
# featureGates:
215
# AdditionalCertificateOutputFormats: true # GA - default=true
216
# AllAlpha: false # ALPHA - default=false
217
# AllBeta: false # BETA - default=false
218
# ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
219
# ExperimentalGatewayAPISupport: true # BETA - default=true
220
# LiteralCertificateSubject: true # BETA - default=true
221
# NameConstraints: true # BETA - default=true
222
# OtherNames: false # ALPHA - default=false
223
# SecretsFilteredCaching: true # BETA - default=true
224
# ServerSideApply: false # ALPHA - default=false
225
# StableCertificateRequestName: true # BETA - default=true
226
# UseCertificateRequestBasicConstraints: false # ALPHA - default=false
227
# UseDomainQualifiedFinalizer: true # GA - default=true
228
# ValidateCAA: false # ALPHA - default=false
229
# DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
230
# ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
231
# # Configure the metrics server for TLS
232
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
233
# metricsTLSConfig:
234
# dynamic:
235
# secretNamespace: "cert-manager"
236
# secretName: "cert-manager-metrics-ca"
237
# dnsNames:
238
# - cert-manager-metrics
239
config: {}
240
# Setting Nameservers for DNS01 Self Check.
241
# For more information, see the [cert-manager documentation](https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check).
242
243
# A comma-separated string with the host and port of the recursive nameservers cert-manager should query.
244
dns01RecursiveNameservers: ""
245
# Forces cert-manager to use only the recursive nameservers for verification.
246
# Enabling this option could cause the DNS01 self check to take longer owing to caching performed by the recursive nameservers.
247
dns01RecursiveNameserversOnly: false
248
# Option to disable cert-manager's build-in auto-approver. The auto-approver
249
# approves all CertificateRequests that reference issuers matching the 'approveSignerNames'
250
# option. This 'disableAutoApproval' option is useful when you want to make all approval decisions
251
# using a different approver (like approver-policy - https://github.com/cert-manager/approver-policy).
252
disableAutoApproval: false
253
# List of signer names that cert-manager will approve by default. CertificateRequests
254
# referencing these signer names will be auto-approved by cert-manager. Defaults to just
255
# approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty
256
# array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval,
257
# because, e.g., you are using approver-policy, you can enable 'disableAutoApproval'.
258
# ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
259
# +docs:property
260
approveSignerNames:
261
- issuers.cert-manager.io/*
262
- clusterissuers.cert-manager.io/*
263
# Additional command line flags to pass to cert-manager controller binary.
264
# To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.
265
#
266
# Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.
267
#
268
# For example:
269
# extraArgs:
270
# - --controllers=*,-certificaterequests-approver
271
extraArgs: []
272
# Additional environment variables to pass to cert-manager controller binary.
273
# For example:
274
# extraEnv:
275
# - name: SOME_VAR
276
# value: 'some value'
277
extraEnv: []
278
# Resources to provide to the cert-manager controller pod.
279
#
280
# For example:
281
# requests:
282
# cpu: 10m
283
# memory: 32Mi
284
#
285
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
286
resources: {}
287
# Pod Security Context.
288
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
289
# +docs:property
290
securityContext:
291
runAsNonRoot: true
292
seccompProfile:
293
type: RuntimeDefault
294
# Container Security Context to be set on the controller component container.
295
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
296
# +docs:property
297
containerSecurityContext:
298
allowPrivilegeEscalation: false
299
capabilities:
300
drop:
301
- ALL
302
readOnlyRootFilesystem: true
303
# Additional volumes to add to the cert-manager controller pod.
304
volumes: []
305
# Additional volume mounts to add to the cert-manager controller container.
306
volumeMounts: []
307
# Optional additional annotations to add to the controller Deployment.
308
# +docs:property
309
# deploymentAnnotations: {}
310
311
# Optional additional annotations to add to the controller Pods.
312
# +docs:property
313
# podAnnotations: {}
314
315
# Optional additional labels to add to the controller Pods.
316
podLabels: {}
317
# Optional annotations to add to the controller Service.
318
# +docs:property
319
# serviceAnnotations: {}
320
321
# Optional additional labels to add to the controller Service.
322
# +docs:property
323
# serviceLabels: {}
324
325
# Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
326
# +docs:property
327
# serviceIPFamilyPolicy: ""
328
329
# Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
330
# +docs:property
331
# serviceIPFamilies: []
332
333
# Optional DNS settings. These are useful if you have a public and private DNS zone for
334
# the same domain on Route 53. The following is an example of ensuring
335
# cert-manager can access an ingress or DNS TXT records at all times.
336
# Note that this requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
337
# the cluster to work.
338
339
# Pod DNS policy.
340
# For more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
341
# +docs:property
342
# podDnsPolicy: "None"
343
344
# Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy
345
# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
346
# For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config).
347
# +docs:property
348
# podDnsConfig:
349
# nameservers:
350
# - "1.1.1.1"
351
# - "8.8.8.8"
352
353
# Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks.
354
hostAliases: []
355
# - ip: 127.0.0.1
356
# hostnames:
357
# - foo.local
358
# - bar.local
359
# - ip: 10.1.2.3
360
# hostnames:
361
# - foo.remote
362
# - bar.remote
363
364
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
365
# matching labels.
366
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
367
#
368
# This default ensures that Pods are only scheduled to Linux nodes.
369
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
370
# +docs:property
371
nodeSelector:
372
kubernetes.io/os: linux
373
# +docs:ignore
374
ingressShim: {}
375
# Optional default issuer to use for ingress resources.
376
# +docs:property=ingressShim.defaultIssuerName
377
# defaultIssuerName: ""
378
379
# Optional default issuer kind to use for ingress resources.
380
# +docs:property=ingressShim.defaultIssuerKind
381
# defaultIssuerKind: ""
382
383
# Optional default issuer group to use for ingress resources.
384
# +docs:property=ingressShim.defaultIssuerGroup
385
# defaultIssuerGroup: ""
386
387
# Use these variables to configure the HTTP_PROXY environment variables.
388
389
# Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
390
# +docs:property
391
# http_proxy: "http://proxy:8080"
392
393
# Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
394
# +docs:property
395
# https_proxy: "https://proxy:8080"
396
397
# Configures the NO_PROXY environment variable where a HTTP proxy is required,
398
# but certain domains should be excluded.
399
# +docs:property
400
# no_proxy: 127.0.0.1,localhost
401
402
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
403
#
404
# For example:
405
# affinity:
406
# nodeAffinity:
407
# requiredDuringSchedulingIgnoredDuringExecution:
408
# nodeSelectorTerms:
409
# - matchExpressions:
410
# - key: foo.bar.com/role
411
# operator: In
412
# values:
413
# - master
414
affinity: {}
415
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
416
#
417
# For example:
418
# tolerations:
419
# - key: foo.bar.com/role
420
# operator: Equal
421
# value: master
422
# effect: NoSchedule
423
tolerations: []
424
# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
425
#
426
# For example:
427
# topologySpreadConstraints:
428
# - maxSkew: 2
429
# topologyKey: topology.kubernetes.io/zone
430
# whenUnsatisfiable: ScheduleAnyway
431
# labelSelector:
432
# matchLabels:
433
# app.kubernetes.io/instance: cert-manager
434
# app.kubernetes.io/component: controller
435
topologySpreadConstraints: []
436
# LivenessProbe settings for the controller container of the controller Pod.
437
#
438
# This is enabled by default, in order to enable the clock-skew liveness probe that
439
# restarts the controller in case of a skew between the system clock and the monotonic clock.
440
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
441
# controller-manager. For more information see the following on the
442
# [Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245)
443
# +docs:property
444
livenessProbe:
445
enabled: true
446
initialDelaySeconds: 10
447
periodSeconds: 10
448
timeoutSeconds: 15
449
successThreshold: 1
450
failureThreshold: 8
451
# enableServiceLinks indicates whether information about services should be
452
# injected into the pod's environment variables, matching the syntax of Docker
453
# links.
454
enableServiceLinks: false
455
# +docs:section=Prometheus
456
prometheus:
457
# Enable Prometheus monitoring for the cert-manager controller and webhook.
458
# If you use the Prometheus Operator, set prometheus.podmonitor.enabled or
459
# prometheus.servicemonitor.enabled, to create a PodMonitor or a
460
# ServiceMonitor resource.
461
# Otherwise, 'prometheus.io' annotations are added to the cert-manager and
462
# cert-manager-webhook Deployments.
463
# Note that you cannot enable both PodMonitor and ServiceMonitor as they are
464
# mutually exclusive. Enabling both will result in an error.
465
enabled: true
466
servicemonitor:
467
# Create a ServiceMonitor to add cert-manager to Prometheus.
468
enabled: false
469
# The namespace that the service monitor should live in, defaults
470
# to the cert-manager namespace.
471
# +docs:property
472
# namespace: cert-manager
473
474
# Specifies the `prometheus` label on the created ServiceMonitor. This is
475
# used when different Prometheus instances have label selectors matching
476
# different ServiceMonitors.
477
prometheusInstance: default
478
# The target port to set on the ServiceMonitor. This must match the port that the
479
# cert-manager controller is listening on for metrics.
480
# +docs:type=string,integer
481
targetPort: http-metrics
482
# The path to scrape for metrics.
483
path: /metrics
484
# The interval to scrape metrics.
485
interval: 60s
486
# The timeout before a metrics scrape fails.
487
scrapeTimeout: 30s
488
# Additional labels to add to the ServiceMonitor.
489
labels: {}
490
# Additional annotations to add to the ServiceMonitor.
491
annotations: {}
492
# Keep labels from scraped data, overriding server-side labels.
493
honorLabels: false
494
# EndpointAdditionalProperties allows setting additional properties on the
495
# endpoint such as relabelings, metricRelabelings etc.
496
#
497
# For example:
498
# endpointAdditionalProperties:
499
# relabelings:
500
# - action: replace
501
# sourceLabels:
502
# - __meta_kubernetes_pod_node_name
503
# targetLabel: instance
504
#
505
# +docs:property
506
endpointAdditionalProperties: {}
507
# Note that you cannot enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
508
podmonitor:
509
# Create a PodMonitor to add cert-manager to Prometheus.
510
enabled: false
511
# The namespace that the pod monitor should live in, defaults
512
# to the cert-manager namespace.
513
# +docs:property
514
# namespace: cert-manager
515
516
# Specifies the `prometheus` label on the created PodMonitor. This is
517
# used when different Prometheus instances have label selectors matching
518
# different PodMonitors.
519
prometheusInstance: default
520
# The path to scrape for metrics.
521
path: /metrics
522
# The interval to scrape metrics.
523
interval: 60s
524
# The timeout before a metrics scrape fails.
525
scrapeTimeout: 30s
526
# Additional labels to add to the PodMonitor.
527
labels: {}
528
# Additional annotations to add to the PodMonitor.
529
annotations: {}
530
# Keep labels from scraped data, overriding server-side labels.
531
honorLabels: false
532
# EndpointAdditionalProperties allows setting additional properties on the
533
# endpoint such as relabelings, metricRelabelings etc.
534
#
535
# For example:
536
# endpointAdditionalProperties:
537
# relabelings:
538
# - action: replace
539
# sourceLabels:
540
# - __meta_kubernetes_pod_node_name
541
# targetLabel: instance
542
# # Configure the PodMonitor for TLS connections
543
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
544
# scheme: https
545
# tlsConfig:
546
# serverName: cert-manager-metrics
547
# ca:
548
# secret:
549
# name: cert-manager-metrics-ca
550
# key: "tls.crt"
551
#
552
# +docs:property
553
endpointAdditionalProperties: {}
554
# +docs:section=Webhook
555
webhook:
556
# Number of replicas of the cert-manager webhook to run.
557
#
558
# The default is 1, but in production set this to 2 or 3 to provide high
559
# availability.
560
#
561
# If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.
562
replicaCount: 1
563
# The number of seconds the API server should wait for the webhook to respond before treating the call as a failure.
564
# The value must be between 1 and 30 seconds. For more information, see
565
# [Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).
566
#
567
# The default is set to the maximum value of 30 seconds as
568
# users sometimes report that the connection between the K8S API server and
569
# the cert-manager webhook server times out.
570
# If *this* timeout is reached, the error message will be "context deadline exceeded",
571
# which doesn't help the user diagnose what phase of the HTTPS connection timed out.
572
# For example, it could be during DNS resolution, TCP connection, TLS
573
# negotiation, HTTP negotiation, or slow HTTP response from the webhook
574
# server.
575
# By setting this timeout to its maximum value the underlying timeout error
576
# message has more chance of being returned to the end user.
577
timeoutSeconds: 30
578
# This is used to configure options for the webhook pod.
579
# This allows setting options that would usually be provided using flags.
580
#
581
# If `apiVersion` and `kind` are unspecified they default to the current latest
582
# version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin
583
# the version by specifying the `apiVersion` yourself.
584
#
585
# For example:
586
# apiVersion: webhook.config.cert-manager.io/v1alpha1
587
# kind: WebhookConfiguration
588
# # The port that the webhook listens on for requests.
589
# # In GKE private clusters, by default Kubernetes apiservers are allowed to
590
# # talk to the cluster nodes only on 443 and 10250. Configuring
591
# # securePort: 10250 therefore will work out-of-the-box without needing to add firewall
592
# # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.
593
# # This should be uncommented and set as a default by the chart once
594
# # the apiVersion of WebhookConfiguration graduates beyond v1alpha1.
595
# securePort: 10250
596
# # Configure the metrics server for TLS
597
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
598
# metricsTLSConfig:
599
# dynamic:
600
# secretNamespace: "cert-manager"
601
# secretName: "cert-manager-metrics-ca"
602
# dnsNames:
603
# - cert-manager-metrics
604
config: {}
605
# The update strategy for the cert-manager webhook deployment.
606
# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)
607
#
608
# For example:
609
# strategy:
610
# type: RollingUpdate
611
# rollingUpdate:
612
# maxSurge: 0
613
# maxUnavailable: 1
614
strategy: {}
615
# Pod Security Context to be set on the webhook component Pod.
616
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
617
# +docs:property
618
securityContext:
619
runAsNonRoot: true
620
seccompProfile:
621
type: RuntimeDefault
622
# Container Security Context to be set on the webhook component container.
623
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
624
# +docs:property
625
containerSecurityContext:
626
allowPrivilegeEscalation: false
627
capabilities:
628
drop:
629
- ALL
630
readOnlyRootFilesystem: true
631
podDisruptionBudget:
632
# Enable or disable the PodDisruptionBudget resource.
633
#
634
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
635
# For example, the PodDisruptionBudget will block `kubectl drain`
636
# if it is used on the Node where the only remaining cert-manager
637
# Pod is currently running.
638
enabled: false
639
# This property configures the minimum available pods for disruptions. Can either be set to
640
# an integer (e.g., 1) or a percentage value (e.g., 25%).
641
# It cannot be used if `maxUnavailable` is set.
642
# +docs:property
643
# +docs:type=unknown
644
# minAvailable: 1
645
# This property configures the maximum unavailable pods for disruptions. Can either be set to
646
# an integer (e.g., 1) or a percentage value (e.g., 25%).
647
# It cannot be used if `minAvailable` is set.
648
# +docs:property
649
# +docs:type=unknown
650
# maxUnavailable: 1
651
652
# Optional additional annotations to add to the webhook Deployment.
653
# +docs:property
654
# deploymentAnnotations: {}
655
656
# Optional additional annotations to add to the webhook Pods.
657
# +docs:property
658
# podAnnotations: {}
659
660
# Optional additional annotations to add to the webhook Service.
661
# +docs:property
662
# serviceAnnotations: {}
663
664
# Optional additional annotations to add to the webhook MutatingWebhookConfiguration.
665
# +docs:property
666
# mutatingWebhookConfigurationAnnotations: {}
667
668
# Optional additional annotations to add to the webhook ValidatingWebhookConfiguration.
669
# +docs:property
670
# validatingWebhookConfigurationAnnotations: {}
671
validatingWebhookConfiguration:
672
# Configure spec.namespaceSelector for validating webhooks.
673
# +docs:property
674
namespaceSelector:
675
matchExpressions:
676
- key: "cert-manager.io/disable-validation"
677
operator: "NotIn"
678
values:
679
- "true"
680
mutatingWebhookConfiguration:
681
# Configure spec.namespaceSelector for mutating webhooks.
682
# +docs:property
683
namespaceSelector: {}
684
# matchLabels:
685
# key: value
686
# matchExpressions:
687
# - key: kubernetes.io/metadata.name
688
# operator: NotIn
689
# values:
690
# - kube-system
691
# Additional command line flags to pass to cert-manager webhook binary.
692
# To see all available flags run `docker run quay.io/jetstack/cert-manager-webhook:<version> --help`.
693
extraArgs: []
694
# Path to a file containing a WebhookConfiguration object used to configure the webhook.
695
# - --config=<path-to-config-file>
696
697
# Additional environment variables to pass to cert-manager webhook binary.
698
# For example:
699
# extraEnv:
700
# - name: SOME_VAR
701
# value: 'some value'
702
extraEnv: []
703
# Comma separated list of feature gates that should be enabled on the
704
# webhook pod.
705
featureGates: ""
706
# Resources to provide to the cert-manager webhook pod.
707
#
708
# For example:
709
# requests:
710
# cpu: 10m
711
# memory: 32Mi
712
#
713
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
714
resources: {}
715
# Liveness probe values.
716
# For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
717
#
718
# +docs:property
719
livenessProbe:
720
failureThreshold: 3
721
initialDelaySeconds: 60
722
periodSeconds: 10
723
successThreshold: 1
724
timeoutSeconds: 1
725
# Readiness probe values.
726
# For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
727
#
728
# +docs:property
729
readinessProbe:
730
failureThreshold: 3
731
initialDelaySeconds: 5
732
periodSeconds: 5
733
successThreshold: 1
734
timeoutSeconds: 1
735
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
736
# matching labels.
737
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
738
#
739
# This default ensures that Pods are only scheduled to Linux nodes.
740
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
741
# +docs:property
742
nodeSelector:
743
kubernetes.io/os: linux
744
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
745
#
746
# For example:
747
# affinity:
748
# nodeAffinity:
749
# requiredDuringSchedulingIgnoredDuringExecution:
750
# nodeSelectorTerms:
751
# - matchExpressions:
752
# - key: foo.bar.com/role
753
# operator: In
754
# values:
755
# - master
756
affinity: {}
757
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
758
#
759
# For example:
760
# tolerations:
761
# - key: foo.bar.com/role
762
# operator: Equal
763
# value: master
764
# effect: NoSchedule
765
tolerations: []
766
# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
767
#
768
# For example:
769
# topologySpreadConstraints:
770
# - maxSkew: 2
771
# topologyKey: topology.kubernetes.io/zone
772
# whenUnsatisfiable: ScheduleAnyway
773
# labelSelector:
774
# matchLabels:
775
# app.kubernetes.io/instance: cert-manager
776
# app.kubernetes.io/component: controller
777
topologySpreadConstraints: []
778
# Optional additional labels to add to the Webhook Pods.
779
podLabels: {}
780
# Optional additional labels to add to the Webhook Service.
781
serviceLabels: {}
782
# Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services).
783
serviceIPFamilyPolicy: ""
784
# Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
785
serviceIPFamilies: []
786
image:
787
# The container registry to pull the webhook image from.
788
# +docs:property
789
# registry: quay.io
790
791
# The container image for the cert-manager webhook
792
# +docs:property
793
repository: chainguard-private/cert-manager-webhook
794
# Override the image tag to deploy by setting this variable.
795
# If no value is set, the chart's appVersion will be used.
796
# +docs:property
797
# tag: vX.Y.Z
798
799
# Setting a digest will override any tag
800
# +docs:property
801
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
802
803
# Kubernetes imagePullPolicy on Deployment.
804
pullPolicy: IfNotPresent
805
registry: chainreg.biz
806
tag: "1.18"
807
digest: sha256:64b5bff1ad90a5eb2233e15e76d58dda61731678b99a0d89c75588bff6bc3faa
808
serviceAccount:
809
# Specifies whether a service account should be created.
810
create: true
811
# The name of the service account to use.
812
# If not set and create is true, a name is generated using the fullname template.
813
# +docs:property
814
# name: ""
815
816
# Optional additional annotations to add to the webhook's Service Account.
817
# +docs:property
818
# annotations: {}
819
820
# Optional additional labels to add to the webhook's Service Account.
821
# +docs:property
822
# labels: {}
823
824
# Automount API credentials for a Service Account.
825
automountServiceAccountToken: true
826
# Automounting API credentials for a particular pod.
827
# +docs:property
828
# automountServiceAccountToken: true
829
830
# The port that the webhook listens on for requests.
831
# In GKE private clusters, by default Kubernetes apiservers are allowed to
832
# talk to the cluster nodes only on 443 and 10250. Configuring
833
# securePort: 10250, therefore will work out-of-the-box without needing to add firewall
834
# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
835
securePort: 10250
836
# Specifies if the webhook should be started in hostNetwork mode.
837
#
838
# Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
839
# CNI (such as calico), because control-plane managed by AWS cannot communicate
840
# with pods' IP CIDR and admission webhooks are not working
841
#
842
# Since the default port for the webhook conflicts with kubelet on the host
843
# network, `webhook.securePort` should be changed to an available port if
844
# running in hostNetwork mode.
845
hostNetwork: false
846
# Specifies how the service should be handled. Useful if you want to expose the
847
# webhook outside of the cluster. In some cases, the control plane cannot
848
# reach internal services.
849
serviceType: ClusterIP
850
# Specify the load balancer IP for the created service.
851
# +docs:property
852
# loadBalancerIP: "10.10.10.10"
853
854
# Overrides the mutating webhook and validating webhook so they reach the webhook
855
# service using the `url` field instead of a service.
856
url: {}
857
# host:
858
859
# Enables default network policies for webhooks.
860
networkPolicy:
861
# Create network policies for the webhooks.
862
enabled: false
863
# Ingress rule for the webhook network policy. By default, it allows all
864
# inbound traffic.
865
# +docs:property
866
ingress:
867
- from:
868
- ipBlock:
869
cidr: 0.0.0.0/0
870
# Egress rule for the webhook network policy. By default, it allows all
871
# outbound traffic to ports 80 and 443, as well as DNS ports.
872
# +docs:property
873
egress:
874
- ports:
875
- port: 80
876
protocol: TCP
877
- port: 443
878
protocol: TCP
879
- port: 53
880
protocol: TCP
881
- port: 53
882
protocol: UDP
883
# On OpenShift and OKD, the Kubernetes API server listens on.
884
# port 6443.
885
- port: 6443
886
protocol: TCP
887
to:
888
- ipBlock:
889
cidr: 0.0.0.0/0
890
# Additional volumes to add to the cert-manager controller pod.
891
volumes: []
892
# Additional volume mounts to add to the cert-manager controller container.
893
volumeMounts: []
894
# enableServiceLinks indicates whether information about services should be
895
# injected into the pod's environment variables, matching the syntax of Docker
896
# links.
897
enableServiceLinks: false
898
# +docs:section=CA Injector
899
cainjector:
900
# Create the CA Injector deployment
901
enabled: true
902
# The number of replicas of the cert-manager cainjector to run.
903
#
904
# The default is 1, but in production set this to 2 or 3 to provide high
905
# availability.
906
#
907
# If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.
908
#
909
# Note that cert-manager uses leader election to ensure that there can
910
# only be a single instance active at a time.
911
replicaCount: 1
912
# This is used to configure options for the cainjector pod.
913
# It allows setting options that are usually provided via flags.
914
#
915
# If `apiVersion` and `kind` are unspecified they default to the current latest
916
# version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin
917
# the version by specifying the `apiVersion` yourself.
918
#
919
# For example:
920
# apiVersion: cainjector.config.cert-manager.io/v1alpha1
921
# kind: CAInjectorConfiguration
922
# logging:
923
# verbosity: 2
924
# format: text
925
# leaderElectionConfig:
926
# namespace: kube-system
927
# # Configure the metrics server for TLS
928
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
929
# metricsTLSConfig:
930
# dynamic:
931
# secretNamespace: "cert-manager"
932
# secretName: "cert-manager-metrics-ca"
933
# dnsNames:
934
# - cert-manager-metrics
935
config: {}
936
# Deployment update strategy for the cert-manager cainjector deployment.
937
# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
938
#
939
# For example:
940
# strategy:
941
# type: RollingUpdate
942
# rollingUpdate:
943
# maxSurge: 0
944
# maxUnavailable: 1
945
strategy: {}
946
# Pod Security Context to be set on the cainjector component Pod
947
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
948
# +docs:property
949
securityContext:
950
runAsNonRoot: true
951
seccompProfile:
952
type: RuntimeDefault
953
# Container Security Context to be set on the cainjector component container
954
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
955
# +docs:property
956
containerSecurityContext:
957
allowPrivilegeEscalation: false
958
capabilities:
959
drop:
960
- ALL
961
readOnlyRootFilesystem: true
962
podDisruptionBudget:
963
# Enable or disable the PodDisruptionBudget resource.
964
#
965
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
966
# For example, the PodDisruptionBudget will block `kubectl drain`
967
# if it is used on the Node where the only remaining cert-manager
968
# Pod is currently running.
969
enabled: false
970
# `minAvailable` configures the minimum available pods for disruptions. It can either be set to
971
# an integer (e.g., 1) or a percentage value (e.g., 25%).
972
# Cannot be used if `maxUnavailable` is set.
973
# +docs:property
974
# +docs:type=unknown
975
# minAvailable: 1
976
# `maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to
977
# an integer (e.g., 1) or a percentage value (e.g., 25%).
978
# Cannot be used if `minAvailable` is set.
979
# +docs:property
980
# +docs:type=unknown
981
# maxUnavailable: 1
982
983
# Optional additional annotations to add to the cainjector Deployment.
984
# +docs:property
985
# deploymentAnnotations: {}
986
987
# Optional additional annotations to add to the cainjector Pods.
988
# +docs:property
989
# podAnnotations: {}
990
991
# Optional additional annotations to add to the cainjector metrics Service.
992
# +docs:property
993
# serviceAnnotations: {}
994
995
# Additional command line flags to pass to cert-manager cainjector binary.
996
# To see all available flags run `docker run quay.io/jetstack/cert-manager-cainjector:<version> --help`.
997
extraArgs: []
998
# Enable profiling for cainjector.
999
# - --enable-profiling=true
1000
1001
# Additional environment variables to pass to cert-manager cainjector binary.
1002
# For example:
1003
# extraEnv:
1004
# - name: SOME_VAR
1005
# value: 'some value'
1006
extraEnv: []
1007
# Comma separated list of feature gates that should be enabled on the
1008
# cainjector pod.
1009
featureGates: ""
1010
# Resources to provide to the cert-manager cainjector pod.
1011
#
1012
# For example:
1013
# requests:
1014
# cpu: 10m
1015
# memory: 32Mi
1016
#
1017
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
1018
resources: {}
1019
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
1020
# matching labels.
1021
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
1022
#
1023
# This default ensures that Pods are only scheduled to Linux nodes.
1024
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
1025
# +docs:property
1026
nodeSelector:
1027
kubernetes.io/os: linux
1028
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
1029
#
1030
# For example:
1031
# affinity:
1032
# nodeAffinity:
1033
# requiredDuringSchedulingIgnoredDuringExecution:
1034
# nodeSelectorTerms:
1035
# - matchExpressions:
1036
# - key: foo.bar.com/role
1037
# operator: In
1038
# values:
1039
# - master
1040
affinity: {}
1041
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
1042
#
1043
# For example:
1044
# tolerations:
1045
# - key: foo.bar.com/role
1046
# operator: Equal
1047
# value: master
1048
# effect: NoSchedule
1049
tolerations: []
1050
# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
1051
#
1052
# For example:
1053
# topologySpreadConstraints:
1054
# - maxSkew: 2
1055
# topologyKey: topology.kubernetes.io/zone
1056
# whenUnsatisfiable: ScheduleAnyway
1057
# labelSelector:
1058
# matchLabels:
1059
# app.kubernetes.io/instance: cert-manager
1060
# app.kubernetes.io/component: controller
1061
topologySpreadConstraints: []
1062
# Optional additional labels to add to the CA Injector Pods.
1063
podLabels: {}
1064
# Optional additional labels to add to the CA Injector metrics Service.
1065
serviceLabels: {}
1066
image:
1067
# The container registry to pull the cainjector image from.
1068
# +docs:property
1069
# registry: quay.io
1070
1071
# The container image for the cert-manager cainjector
1072
# +docs:property
1073
repository: chainguard-private/cert-manager-cainjector
1074
# Override the image tag to deploy by setting this variable.
1075
# If no value is set, the chart's appVersion will be used.
1076
# +docs:property
1077
# tag: vX.Y.Z
1078
1079
# Setting a digest will override any tag.
1080
# +docs:property
1081
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
1082
1083
# Kubernetes imagePullPolicy on Deployment.
1084
pullPolicy: IfNotPresent
1085
registry: chainreg.biz
1086
tag: "1.18"
1087
digest: sha256:29ab7d71313225a31528d3e0af28983e34f2fd96501edc47206a9cdd09553de9
1088
serviceAccount:
1089
# Specifies whether a service account should be created.
1090
create: true
1091
# The name of the service account to use.
1092
# If not set and create is true, a name is generated using the fullname template
1093
# +docs:property
1094
# name: ""
1095
1096
# Optional additional annotations to add to the cainjector's Service Account.
1097
# +docs:property
1098
# annotations: {}
1099
1100
# Optional additional labels to add to the cainjector's Service Account.
1101
# +docs:property
1102
# labels: {}
1103
1104
# Automount API credentials for a Service Account.
1105
automountServiceAccountToken: true
1106
# Automounting API credentials for a particular pod.
1107
# +docs:property
1108
# automountServiceAccountToken: true
1109
1110
# Additional volumes to add to the cert-manager controller pod.
1111
volumes: []
1112
# Additional volume mounts to add to the cert-manager controller container.
1113
volumeMounts: []
1114
# enableServiceLinks indicates whether information about services should be
1115
# injected into the pod's environment variables, matching the syntax of Docker
1116
# links.
1117
enableServiceLinks: false
1118
# +docs:section=ACME Solver
1119
acmesolver:
1120
image:
1121
# The container registry to pull the acmesolver image from.
1122
# +docs:property
1123
# registry: quay.io
1124
1125
# The container image for the cert-manager acmesolver.
1126
# +docs:property
1127
repository: chainguard-private/cert-manager-acmesolver
1128
# Override the image tag to deploy by setting this variable.
1129
# If no value is set, the chart's appVersion is used.
1130
# +docs:property
1131
# tag: vX.Y.Z
1132
1133
# Setting a digest will override any tag.
1134
# +docs:property
1135
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
1136
1137
# Kubernetes imagePullPolicy on Deployment.
1138
pullPolicy: IfNotPresent
1139
registry: chainreg.biz
1140
tag: "1.18"
1141
digest: sha256:8ec27d7b6a35e503ad657eab4d8ceb0b240d06e4f2bb659afb68e2cf1f515a28
1142
# +docs:section=Startup API Check
1143
# This startupapicheck is a Helm post-install hook that waits for the webhook
1144
# endpoints to become available.
1145
# The check is implemented using a Kubernetes Job - if you are injecting mesh
1146
# sidecar proxies into cert-manager pods, ensure that they
1147
# are not injected into this Job's pod. Otherwise, the installation may time out
1148
# owing to the Job never being completed because the sidecar proxy does not exit.
1149
# For more information, see [this note](https://github.com/cert-manager/cert-manager/pull/4414).
1150
startupapicheck:
1151
# Enables the startup api check.
1152
enabled: true
1153
# Pod Security Context to be set on the startupapicheck component Pod.
1154
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
1155
# +docs:property
1156
securityContext:
1157
runAsNonRoot: true
1158
seccompProfile:
1159
type: RuntimeDefault
1160
# Container Security Context to be set on the controller component container.
1161
# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
1162
# +docs:property
1163
containerSecurityContext:
1164
allowPrivilegeEscalation: false
1165
capabilities:
1166
drop:
1167
- ALL
1168
readOnlyRootFilesystem: true
1169
# Timeout for 'kubectl check api' command.
1170
timeout: 1m
1171
# Job backoffLimit
1172
backoffLimit: 4
1173
# Optional additional annotations to add to the startupapicheck Job.
1174
# +docs:property
1175
jobAnnotations:
1176
helm.sh/hook: post-install
1177
helm.sh/hook-weight: "1"
1178
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
1179
# Optional additional annotations to add to the startupapicheck Pods.
1180
# +docs:property
1181
# podAnnotations: {}
1182
1183
# Additional command line flags to pass to startupapicheck binary.
1184
# To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.
1185
#
1186
# Verbose logging is enabled by default so that if startupapicheck fails, you
1187
# can know what exactly caused the failure. Verbose logs include details of
1188
# the webhook URL, IP address and TCP connect errors for example.
1189
# +docs:property
1190
extraArgs:
1191
- -v
1192
# Additional environment variables to pass to cert-manager startupapicheck binary.
1193
# For example:
1194
# extraEnv:
1195
# - name: SOME_VAR
1196
# value: 'some value'
1197
extraEnv: []
1198
# Resources to provide to the cert-manager controller pod.
1199
#
1200
# For example:
1201
# requests:
1202
# cpu: 10m
1203
# memory: 32Mi
1204
#
1205
# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
1206
resources: {}
1207
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
1208
# matching labels.
1209
# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
1210
#
1211
# This default ensures that Pods are only scheduled to Linux nodes.
1212
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
1213
# +docs:property
1214
nodeSelector:
1215
kubernetes.io/os: linux
1216
# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
1217
# For example:
1218
# affinity:
1219
# nodeAffinity:
1220
# requiredDuringSchedulingIgnoredDuringExecution:
1221
# nodeSelectorTerms:
1222
# - matchExpressions:
1223
# - key: foo.bar.com/role
1224
# operator: In
1225
# values:
1226
# - master
1227
affinity: {}
1228
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
1229
#
1230
# For example:
1231
# tolerations:
1232
# - key: foo.bar.com/role
1233
# operator: Equal
1234
# value: master
1235
# effect: NoSchedule
1236
tolerations: []
1237
# Optional additional labels to add to the startupapicheck Pods.
1238
podLabels: {}
1239
image:
1240
# The container registry to pull the startupapicheck image from.
1241
# +docs:property
1242
# registry: quay.io
1243
1244
# The container image for the cert-manager startupapicheck.
1245
# +docs:property
1246
repository: chainguard-private/cert-manager-startupapicheck
1247
# Override the image tag to deploy by setting this variable.
1248
# If no value is set, the chart's appVersion is used.
1249
# +docs:property
1250
# tag: vX.Y.Z
1251
1252
# Setting a digest will override any tag.
1253
# +docs:property
1254
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
1255
1256
# Kubernetes imagePullPolicy on Deployment.
1257
pullPolicy: IfNotPresent
1258
registry: chainreg.biz
1259
tag: "1.18"
1260
digest: sha256:1b8550a65afd768fffba88a9d097b78de7a0b8520a1b859a554f965ba702adab
1261
rbac:
1262
# annotations for the startup API Check job RBAC and PSP resources.
1263
# +docs:property
1264
annotations:
1265
helm.sh/hook: post-install
1266
helm.sh/hook-weight: "-5"
1267
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
1268
# Automounting API credentials for a particular pod.
1269
# +docs:property
1270
# automountServiceAccountToken: true
1271
serviceAccount:
1272
# Specifies whether a service account should be created.
1273
create: true
1274
# The name of the service account to use.
1275
# If not set and create is true, a name is generated using the fullname template.
1276
# +docs:property
1277
# name: ""
1278
1279
# Optional additional annotations to add to the Job's Service Account.
1280
# +docs:property
1281
annotations:
1282
helm.sh/hook: post-install
1283
helm.sh/hook-weight: "-5"
1284
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
1285
# Automount API credentials for a Service Account.
1286
# +docs:property
1287
automountServiceAccountToken: true
1288
# Optional additional labels to add to the startupapicheck's Service Account.
1289
# +docs:property
1290
# labels: {}
1291
# Additional volumes to add to the cert-manager controller pod.
1292
volumes: []
1293
# Additional volume mounts to add to the cert-manager controller container.
1294
volumeMounts: []
1295
# enableServiceLinks indicates whether information about services should be
1296
# injected into pod's environment variables, matching the syntax of Docker
1297
# links.
1298
enableServiceLinks: false
1299
# Create dynamic manifests via values.
1300
#
1301
# For example:
1302
# extraObjects:
1303
# - |
1304
# apiVersion: v1
1305
# kind: ConfigMap
1306
# metadata:
1307
# name: '{{ template "cert-manager.fullname" . }}-extra-configmap'
1308
extraObjects: []
1309
# Field used by our release pipeline to produce the static manifests.
1310
# The field defaults to "helm" but is set to "static" when we render
1311
# the static YAML manifests.
1312
# +docs:hidden
1313
creator: "helm"
1314
# Field that can be used as a condition when cert-manager is a dependency.
1315
# This definition is only here as a placeholder such that it is included in
1316
# the json schema.
1317
# See https://helm.sh/docs/chart_best_practices/dependencies/#conditions-and-tags
1318
# for more info.
1319
# +docs:hidden
1320
enabled: true
1321
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.