Gitiles
Code Review Sign In
code.v1.dodo.cloud / helm-charts / 4e166dccd0dd304bf1e1abc9891ada6f3337d7f4 / . / charts / cert-manager-1.20.3 / templates / crd-cert-manager.io_certificates.yaml
blob: 7ebc08e679ca30f8835abb7b401ff52effa052cc [file] [log] [blame]
Giorgi Lekveishviliea328da2026-07-29 12:15:15 +0400[diff] [blame]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "certificates.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: Certificate
18 listKind: CertificateList
19 plural: certificates
20 shortNames:
21 - cert
22 - certs
23 singular: certificate
24 scope: Namespaced
25 versions:
26 - additionalPrinterColumns:
27 - jsonPath: .status.conditions[?(@.type == "Ready")].status
28 name: Ready
29 type: string
30 - jsonPath: .spec.secretName
31 name: Secret
32 type: string
33 - jsonPath: .spec.issuerRef.name
34 name: Issuer
35 priority: 1
36 type: string
37 - jsonPath: .status.conditions[?(@.type == "Ready")].message
38 name: Status
39 priority: 1
40 type: string
41 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
42 jsonPath: .metadata.creationTimestamp
43 name: Age
44 type: date
45 name: v1
46 schema:
47 openAPIV3Schema:
48 description: |-
49 A Certificate resource should be created to ensure an up to date and signed
50 X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
51
52 The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
53 properties:
54 apiVersion:
55 description: |-
56 APIVersion defines the versioned schema of this representation of an object.
57 Servers should convert recognized schemas to the latest internal value, and
58 may reject unrecognized values.
59 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
60 type: string
61 kind:
62 description: |-
63 Kind is a string value representing the REST resource this object represents.
64 Servers may infer this from the endpoint the client submits requests to.
65 Cannot be updated.
66 In CamelCase.
67 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
68 type: string
69 metadata:
70 type: object
71 spec:
72 description: |-
73 Specification of the desired state of the Certificate resource.
74 https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
75 properties:
76 additionalOutputFormats:
77 description: |-
78 Defines extra output formats of the private key and signed certificate chain
79 to be written to this Certificate's target Secret.
80 items:
81 description: |-
82 CertificateAdditionalOutputFormat defines an additional output format of a
83 Certificate resource. These contain supplementary data formats of the signed
84 certificate chain and paired private key.
85 properties:
86 type:
87 description: |-
88 Type is the name of the format type that should be written to the
89 Certificate's target Secret.
90 enum:
91 - DER
92 - CombinedPEM
93 type: string
94 required:
95 - type
96 type: object
97 type: array
98 x-kubernetes-list-type: atomic
99 commonName:
100 description: |-
101 Requested common name X509 certificate subject attribute.
102 More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
103 NOTE: TLS clients will ignore this value when any subject alternative name is
104 set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
105
106 Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
107 Cannot be set if the `literalSubject` field is set.
108 type: string
109 dnsNames:
110 description: Requested DNS subject alternative names.
111 items:
112 type: string
113 type: array
114 x-kubernetes-list-type: atomic
115 duration:
116 description: |-
117 Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
118 issuer may choose to ignore the requested duration, just like any other
119 requested attribute.
120
121 If unset, this defaults to 90 days.
122 Minimum accepted duration is 1 hour.
123 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
124 type: string
125 emailAddresses:
126 description: Requested email subject alternative names.
127 items:
128 type: string
129 type: array
130 x-kubernetes-list-type: atomic
131 encodeUsagesInRequest:
132 description: |-
133 Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
134
135 This option defaults to true, and should only be disabled if the target
136 issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
137 type: boolean
138 ipAddresses:
139 description: Requested IP address subject alternative names.
140 items:
141 type: string
142 type: array
143 x-kubernetes-list-type: atomic
144 isCA:
145 description: |-
146 Requested basic constraints isCA value.
147 The isCA value is used to set the `isCA` field on the created CertificateRequest
148 resources. Note that the issuer may choose to ignore the requested isCA value, just
149 like any other requested attribute.
150
151 If true, this will automatically add the `cert sign` usage to the list
152 of requested `usages`.
153 type: boolean
154 issuerRef:
155 description: |-
156 Reference to the issuer responsible for issuing the certificate.
157 If the issuer is namespace-scoped, it must be in the same namespace
158 as the Certificate. If the issuer is cluster-scoped, it can be used
159 from any namespace.
160
161 The `name` field of the reference must always be specified.
162 properties:
163 group:
164 description: |-
165 Group of the issuer being referred to.
166 Defaults to 'cert-manager.io'.
167 type: string
168 kind:
169 description: |-
170 Kind of the issuer being referred to.
171 Defaults to 'Issuer'.
172 type: string
173 name:
174 description: Name of the issuer being referred to.
175 type: string
176 required:
177 - name
178 type: object
179 keystores:
180 description: Additional keystore output formats to be stored in the Certificate's Secret.
181 properties:
182 jks:
183 description: |-
184 JKS configures options for storing a JKS keystore in the
185 `spec.secretName` Secret resource.
186 properties:
187 alias:
188 description: |-
189 Alias specifies the alias of the key in the keystore, required by the JKS format.
190 If not provided, the default alias `certificate` will be used.
191 type: string
192 create:
193 description: |-
194 Create enables JKS keystore creation for the Certificate.
195 If true, a file named `keystore.jks` will be created in the target
196 Secret resource, encrypted using the password stored in
197 `passwordSecretRef` or `password`.
198 The keystore file will be updated immediately.
199 If the issuer provided a CA certificate, a file named `truststore.jks`
200 will also be created in the target Secret resource, encrypted using the
201 password stored in `passwordSecretRef`
202 containing the issuing Certificate Authority
203 type: boolean
204 password:
205 description: |-
206 Password provides a literal password used to encrypt the JKS keystore.
207 Mutually exclusive with passwordSecretRef.
208 One of password or passwordSecretRef must provide a password with a non-zero length.
209 type: string
210 passwordSecretRef:
211 description: |-
212 PasswordSecretRef is a reference to a non-empty key in a Secret resource
213 containing the password used to encrypt the JKS keystore.
214 Mutually exclusive with password.
215 One of password or passwordSecretRef must provide a password with a non-zero length.
216 properties:
217 key:
218 description: |-
219 The key of the entry in the Secret resource's `data` field to be used.
220 Some instances of this field may be defaulted, in others it may be
221 required.
222 type: string
223 name:
224 description: |-
225 Name of the resource being referred to.
226 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
227 type: string
228 required:
229 - name
230 type: object
231 required:
232 - create
233 type: object
234 pkcs12:
235 description: |-
236 PKCS12 configures options for storing a PKCS12 keystore in the
237 `spec.secretName` Secret resource.
238 properties:
239 create:
240 description: |-
241 Create enables PKCS12 keystore creation for the Certificate.
242 If true, a file named `keystore.p12` will be created in the target
243 Secret resource, encrypted using the password stored in
244 `passwordSecretRef` or in `password`.
245 The keystore file will be updated immediately.
246 If the issuer provided a CA certificate, a file named `truststore.p12` will
247 also be created in the target Secret resource, encrypted using the
248 password stored in `passwordSecretRef` containing the issuing Certificate
249 Authority
250 type: boolean
251 password:
252 description: |-
253 Password provides a literal password used to encrypt the PKCS#12 keystore.
254 Mutually exclusive with passwordSecretRef.
255 One of password or passwordSecretRef must provide a password with a non-zero length.
256 type: string
257 passwordSecretRef:
258 description: |-
259 PasswordSecretRef is a reference to a non-empty key in a Secret resource
260 containing the password used to encrypt the PKCS#12 keystore.
261 Mutually exclusive with password.
262 One of password or passwordSecretRef must provide a password with a non-zero length.
263 properties:
264 key:
265 description: |-
266 The key of the entry in the Secret resource's `data` field to be used.
267 Some instances of this field may be defaulted, in others it may be
268 required.
269 type: string
270 name:
271 description: |-
272 Name of the resource being referred to.
273 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
274 type: string
275 required:
276 - name
277 type: object
278 profile:
279 description: |-
280 Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
281 used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
282
283 If provided, allowed values are:
284 `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
285 `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
286 `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
287 (e.g., because of company policy). Please note that the security of the algorithm is not that important
288 in reality, because the unencrypted certificate and private key are also stored in the Secret.
289 enum:
290 - LegacyRC2
291 - LegacyDES
292 - Modern2023
293 type: string
294 required:
295 - create
296 type: object
297 type: object
298 literalSubject:
299 description: |-
300 Requested X.509 certificate subject, represented using the LDAP "String
301 Representation of a Distinguished Name" [1].
302 Important: the LDAP string format also specifies the order of the attributes
303 in the subject, this is important when issuing certs for LDAP authentication.
304 Example: `CN=foo,DC=corp,DC=example,DC=com`
305 More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
306 More info: https://github.com/cert-manager/cert-manager/issues/3203
307 More info: https://github.com/cert-manager/cert-manager/issues/4424
308
309 Cannot be set if the `subject` or `commonName` field is set.
310 type: string
311 nameConstraints:
312 description: |-
313 x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
314 More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
315
316 This is an Alpha Feature and is only enabled with the
317 `--feature-gates=NameConstraints=true` option set on both
318 the controller and webhook components.
319 properties:
320 critical:
321 description: if true then the name constraints are marked critical.
322 type: boolean
323 excluded:
324 description: |-
325 Excluded contains the constraints which must be disallowed. Any name matching a
326 restriction in the excluded field is invalid regardless
327 of information appearing in the permitted
328 properties:
329 dnsDomains:
330 description: DNSDomains is a list of DNS domains that are permitted or excluded.
331 items:
332 type: string
333 type: array
334 x-kubernetes-list-type: atomic
335 emailAddresses:
336 description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
337 items:
338 type: string
339 type: array
340 x-kubernetes-list-type: atomic
341 ipRanges:
342 description: |-
343 IPRanges is a list of IP Ranges that are permitted or excluded.
344 This should be a valid CIDR notation.
345 items:
346 type: string
347 type: array
348 x-kubernetes-list-type: atomic
349 uriDomains:
350 description: URIDomains is a list of URI domains that are permitted or excluded.
351 items:
352 type: string
353 type: array
354 x-kubernetes-list-type: atomic
355 type: object
356 permitted:
357 description: Permitted contains the constraints in which the names must be located.
358 properties:
359 dnsDomains:
360 description: DNSDomains is a list of DNS domains that are permitted or excluded.
361 items:
362 type: string
363 type: array
364 x-kubernetes-list-type: atomic
365 emailAddresses:
366 description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
367 items:
368 type: string
369 type: array
370 x-kubernetes-list-type: atomic
371 ipRanges:
372 description: |-
373 IPRanges is a list of IP Ranges that are permitted or excluded.
374 This should be a valid CIDR notation.
375 items:
376 type: string
377 type: array
378 x-kubernetes-list-type: atomic
379 uriDomains:
380 description: URIDomains is a list of URI domains that are permitted or excluded.
381 items:
382 type: string
383 type: array
384 x-kubernetes-list-type: atomic
385 type: object
386 type: object
387 otherNames:
388 description: |-
389 `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
390 Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
391 Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
392 You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
393 items:
394 properties:
395 oid:
396 description: |-
397 OID is the object identifier for the otherName SAN.
398 The object identifier must be expressed as a dotted string, for
399 example, "1.2.840.113556.1.4.221".
400 type: string
401 utf8Value:
402 description: |-
403 utf8Value is the string value of the otherName SAN.
404 The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
405 type: string
406 type: object
407 type: array
408 x-kubernetes-list-type: atomic
409 privateKey:
410 description: |-
411 Private key options. These include the key algorithm and size, the used
412 encoding and the rotation policy.
413 properties:
414 algorithm:
415 description: |-
416 Algorithm is the private key algorithm of the corresponding private key
417 for this certificate.
418
419 If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
420 If `algorithm` is specified and `size` is not provided,
421 key size of 2048 will be used for `RSA` key algorithm and
422 key size of 256 will be used for `ECDSA` key algorithm.
423 key size is ignored when using the `Ed25519` key algorithm.
424 enum:
425 - RSA
426 - ECDSA
427 - Ed25519
428 type: string
429 encoding:
430 description: |-
431 The private key cryptography standards (PKCS) encoding for this
432 certificate's private key to be encoded in.
433
434 If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
435 and PKCS#8, respectively.
436 Defaults to `PKCS1` if not specified.
437 enum:
438 - PKCS1
439 - PKCS8
440 type: string
441 rotationPolicy:
442 description: |-
443 RotationPolicy controls how private keys should be regenerated when a
444 re-issuance is being processed.
445
446 If set to `Never`, a private key will only be generated if one does not
447 already exist in the target `spec.secretName`. If one does exist but it
448 does not have the correct algorithm or size, a warning will be raised
449 to await user intervention.
450 If set to `Always`, a private key matching the specified requirements
451 will be generated whenever a re-issuance occurs.
452 Default is `Always`.
453 The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
454 enum:
455 - Never
456 - Always
457 type: string
458 size:
459 description: |-
460 Size is the key bit size of the corresponding private key for this certificate.
461
462 If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
463 and will default to `2048` if not specified.
464 If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
465 and will default to `256` if not specified.
466 If `algorithm` is set to `Ed25519`, Size is ignored.
467 No other values are allowed.
468 type: integer
469 type: object
470 renewBefore:
471 description: |-
472 How long before the currently issued certificate's expiry cert-manager should
473 renew the certificate. For example, if a certificate is valid for 60 minutes,
474 and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
475 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
476 the certificate is no longer valid).
477
478 NOTE: The actual lifetime of the issued certificate is used to determine the
479 renewal time. If an issuer returns a certificate with a different lifetime than
480 the one requested, cert-manager will use the lifetime of the issued certificate.
481
482 If unset, this defaults to 1/3 of the issued certificate's lifetime.
483 Minimum accepted value is 5 minutes.
484 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
485 Cannot be set if the `renewBeforePercentage` field is set.
486 type: string
487 renewBeforePercentage:
488 description: |-
489 `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
490 rather than an absolute duration. For example, if a certificate is valid for 60
491 minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to
492 renew the certificate 45 minutes after it was issued (i.e. when there are 15
493 minutes (25%) remaining until the certificate is no longer valid).
494
495 NOTE: The actual lifetime of the issued certificate is used to determine the
496 renewal time. If an issuer returns a certificate with a different lifetime than
497 the one requested, cert-manager will use the lifetime of the issued certificate.
498
499 Value must be an integer in the range (0,100). The minimum effective
500 `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
501 minutes.
502 Cannot be set if the `renewBefore` field is set.
503 format: int32
504 type: integer
505 revisionHistoryLimit:
506 description: |-
507 The maximum number of CertificateRequest revisions that are maintained in
508 the Certificate's history. Each revision represents a single `CertificateRequest`
509 created by this Certificate, either when it was created, renewed, or Spec
510 was changed. Revisions will be removed by oldest first if the number of
511 revisions exceeds this number.
512
513 If set, revisionHistoryLimit must be a value of `1` or greater.
514 Default value is `1`.
515 format: int32
516 type: integer
517 secretName:
518 description: |-
519 Name of the Secret resource that will be automatically created and
520 managed by this Certificate resource. It will be populated with a
521 private key and certificate, signed by the denoted issuer. The Secret
522 resource lives in the same namespace as the Certificate resource.
523 type: string
524 secretTemplate:
525 description: |-
526 Defines annotations and labels to be copied to the Certificate's Secret.
527 Labels and annotations on the Secret will be changed as they appear on the
528 SecretTemplate when added or removed. SecretTemplate annotations are added
529 in conjunction with, and cannot overwrite, the base set of annotations
530 cert-manager sets on the Certificate's Secret.
531 properties:
532 annotations:
533 additionalProperties:
534 type: string
535 description: Annotations is a key value map to be copied to the target Kubernetes Secret.
536 type: object
537 labels:
538 additionalProperties:
539 type: string
540 description: Labels is a key value map to be copied to the target Kubernetes Secret.
541 type: object
542 type: object
543 signatureAlgorithm:
544 description: |-
545 Signature algorithm to use.
546 Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
547 Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
548 Allowed values for Ed25519 keys: PureEd25519.
549 enum:
550 - SHA256WithRSA
551 - SHA384WithRSA
552 - SHA512WithRSA
553 - ECDSAWithSHA256
554 - ECDSAWithSHA384
555 - ECDSAWithSHA512
556 - PureEd25519
557 type: string
558 subject:
559 description: |-
560 Requested set of X509 certificate subject attributes.
561 More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
562
563 The common name attribute is specified separately in the `commonName` field.
564 Cannot be set if the `literalSubject` field is set.
565 properties:
566 countries:
567 description: Countries to be used on the Certificate.
568 items:
569 type: string
570 type: array
571 x-kubernetes-list-type: atomic
572 localities:
573 description: Cities to be used on the Certificate.
574 items:
575 type: string
576 type: array
577 x-kubernetes-list-type: atomic
578 organizationalUnits:
579 description: Organizational Units to be used on the Certificate.
580 items:
581 type: string
582 type: array
583 x-kubernetes-list-type: atomic
584 organizations:
585 description: Organizations to be used on the Certificate.
586 items:
587 type: string
588 type: array
589 x-kubernetes-list-type: atomic
590 postalCodes:
591 description: Postal codes to be used on the Certificate.
592 items:
593 type: string
594 type: array
595 x-kubernetes-list-type: atomic
596 provinces:
597 description: State/Provinces to be used on the Certificate.
598 items:
599 type: string
600 type: array
601 x-kubernetes-list-type: atomic
602 serialNumber:
603 description: Serial number to be used on the Certificate.
604 type: string
605 streetAddresses:
606 description: Street addresses to be used on the Certificate.
607 items:
608 type: string
609 type: array
610 x-kubernetes-list-type: atomic
611 type: object
612 uris:
613 description: Requested URI subject alternative names.
614 items:
615 type: string
616 type: array
617 x-kubernetes-list-type: atomic
618 usages:
619 description: |-
620 Requested key usages and extended key usages.
621 These usages are used to set the `usages` field on the created CertificateRequest
622 resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
623 will additionally be encoded in the `request` field which contains the CSR blob.
624
625 If unset, defaults to `digital signature` and `key encipherment`.
626 items:
627 description: |-
628 KeyUsage specifies valid usage contexts for keys.
629 See:
630 https://tools.ietf.org/html/rfc5280#section-4.2.1.3
631 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
632
633 Valid KeyUsage values are as follows:
634 "signing",
635 "digital signature",
636 "content commitment",
637 "key encipherment",
638 "key agreement",
639 "data encipherment",
640 "cert sign",
641 "crl sign",
642 "encipher only",
643 "decipher only",
644 "any",
645 "server auth",
646 "client auth",
647 "code signing",
648 "email protection",
649 "s/mime",
650 "ipsec end system",
651 "ipsec tunnel",
652 "ipsec user",
653 "timestamping",
654 "ocsp signing",
655 "microsoft sgc",
656 "netscape sgc"
657 enum:
658 - signing
659 - digital signature
660 - content commitment
661 - key encipherment
662 - key agreement
663 - data encipherment
664 - cert sign
665 - crl sign
666 - encipher only
667 - decipher only
668 - any
669 - server auth
670 - client auth
671 - code signing
672 - email protection
673 - s/mime
674 - ipsec end system
675 - ipsec tunnel
676 - ipsec user
677 - timestamping
678 - ocsp signing
679 - microsoft sgc
680 - netscape sgc
681 type: string
682 type: array
683 x-kubernetes-list-type: atomic
684 required:
685 - issuerRef
686 - secretName
687 type: object
688 status:
689 description: |-
690 Status of the Certificate.
691 This is set and managed automatically.
692 Read-only.
693 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
694 properties:
695 conditions:
696 description: |-
697 List of status conditions to indicate the status of certificates.
698 Known condition types are `Ready` and `Issuing`.
699 items:
700 description: CertificateCondition contains condition information for a Certificate.
701 properties:
702 lastTransitionTime:
703 description: |-
704 LastTransitionTime is the timestamp corresponding to the last status
705 change of this condition.
706 format: date-time
707 type: string
708 message:
709 description: |-
710 Message is a human readable description of the details of the last
711 transition, complementing reason.
712 type: string
713 observedGeneration:
714 description: |-
715 If set, this represents the .metadata.generation that the condition was
716 set based upon.
717 For instance, if .metadata.generation is currently 12, but the
718 .status.condition[x].observedGeneration is 9, the condition is out of date
719 with respect to the current state of the Certificate.
720 format: int64
721 type: integer
722 reason:
723 description: |-
724 Reason is a brief machine readable explanation for the condition's last
725 transition.
726 type: string
727 status:
728 description: Status of the condition, one of (`True`, `False`, `Unknown`).
729 enum:
730 - "True"
731 - "False"
732 - Unknown
733 type: string
734 type:
735 description: Type of the condition, known values are (`Ready`, `Issuing`).
736 type: string
737 required:
738 - status
739 - type
740 type: object
741 type: array
742 x-kubernetes-list-map-keys:
743 - type
744 x-kubernetes-list-type: map
745 failedIssuanceAttempts:
746 description: |-
747 The number of continuous failed issuance attempts up till now. This
748 field gets removed (if set) on a successful issuance and gets set to
749 1 if unset and an issuance has failed. If an issuance has failed, the
750 delay till the next issuance will be calculated using formula
751 time.Hour * 2 ^ (failedIssuanceAttempts - 1).
752 type: integer
753 lastFailureTime:
754 description: |-
755 LastFailureTime is set only if the latest issuance for this
756 Certificate failed and contains the time of the failure. If an
757 issuance has failed, the delay till the next issuance will be
758 calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
759 1). If the latest issuance has succeeded this field will be unset.
760 format: date-time
761 type: string
762 nextPrivateKeySecretName:
763 description: |-
764 The name of the Secret resource containing the private key to be used
765 for the next certificate iteration.
766 The keymanager controller will automatically set this field if the
767 `Issuing` condition is set to `True`.
768 It will automatically unset this field when the Issuing condition is
769 not set or False.
770 type: string
771 notAfter:
772 description: |-
773 The expiration time of the certificate stored in the secret named
774 by this resource in `spec.secretName`.
775 format: date-time
776 type: string
777 notBefore:
778 description: |-
779 The time after which the certificate stored in the secret named
780 by this resource in `spec.secretName` is valid.
781 format: date-time
782 type: string
783 renewalTime:
784 description: |-
785 RenewalTime is the time at which the certificate will be next
786 renewed.
787 If not set, no upcoming renewal is scheduled.
788 format: date-time
789 type: string
790 revision:
791 description: |-
792 The current 'revision' of the certificate as issued.
793
794 When a CertificateRequest resource is created, it will have the
795 `cert-manager.io/certificate-revision` set to one greater than the
796 current value of this field.
797
798 Upon issuance, this field will be set to the value of the annotation
799 on the CertificateRequest resource used to issue the certificate.
800
801 Persisting the value on the CertificateRequest resource allows the
802 certificates controller to know whether a request is part of an old
803 issuance or if it is part of the ongoing revision's issuance by
804 checking if the revision value in the annotation is greater than this
805 field.
806 type: integer
807 type: object
808 type: object
809 selectableFields:
810 - jsonPath: .spec.issuerRef.group
811 - jsonPath: .spec.issuerRef.kind
812 - jsonPath: .spec.issuerRef.name
813 served: true
814 storage: true
815 subresources:
816 status: {}
817{{- end }}