| Giorgi Lekveishvili | ea328da | 2026-07-29 12:15:15 +0400 | [diff] [blame] | 1 | {{- if or .Values.crds.enabled .Values.installCRDs }} |
| 2 | apiVersion: apiextensions.k8s.io/v1 |
| 3 | kind: CustomResourceDefinition |
| 4 | metadata: |
| 5 | name: "certificaterequests.cert-manager.io" |
| 6 | {{- if .Values.crds.keep }} |
| 7 | annotations: |
| 8 | helm.sh/resource-policy: keep |
| 9 | {{- end }} |
| 10 | labels: |
| 11 | {{- include "cert-manager.crd-labels" . | nindent 4 }} |
| 12 | spec: |
| 13 | group: cert-manager.io |
| 14 | names: |
| 15 | categories: |
| 16 | - cert-manager |
| 17 | kind: CertificateRequest |
| 18 | listKind: CertificateRequestList |
| 19 | plural: certificaterequests |
| 20 | shortNames: |
| 21 | - cr |
| 22 | - crs |
| 23 | singular: certificaterequest |
| 24 | scope: Namespaced |
| 25 | versions: |
| 26 | - additionalPrinterColumns: |
| 27 | - jsonPath: .status.conditions[?(@.type == "Approved")].status |
| 28 | name: Approved |
| 29 | type: string |
| 30 | - jsonPath: .status.conditions[?(@.type == "Denied")].status |
| 31 | name: Denied |
| 32 | type: string |
| 33 | - jsonPath: .status.conditions[?(@.type == "Ready")].status |
| 34 | name: Ready |
| 35 | type: string |
| 36 | - jsonPath: .spec.issuerRef.name |
| 37 | name: Issuer |
| 38 | type: string |
| 39 | - jsonPath: .spec.username |
| 40 | name: Requester |
| 41 | type: string |
| 42 | - jsonPath: .status.conditions[?(@.type == "Ready")].message |
| 43 | name: Status |
| 44 | priority: 1 |
| 45 | type: string |
| 46 | - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. |
| 47 | jsonPath: .metadata.creationTimestamp |
| 48 | name: Age |
| 49 | type: date |
| 50 | name: v1 |
| 51 | schema: |
| 52 | openAPIV3Schema: |
| 53 | description: |- |
| 54 | A CertificateRequest is used to request a signed certificate from one of the |
| 55 | configured issuers. |
| 56 | |
| 57 | All fields within the CertificateRequest's `spec` are immutable after creation. |
| 58 | A CertificateRequest will either succeed or fail, as denoted by its `Ready` status |
| 59 | condition and its `status.failureTime` field. |
| 60 | |
| 61 | A CertificateRequest is a one-shot resource, meaning it represents a single |
| 62 | point in time request for a certificate and cannot be re-used. |
| 63 | properties: |
| 64 | apiVersion: |
| 65 | description: |- |
| 66 | APIVersion defines the versioned schema of this representation of an object. |
| 67 | Servers should convert recognized schemas to the latest internal value, and |
| 68 | may reject unrecognized values. |
| 69 | More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| 70 | type: string |
| 71 | kind: |
| 72 | description: |- |
| 73 | Kind is a string value representing the REST resource this object represents. |
| 74 | Servers may infer this from the endpoint the client submits requests to. |
| 75 | Cannot be updated. |
| 76 | In CamelCase. |
| 77 | More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| 78 | type: string |
| 79 | metadata: |
| 80 | type: object |
| 81 | spec: |
| 82 | description: |- |
| 83 | Specification of the desired state of the CertificateRequest resource. |
| 84 | https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| 85 | properties: |
| 86 | duration: |
| 87 | description: |- |
| 88 | Requested 'duration' (i.e. lifetime) of the Certificate. Note that the |
| 89 | issuer may choose to ignore the requested duration, just like any other |
| 90 | requested attribute. |
| 91 | type: string |
| 92 | extra: |
| 93 | additionalProperties: |
| 94 | items: |
| 95 | type: string |
| 96 | type: array |
| 97 | description: |- |
| 98 | Extra contains extra attributes of the user that created the CertificateRequest. |
| 99 | Populated by the cert-manager webhook on creation and immutable. |
| 100 | type: object |
| 101 | groups: |
| 102 | description: |- |
| 103 | Groups contains group membership of the user that created the CertificateRequest. |
| 104 | Populated by the cert-manager webhook on creation and immutable. |
| 105 | items: |
| 106 | type: string |
| 107 | type: array |
| 108 | x-kubernetes-list-type: atomic |
| 109 | isCA: |
| 110 | description: |- |
| 111 | Requested basic constraints isCA value. Note that the issuer may choose |
| 112 | to ignore the requested isCA value, just like any other requested attribute. |
| 113 | |
| 114 | NOTE: If the CSR in the `Request` field has a BasicConstraints extension, |
| 115 | it must have the same isCA value as specified here. |
| 116 | |
| 117 | If true, this will automatically add the `cert sign` usage to the list |
| 118 | of requested `usages`. |
| 119 | type: boolean |
| 120 | issuerRef: |
| 121 | description: |- |
| 122 | Reference to the issuer responsible for issuing the certificate. |
| 123 | If the issuer is namespace-scoped, it must be in the same namespace |
| 124 | as the Certificate. If the issuer is cluster-scoped, it can be used |
| 125 | from any namespace. |
| 126 | |
| 127 | The `name` field of the reference must always be specified. |
| 128 | properties: |
| 129 | group: |
| 130 | description: |- |
| 131 | Group of the issuer being referred to. |
| 132 | Defaults to 'cert-manager.io'. |
| 133 | type: string |
| 134 | kind: |
| 135 | description: |- |
| 136 | Kind of the issuer being referred to. |
| 137 | Defaults to 'Issuer'. |
| 138 | type: string |
| 139 | name: |
| 140 | description: Name of the issuer being referred to. |
| 141 | type: string |
| 142 | required: |
| 143 | - name |
| 144 | type: object |
| 145 | request: |
| 146 | description: |- |
| 147 | The PEM-encoded X.509 certificate signing request to be submitted to the |
| 148 | issuer for signing. |
| 149 | |
| 150 | If the CSR has a BasicConstraints extension, its isCA attribute must |
| 151 | match the `isCA` value of this CertificateRequest. |
| 152 | If the CSR has a KeyUsage extension, its key usages must match the |
| 153 | key usages in the `usages` field of this CertificateRequest. |
| 154 | If the CSR has a ExtKeyUsage extension, its extended key usages |
| 155 | must match the extended key usages in the `usages` field of this |
| 156 | CertificateRequest. |
| 157 | format: byte |
| 158 | type: string |
| 159 | uid: |
| 160 | description: |- |
| 161 | UID contains the uid of the user that created the CertificateRequest. |
| 162 | Populated by the cert-manager webhook on creation and immutable. |
| 163 | type: string |
| 164 | usages: |
| 165 | description: |- |
| 166 | Requested key usages and extended key usages. |
| 167 | |
| 168 | NOTE: If the CSR in the `Request` field has uses the KeyUsage or |
| 169 | ExtKeyUsage extension, these extensions must have the same values |
| 170 | as specified here without any additional values. |
| 171 | |
| 172 | If unset, defaults to `digital signature` and `key encipherment`. |
| 173 | items: |
| 174 | description: |- |
| 175 | KeyUsage specifies valid usage contexts for keys. |
| 176 | See: |
| 177 | https://tools.ietf.org/html/rfc5280#section-4.2.1.3 |
| 178 | https://tools.ietf.org/html/rfc5280#section-4.2.1.12 |
| 179 | |
| 180 | Valid KeyUsage values are as follows: |
| 181 | "signing", |
| 182 | "digital signature", |
| 183 | "content commitment", |
| 184 | "key encipherment", |
| 185 | "key agreement", |
| 186 | "data encipherment", |
| 187 | "cert sign", |
| 188 | "crl sign", |
| 189 | "encipher only", |
| 190 | "decipher only", |
| 191 | "any", |
| 192 | "server auth", |
| 193 | "client auth", |
| 194 | "code signing", |
| 195 | "email protection", |
| 196 | "s/mime", |
| 197 | "ipsec end system", |
| 198 | "ipsec tunnel", |
| 199 | "ipsec user", |
| 200 | "timestamping", |
| 201 | "ocsp signing", |
| 202 | "microsoft sgc", |
| 203 | "netscape sgc" |
| 204 | enum: |
| 205 | - signing |
| 206 | - digital signature |
| 207 | - content commitment |
| 208 | - key encipherment |
| 209 | - key agreement |
| 210 | - data encipherment |
| 211 | - cert sign |
| 212 | - crl sign |
| 213 | - encipher only |
| 214 | - decipher only |
| 215 | - any |
| 216 | - server auth |
| 217 | - client auth |
| 218 | - code signing |
| 219 | - email protection |
| 220 | - s/mime |
| 221 | - ipsec end system |
| 222 | - ipsec tunnel |
| 223 | - ipsec user |
| 224 | - timestamping |
| 225 | - ocsp signing |
| 226 | - microsoft sgc |
| 227 | - netscape sgc |
| 228 | type: string |
| 229 | type: array |
| 230 | x-kubernetes-list-type: atomic |
| 231 | username: |
| 232 | description: |- |
| 233 | Username contains the name of the user that created the CertificateRequest. |
| 234 | Populated by the cert-manager webhook on creation and immutable. |
| 235 | type: string |
| 236 | required: |
| 237 | - issuerRef |
| 238 | - request |
| 239 | type: object |
| 240 | status: |
| 241 | description: |- |
| 242 | Status of the CertificateRequest. |
| 243 | This is set and managed automatically. |
| 244 | Read-only. |
| 245 | More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| 246 | properties: |
| 247 | ca: |
| 248 | description: |- |
| 249 | The PEM encoded X.509 certificate of the signer, also known as the CA |
| 250 | (Certificate Authority). |
| 251 | This is set on a best-effort basis by different issuers. |
| 252 | If not set, the CA is assumed to be unknown/not available. |
| 253 | format: byte |
| 254 | type: string |
| 255 | certificate: |
| 256 | description: |- |
| 257 | The PEM encoded X.509 certificate resulting from the certificate |
| 258 | signing request. |
| 259 | If not set, the CertificateRequest has either not been completed or has |
| 260 | failed. More information on failure can be found by checking the |
| 261 | `conditions` field. |
| 262 | format: byte |
| 263 | type: string |
| 264 | conditions: |
| 265 | description: |- |
| 266 | List of status conditions to indicate the status of a CertificateRequest. |
| 267 | Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. |
| 268 | items: |
| 269 | description: CertificateRequestCondition contains condition information for a CertificateRequest. |
| 270 | properties: |
| 271 | lastTransitionTime: |
| 272 | description: |- |
| 273 | LastTransitionTime is the timestamp corresponding to the last status |
| 274 | change of this condition. |
| 275 | format: date-time |
| 276 | type: string |
| 277 | message: |
| 278 | description: |- |
| 279 | Message is a human readable description of the details of the last |
| 280 | transition, complementing reason. |
| 281 | type: string |
| 282 | reason: |
| 283 | description: |- |
| 284 | Reason is a brief machine readable explanation for the condition's last |
| 285 | transition. |
| 286 | type: string |
| 287 | status: |
| 288 | description: Status of the condition, one of (`True`, `False`, `Unknown`). |
| 289 | enum: |
| 290 | - "True" |
| 291 | - "False" |
| 292 | - Unknown |
| 293 | type: string |
| 294 | type: |
| 295 | description: |- |
| 296 | Type of the condition, known values are (`Ready`, `InvalidRequest`, |
| 297 | `Approved`, `Denied`). |
| 298 | type: string |
| 299 | required: |
| 300 | - status |
| 301 | - type |
| 302 | type: object |
| 303 | type: array |
| 304 | x-kubernetes-list-map-keys: |
| 305 | - type |
| 306 | x-kubernetes-list-type: map |
| 307 | failureTime: |
| 308 | description: |- |
| 309 | FailureTime stores the time that this CertificateRequest failed. This is |
| 310 | used to influence garbage collection and back-off. |
| 311 | format: date-time |
| 312 | type: string |
| 313 | type: object |
| 314 | type: object |
| 315 | selectableFields: |
| 316 | - jsonPath: .spec.issuerRef.group |
| 317 | - jsonPath: .spec.issuerRef.kind |
| 318 | - jsonPath: .spec.issuerRef.name |
| 319 | served: true |
| 320 | storage: true |
| 321 | subresources: |
| 322 | status: {} |
| 323 | {{- end }} |