Gitiles
Code Review Sign In
code.v1.dodo.cloud / helm-charts / ea328da19aadb6b9eeab7254e530f7ca005f69f1 / . / charts / cert-manager-1.19.6 / templates / crd-cert-manager.io_certificates.yaml
blob: 6689de66e15425babb1192d21b258f7265e50554 [file] [log] [blame]
Giorgi Lekveishviliea328da2026-07-29 12:15:15 +0400[diff] [blame^]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "certificates.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: Certificate
18 listKind: CertificateList
19 plural: certificates
20 shortNames:
21 - cert
22 - certs
23 singular: certificate
24 scope: Namespaced
25 versions:
26 - additionalPrinterColumns:
27 - jsonPath: .status.conditions[?(@.type == "Ready")].status
28 name: Ready
29 type: string
30 - jsonPath: .spec.secretName
31 name: Secret
32 type: string
33 - jsonPath: .spec.issuerRef.name
34 name: Issuer
35 priority: 1
36 type: string
37 - jsonPath: .status.conditions[?(@.type == "Ready")].message
38 name: Status
39 priority: 1
40 type: string
41 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
42 jsonPath: .metadata.creationTimestamp
43 name: Age
44 type: date
45 name: v1
46 schema:
47 openAPIV3Schema:
48 description: |-
49 A Certificate resource should be created to ensure an up to date and signed
50 X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
51
52 The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
53 properties:
54 apiVersion:
55 description: |-
56 APIVersion defines the versioned schema of this representation of an object.
57 Servers should convert recognized schemas to the latest internal value, and
58 may reject unrecognized values.
59 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
60 type: string
61 kind:
62 description: |-
63 Kind is a string value representing the REST resource this object represents.
64 Servers may infer this from the endpoint the client submits requests to.
65 Cannot be updated.
66 In CamelCase.
67 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
68 type: string
69 metadata:
70 type: object
71 spec:
72 description: |-
73 Specification of the desired state of the Certificate resource.
74 https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
75 properties:
76 additionalOutputFormats:
77 description: |-
78 Defines extra output formats of the private key and signed certificate chain
79 to be written to this Certificate's target Secret.
80 items:
81 description: |-
82 CertificateAdditionalOutputFormat defines an additional output format of a
83 Certificate resource. These contain supplementary data formats of the signed
84 certificate chain and paired private key.
85 properties:
86 type:
87 description: |-
88 Type is the name of the format type that should be written to the
89 Certificate's target Secret.
90 enum:
91 - DER
92 - CombinedPEM
93 type: string
94 required:
95 - type
96 type: object
97 type: array
98 x-kubernetes-list-type: atomic
99 commonName:
100 description: |-
101 Requested common name X509 certificate subject attribute.
102 More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
103 NOTE: TLS clients will ignore this value when any subject alternative name is
104 set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
105
106 Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
107 Cannot be set if the `literalSubject` field is set.
108 type: string
109 dnsNames:
110 description: Requested DNS subject alternative names.
111 items:
112 type: string
113 type: array
114 x-kubernetes-list-type: atomic
115 duration:
116 description: |-
117 Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
118 issuer may choose to ignore the requested duration, just like any other
119 requested attribute.
120
121 If unset, this defaults to 90 days.
122 Minimum accepted duration is 1 hour.
123 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
124 type: string
125 emailAddresses:
126 description: Requested email subject alternative names.
127 items:
128 type: string
129 type: array
130 x-kubernetes-list-type: atomic
131 encodeUsagesInRequest:
132 description: |-
133 Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
134
135 This option defaults to true, and should only be disabled if the target
136 issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
137 type: boolean
138 ipAddresses:
139 description: Requested IP address subject alternative names.
140 items:
141 type: string
142 type: array
143 x-kubernetes-list-type: atomic
144 isCA:
145 description: |-
146 Requested basic constraints isCA value.
147 The isCA value is used to set the `isCA` field on the created CertificateRequest
148 resources. Note that the issuer may choose to ignore the requested isCA value, just
149 like any other requested attribute.
150
151 If true, this will automatically add the `cert sign` usage to the list
152 of requested `usages`.
153 type: boolean
154 issuerRef:
155 description: |-
156 Reference to the issuer responsible for issuing the certificate.
157 If the issuer is namespace-scoped, it must be in the same namespace
158 as the Certificate. If the issuer is cluster-scoped, it can be used
159 from any namespace.
160
161 The `name` field of the reference must always be specified.
162 properties:
163 group:
164 description: |-
165 Group of the issuer being referred to.
166 Defaults to 'cert-manager.io'.
167 type: string
168 kind:
169 description: |-
170 Kind of the issuer being referred to.
171 Defaults to 'Issuer'.
172 type: string
173 name:
174 description: Name of the issuer being referred to.
175 type: string
176 required:
177 - name
178 type: object
179 keystores:
180 description: Additional keystore output formats to be stored in the Certificate's Secret.
181 properties:
182 jks:
183 description: |-
184 JKS configures options for storing a JKS keystore in the
185 `spec.secretName` Secret resource.
186 properties:
187 alias:
188 description: |-
189 Alias specifies the alias of the key in the keystore, required by the JKS format.
190 If not provided, the default alias `certificate` will be used.
191 type: string
192 create:
193 description: |-
194 Create enables JKS keystore creation for the Certificate.
195 If true, a file named `keystore.jks` will be created in the target
196 Secret resource, encrypted using the password stored in
197 `passwordSecretRef` or `password`.
198 The keystore file will be updated immediately.
199 If the issuer provided a CA certificate, a file named `truststore.jks`
200 will also be created in the target Secret resource, encrypted using the
201 password stored in `passwordSecretRef`
202 containing the issuing Certificate Authority
203 type: boolean
204 password:
205 description: |-
206 Password provides a literal password used to encrypt the JKS keystore.
207 Mutually exclusive with passwordSecretRef.
208 One of password or passwordSecretRef must provide a password with a non-zero length.
209 type: string
210 passwordSecretRef:
211 description: |-
212 PasswordSecretRef is a reference to a non-empty key in a Secret resource
213 containing the password used to encrypt the JKS keystore.
214 Mutually exclusive with password.
215 One of password or passwordSecretRef must provide a password with a non-zero length.
216 properties:
217 key:
218 description: |-
219 The key of the entry in the Secret resource's `data` field to be used.
220 Some instances of this field may be defaulted, in others it may be
221 required.
222 type: string
223 name:
224 description: |-
225 Name of the resource being referred to.
226 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
227 type: string
228 required:
229 - name
230 type: object
231 required:
232 - create
233 type: object
234 pkcs12:
235 description: |-
236 PKCS12 configures options for storing a PKCS12 keystore in the
237 `spec.secretName` Secret resource.
238 properties:
239 create:
240 description: |-
241 Create enables PKCS12 keystore creation for the Certificate.
242 If true, a file named `keystore.p12` will be created in the target
243 Secret resource, encrypted using the password stored in
244 `passwordSecretRef` or in `password`.
245 The keystore file will be updated immediately.
246 If the issuer provided a CA certificate, a file named `truststore.p12` will
247 also be created in the target Secret resource, encrypted using the
248 password stored in `passwordSecretRef` containing the issuing Certificate
249 Authority
250 type: boolean
251 password:
252 description: |-
253 Password provides a literal password used to encrypt the PKCS#12 keystore.
254 Mutually exclusive with passwordSecretRef.
255 One of password or passwordSecretRef must provide a password with a non-zero length.
256 type: string
257 passwordSecretRef:
258 description: |-
259 PasswordSecretRef is a reference to a non-empty key in a Secret resource
260 containing the password used to encrypt the PKCS#12 keystore.
261 Mutually exclusive with password.
262 One of password or passwordSecretRef must provide a password with a non-zero length.
263 properties:
264 key:
265 description: |-
266 The key of the entry in the Secret resource's `data` field to be used.
267 Some instances of this field may be defaulted, in others it may be
268 required.
269 type: string
270 name:
271 description: |-
272 Name of the resource being referred to.
273 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
274 type: string
275 required:
276 - name
277 type: object
278 profile:
279 description: |-
280 Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
281 used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
282
283 If provided, allowed values are:
284 `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
285 `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
286 `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
287 (e.g., because of company policy). Please note that the security of the algorithm is not that important
288 in reality, because the unencrypted certificate and private key are also stored in the Secret.
289 enum:
290 - LegacyRC2
291 - LegacyDES
292 - Modern2023
293 type: string
294 required:
295 - create
296 type: object
297 type: object
298 literalSubject:
299 description: |-
300 Requested X.509 certificate subject, represented using the LDAP "String
301 Representation of a Distinguished Name" [1].
302 Important: the LDAP string format also specifies the order of the attributes
303 in the subject, this is important when issuing certs for LDAP authentication.
304 Example: `CN=foo,DC=corp,DC=example,DC=com`
305 More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
306 More info: https://github.com/cert-manager/cert-manager/issues/3203
307 More info: https://github.com/cert-manager/cert-manager/issues/4424
308
309 Cannot be set if the `subject` or `commonName` field is set.
310 type: string
311 nameConstraints:
312 description: |-
313 x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
314 More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
315
316 This is an Alpha Feature and is only enabled with the
317 `--feature-gates=NameConstraints=true` option set on both
318 the controller and webhook components.
319 properties:
320 critical:
321 description: if true then the name constraints are marked critical.
322 type: boolean
323 excluded:
324 description: |-
325 Excluded contains the constraints which must be disallowed. Any name matching a
326 restriction in the excluded field is invalid regardless
327 of information appearing in the permitted
328 properties:
329 dnsDomains:
330 description: DNSDomains is a list of DNS domains that are permitted or excluded.
331 items:
332 type: string
333 type: array
334 x-kubernetes-list-type: atomic
335 emailAddresses:
336 description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
337 items:
338 type: string
339 type: array
340 x-kubernetes-list-type: atomic
341 ipRanges:
342 description: |-
343 IPRanges is a list of IP Ranges that are permitted or excluded.
344 This should be a valid CIDR notation.
345 items:
346 type: string
347 type: array
348 x-kubernetes-list-type: atomic
349 uriDomains:
350 description: URIDomains is a list of URI domains that are permitted or excluded.
351 items:
352 type: string
353 type: array
354 x-kubernetes-list-type: atomic
355 type: object
356 permitted:
357 description: Permitted contains the constraints in which the names must be located.
358 properties:
359 dnsDomains:
360 description: DNSDomains is a list of DNS domains that are permitted or excluded.
361 items:
362 type: string
363 type: array
364 x-kubernetes-list-type: atomic
365 emailAddresses:
366 description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
367 items:
368 type: string
369 type: array
370 x-kubernetes-list-type: atomic
371 ipRanges:
372 description: |-
373 IPRanges is a list of IP Ranges that are permitted or excluded.
374 This should be a valid CIDR notation.
375 items:
376 type: string
377 type: array
378 x-kubernetes-list-type: atomic
379 uriDomains:
380 description: URIDomains is a list of URI domains that are permitted or excluded.
381 items:
382 type: string
383 type: array
384 x-kubernetes-list-type: atomic
385 type: object
386 type: object
387 otherNames:
388 description: |-
389 `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
390 Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
391 Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
392 You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
393 items:
394 properties:
395 oid:
396 description: |-
397 OID is the object identifier for the otherName SAN.
398 The object identifier must be expressed as a dotted string, for
399 example, "1.2.840.113556.1.4.221".
400 type: string
401 utf8Value:
402 description: |-
403 utf8Value is the string value of the otherName SAN.
404 The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
405 type: string
406 type: object
407 type: array
408 x-kubernetes-list-type: atomic
409 privateKey:
410 description: |-
411 Private key options. These include the key algorithm and size, the used
412 encoding and the rotation policy.
413 properties:
414 algorithm:
415 description: |-
416 Algorithm is the private key algorithm of the corresponding private key
417 for this certificate.
418
419 If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
420 If `algorithm` is specified and `size` is not provided,
421 key size of 2048 will be used for `RSA` key algorithm and
422 key size of 256 will be used for `ECDSA` key algorithm.
423 key size is ignored when using the `Ed25519` key algorithm.
424 enum:
425 - RSA
426 - ECDSA
427 - Ed25519
428 type: string
429 encoding:
430 description: |-
431 The private key cryptography standards (PKCS) encoding for this
432 certificate's private key to be encoded in.
433
434 If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
435 and PKCS#8, respectively.
436 Defaults to `PKCS1` if not specified.
437 enum:
438 - PKCS1
439 - PKCS8
440 type: string
441 rotationPolicy:
442 description: |-
443 RotationPolicy controls how private keys should be regenerated when a
444 re-issuance is being processed.
445
446 If set to `Never`, a private key will only be generated if one does not
447 already exist in the target `spec.secretName`. If one does exist but it
448 does not have the correct algorithm or size, a warning will be raised
449 to await user intervention.
450 If set to `Always`, a private key matching the specified requirements
451 will be generated whenever a re-issuance occurs.
452 Default is `Always`.
453 The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
454 The new default can be disabled by setting the
455 `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
456 the controller component.
457 enum:
458 - Never
459 - Always
460 type: string
461 size:
462 description: |-
463 Size is the key bit size of the corresponding private key for this certificate.
464
465 If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
466 and will default to `2048` if not specified.
467 If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
468 and will default to `256` if not specified.
469 If `algorithm` is set to `Ed25519`, Size is ignored.
470 No other values are allowed.
471 type: integer
472 type: object
473 renewBefore:
474 description: |-
475 How long before the currently issued certificate's expiry cert-manager should
476 renew the certificate. For example, if a certificate is valid for 60 minutes,
477 and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
478 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
479 the certificate is no longer valid).
480
481 NOTE: The actual lifetime of the issued certificate is used to determine the
482 renewal time. If an issuer returns a certificate with a different lifetime than
483 the one requested, cert-manager will use the lifetime of the issued certificate.
484
485 If unset, this defaults to 1/3 of the issued certificate's lifetime.
486 Minimum accepted value is 5 minutes.
487 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
488 Cannot be set if the `renewBeforePercentage` field is set.
489 type: string
490 renewBeforePercentage:
491 description: |-
492 `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
493 rather than an absolute duration. For example, if a certificate is valid for 60
494 minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to
495 renew the certificate 45 minutes after it was issued (i.e. when there are 15
496 minutes (25%) remaining until the certificate is no longer valid).
497
498 NOTE: The actual lifetime of the issued certificate is used to determine the
499 renewal time. If an issuer returns a certificate with a different lifetime than
500 the one requested, cert-manager will use the lifetime of the issued certificate.
501
502 Value must be an integer in the range (0,100). The minimum effective
503 `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
504 minutes.
505 Cannot be set if the `renewBefore` field is set.
506 format: int32
507 type: integer
508 revisionHistoryLimit:
509 description: |-
510 The maximum number of CertificateRequest revisions that are maintained in
511 the Certificate's history. Each revision represents a single `CertificateRequest`
512 created by this Certificate, either when it was created, renewed, or Spec
513 was changed. Revisions will be removed by oldest first if the number of
514 revisions exceeds this number.
515
516 If set, revisionHistoryLimit must be a value of `1` or greater.
517 Default value is `1`.
518 format: int32
519 type: integer
520 secretName:
521 description: |-
522 Name of the Secret resource that will be automatically created and
523 managed by this Certificate resource. It will be populated with a
524 private key and certificate, signed by the denoted issuer. The Secret
525 resource lives in the same namespace as the Certificate resource.
526 type: string
527 secretTemplate:
528 description: |-
529 Defines annotations and labels to be copied to the Certificate's Secret.
530 Labels and annotations on the Secret will be changed as they appear on the
531 SecretTemplate when added or removed. SecretTemplate annotations are added
532 in conjunction with, and cannot overwrite, the base set of annotations
533 cert-manager sets on the Certificate's Secret.
534 properties:
535 annotations:
536 additionalProperties:
537 type: string
538 description: Annotations is a key value map to be copied to the target Kubernetes Secret.
539 type: object
540 labels:
541 additionalProperties:
542 type: string
543 description: Labels is a key value map to be copied to the target Kubernetes Secret.
544 type: object
545 type: object
546 signatureAlgorithm:
547 description: |-
548 Signature algorithm to use.
549 Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
550 Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
551 Allowed values for Ed25519 keys: PureEd25519.
552 enum:
553 - SHA256WithRSA
554 - SHA384WithRSA
555 - SHA512WithRSA
556 - ECDSAWithSHA256
557 - ECDSAWithSHA384
558 - ECDSAWithSHA512
559 - PureEd25519
560 type: string
561 subject:
562 description: |-
563 Requested set of X509 certificate subject attributes.
564 More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
565
566 The common name attribute is specified separately in the `commonName` field.
567 Cannot be set if the `literalSubject` field is set.
568 properties:
569 countries:
570 description: Countries to be used on the Certificate.
571 items:
572 type: string
573 type: array
574 x-kubernetes-list-type: atomic
575 localities:
576 description: Cities to be used on the Certificate.
577 items:
578 type: string
579 type: array
580 x-kubernetes-list-type: atomic
581 organizationalUnits:
582 description: Organizational Units to be used on the Certificate.
583 items:
584 type: string
585 type: array
586 x-kubernetes-list-type: atomic
587 organizations:
588 description: Organizations to be used on the Certificate.
589 items:
590 type: string
591 type: array
592 x-kubernetes-list-type: atomic
593 postalCodes:
594 description: Postal codes to be used on the Certificate.
595 items:
596 type: string
597 type: array
598 x-kubernetes-list-type: atomic
599 provinces:
600 description: State/Provinces to be used on the Certificate.
601 items:
602 type: string
603 type: array
604 x-kubernetes-list-type: atomic
605 serialNumber:
606 description: Serial number to be used on the Certificate.
607 type: string
608 streetAddresses:
609 description: Street addresses to be used on the Certificate.
610 items:
611 type: string
612 type: array
613 x-kubernetes-list-type: atomic
614 type: object
615 uris:
616 description: Requested URI subject alternative names.
617 items:
618 type: string
619 type: array
620 x-kubernetes-list-type: atomic
621 usages:
622 description: |-
623 Requested key usages and extended key usages.
624 These usages are used to set the `usages` field on the created CertificateRequest
625 resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
626 will additionally be encoded in the `request` field which contains the CSR blob.
627
628 If unset, defaults to `digital signature` and `key encipherment`.
629 items:
630 description: |-
631 KeyUsage specifies valid usage contexts for keys.
632 See:
633 https://tools.ietf.org/html/rfc5280#section-4.2.1.3
634 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
635
636 Valid KeyUsage values are as follows:
637 "signing",
638 "digital signature",
639 "content commitment",
640 "key encipherment",
641 "key agreement",
642 "data encipherment",
643 "cert sign",
644 "crl sign",
645 "encipher only",
646 "decipher only",
647 "any",
648 "server auth",
649 "client auth",
650 "code signing",
651 "email protection",
652 "s/mime",
653 "ipsec end system",
654 "ipsec tunnel",
655 "ipsec user",
656 "timestamping",
657 "ocsp signing",
658 "microsoft sgc",
659 "netscape sgc"
660 enum:
661 - signing
662 - digital signature
663 - content commitment
664 - key encipherment
665 - key agreement
666 - data encipherment
667 - cert sign
668 - crl sign
669 - encipher only
670 - decipher only
671 - any
672 - server auth
673 - client auth
674 - code signing
675 - email protection
676 - s/mime
677 - ipsec end system
678 - ipsec tunnel
679 - ipsec user
680 - timestamping
681 - ocsp signing
682 - microsoft sgc
683 - netscape sgc
684 type: string
685 type: array
686 x-kubernetes-list-type: atomic
687 required:
688 - issuerRef
689 - secretName
690 type: object
691 status:
692 description: |-
693 Status of the Certificate.
694 This is set and managed automatically.
695 Read-only.
696 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
697 properties:
698 conditions:
699 description: |-
700 List of status conditions to indicate the status of certificates.
701 Known condition types are `Ready` and `Issuing`.
702 items:
703 description: CertificateCondition contains condition information for a Certificate.
704 properties:
705 lastTransitionTime:
706 description: |-
707 LastTransitionTime is the timestamp corresponding to the last status
708 change of this condition.
709 format: date-time
710 type: string
711 message:
712 description: |-
713 Message is a human readable description of the details of the last
714 transition, complementing reason.
715 type: string
716 observedGeneration:
717 description: |-
718 If set, this represents the .metadata.generation that the condition was
719 set based upon.
720 For instance, if .metadata.generation is currently 12, but the
721 .status.condition[x].observedGeneration is 9, the condition is out of date
722 with respect to the current state of the Certificate.
723 format: int64
724 type: integer
725 reason:
726 description: |-
727 Reason is a brief machine readable explanation for the condition's last
728 transition.
729 type: string
730 status:
731 description: Status of the condition, one of (`True`, `False`, `Unknown`).
732 enum:
733 - "True"
734 - "False"
735 - Unknown
736 type: string
737 type:
738 description: Type of the condition, known values are (`Ready`, `Issuing`).
739 type: string
740 required:
741 - status
742 - type
743 type: object
744 type: array
745 x-kubernetes-list-map-keys:
746 - type
747 x-kubernetes-list-type: map
748 failedIssuanceAttempts:
749 description: |-
750 The number of continuous failed issuance attempts up till now. This
751 field gets removed (if set) on a successful issuance and gets set to
752 1 if unset and an issuance has failed. If an issuance has failed, the
753 delay till the next issuance will be calculated using formula
754 time.Hour * 2 ^ (failedIssuanceAttempts - 1).
755 type: integer
756 lastFailureTime:
757 description: |-
758 LastFailureTime is set only if the latest issuance for this
759 Certificate failed and contains the time of the failure. If an
760 issuance has failed, the delay till the next issuance will be
761 calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
762 1). If the latest issuance has succeeded this field will be unset.
763 format: date-time
764 type: string
765 nextPrivateKeySecretName:
766 description: |-
767 The name of the Secret resource containing the private key to be used
768 for the next certificate iteration.
769 The keymanager controller will automatically set this field if the
770 `Issuing` condition is set to `True`.
771 It will automatically unset this field when the Issuing condition is
772 not set or False.
773 type: string
774 notAfter:
775 description: |-
776 The expiration time of the certificate stored in the secret named
777 by this resource in `spec.secretName`.
778 format: date-time
779 type: string
780 notBefore:
781 description: |-
782 The time after which the certificate stored in the secret named
783 by this resource in `spec.secretName` is valid.
784 format: date-time
785 type: string
786 renewalTime:
787 description: |-
788 RenewalTime is the time at which the certificate will be next
789 renewed.
790 If not set, no upcoming renewal is scheduled.
791 format: date-time
792 type: string
793 revision:
794 description: |-
795 The current 'revision' of the certificate as issued.
796
797 When a CertificateRequest resource is created, it will have the
798 `cert-manager.io/certificate-revision` set to one greater than the
799 current value of this field.
800
801 Upon issuance, this field will be set to the value of the annotation
802 on the CertificateRequest resource used to issue the certificate.
803
804 Persisting the value on the CertificateRequest resource allows the
805 certificates controller to know whether a request is part of an old
806 issuance or if it is part of the ongoing revision's issuance by
807 checking if the revision value in the annotation is greater than this
808 field.
809 type: integer
810 type: object
811 type: object
812 served: true
813 storage: true
814 subresources:
815 status: {}
816{{- end }}