cert-manager: 1.19.6 -> 1.20.3
Change-Id: Iabb070751250884fca8064f8b27d0a86a63959af
diff --git a/charts/cert-manager/README.md b/charts/cert-manager/README.md
index 872ba1d..bba0bc8 100644
--- a/charts/cert-manager/README.md
+++ b/charts/cert-manager/README.md
@@ -4,7 +4,7 @@
cert-manager can obtain certificates from a [variety of certificate authorities](https://cert-manager.io/docs/configuration/issuers/), including:
[Let's Encrypt](https://cert-manager.io/docs/configuration/acme/), [HashiCorp Vault](https://cert-manager.io/docs/configuration/vault/),
-[Venafi](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
+[CyberArk](https://cert-manager.io/docs/configuration/venafi/) and [private PKI](https://cert-manager.io/docs/configuration/ca/).
## Prerequisites
@@ -26,7 +26,7 @@
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
- --version v1.19.6 \
+ --version v1.20.3 \
--set crds.enabled=true
```
@@ -269,6 +269,11 @@
This configures the maximum unavailable pods for disruptions. It can either be set to an integer (e.g., 1) or a percentage value (e.g., 25%). it cannot be used if `minAvailable` is set.
+#### **podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
#### **featureGates** ~ `string`
> Default value:
> ```yaml
@@ -283,17 +288,51 @@
> ```
The maximum number of challenges that can be scheduled as 'processing' at once.
+#### **imageRegistry** ~ `string`
+> Default value:
+> ```yaml
+> quay.io
+> ```
+
+The container registry used for all cert-manager images by default. This can include path prefixes (e.g. `artifactory.example.com/docker`).
+
+#### **imageNamespace** ~ `string`
+> Default value:
+> ```yaml
+> jetstack
+> ```
+
+The repository namespace used for all cert-manager images by default.
+Examples:
+- jetstack
+- cert-manager
+
#### **image.registry** ~ `string`
-The container registry to pull the manager image from.
+Deprecated: per-component registry prefix.
+
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from
+`imageRegistry` + `imageNamespace` + `image.name`.
+
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-controller
+> ```
+
+The image name for the cert-manager controller.
+This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
#### **image.repository** ~ `string`
> Default value:
> ```yaml
-> quay.io/jetstack/cert-manager-controller
+> ""
> ```
-The container image for the cert-manager controller.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
+Example: quay.io/jetstack/cert-manager-controller
#### **image.tag** ~ `string`
@@ -301,7 +340,7 @@
#### **image.digest** ~ `string`
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
#### **image.pullPolicy** ~ `string`
> Default value:
@@ -401,25 +440,21 @@
kubernetesAPIBurst: 9000
numberOfConcurrentWorkers: 200
enableGatewayAPI: true
- # Feature gates as of v1.18.1. Listed with their default values.
+ # Feature gates as of v1.20.0. Listed with their default values.
# See https://cert-manager.io/docs/cli/controller/
featureGates:
- AdditionalCertificateOutputFormats: true # GA - default=true
AllAlpha: false # ALPHA - default=false
AllBeta: false # BETA - default=false
+ ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
ExperimentalGatewayAPISupport: true # BETA - default=true
LiteralCertificateSubject: true # BETA - default=true
NameConstraints: true # BETA - default=true
- OtherNames: false # ALPHA - default=false
+ OtherNames: true # BETA - default=true
SecretsFilteredCaching: true # BETA - default=true
ServerSideApply: false # ALPHA - default=false
StableCertificateRequestName: true # BETA - default=true
UseCertificateRequestBasicConstraints: false # ALPHA - default=false
- UseDomainQualifiedFinalizer: true # GA - default=true
- ValidateCAA: false # ALPHA - default=false
- DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
- ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
# Configure the metrics server for TLS
# See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
metricsTLSConfig:
@@ -428,6 +463,13 @@
secretName: "cert-manager-metrics-ca"
dnsNames:
- cert-manager-metrics
+ # Configure PEM size limits for certificate validation
+ # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+ pemSizeLimitsConfig:
+ maxCertificateSize: 36500 # Maximum size in bytes for individual certificates (default: 36500)
+ maxPrivateKeySize: 13000 # Maximum size in bytes for private keys (default: 13000)
+ maxChainLength: 95000 # Maximum size in bytes for certificate chains (default: 95000)
+ maxBundleSize: 330000 # Maximum size in bytes for certificate bundles (default: 330000)
```
#### **dns01RecursiveNameservers** ~ `string`
> Default value:
@@ -476,6 +518,43 @@
extraArgs:
- --controllers=*,-certificaterequests-approver
```
+#### **extraContainers** ~ `array`
+> Default value:
+> ```yaml
+> []
+> ```
+
+Extra containers to add to the pod spec in the deployment of the cert-manager controller. For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+
+```yaml
+extraEnv:
+ - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+ - value: http://127.0.0.1:9911
+extraContainers:
+ - name: rolesanywhere-credential-helper
+ image: public.ecr.aws/rolesanywhere/credential-helper:latest
+ command: [aws_signing_helper]
+ args:
+ - serve
+ - --private-key
+ - /etc/cert/tls.key
+ - --certificate
+ - /etc/cert/tls.crt
+ - --role-arn
+ - $ROLE_ARN
+ - --profile-arn
+ - $PROFILE_ARN
+ - --trust-anchor-arn
+ - $TRUST_ANCHOR_ARN
+ volumeMounts:
+ - name: cert
+ mountPath: /etc/cert/
+ readOnly: true
+volumes:
+ - name: cert
+ secret:
+ secretName: cert
+```
#### **extraEnv** ~ `array`
> Default value:
> ```yaml
@@ -601,6 +680,45 @@
This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
+#### **networkPolicy.enabled** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+Create network policies for cert-manager.
+#### **networkPolicy.ingress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+> - port: http-metrics
+> protocol: TCP
+> - port: http-healthz
+> protocol: TCP
+> ```
+
+Ingress rule for the cert-manager network policy.
+By default all pods are allowed access to:
+ http-metrics and http-healthz ports
+
+#### **networkPolicy.egress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+> - port: 80
+> protocol: TCP
+> - port: 443
+> protocol: TCP
+> - port: 53
+> protocol: TCP
+> - port: 53
+> protocol: UDP
+> - port: 6443
+> protocol: TCP
+> ```
+
+Egress rule for the cert-manager network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
+
#### **ingressShim.defaultIssuerName** ~ `string`
Optional default issuer to use for ingress resources.
@@ -1012,6 +1130,11 @@
It cannot be used if `minAvailable` is set.
+#### **webhook.podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
#### **webhook.deploymentAnnotations** ~ `object`
Optional additional annotations to add to the webhook Deployment.
@@ -1221,15 +1344,28 @@
Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6.
#### **webhook.image.registry** ~ `string`
-The container registry to pull the webhook image from.
+Deprecated: per-component registry prefix.
+
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `webhook.image.repository` is set and when the repository is computed from
+`imageRegistry` + `imageNamespace` + `webhook.image.name`.
+
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **webhook.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-webhook
+> ```
+
+The image name for the cert-manager webhook.
#### **webhook.image.repository** ~ `string`
> Default value:
> ```yaml
-> quay.io/jetstack/cert-manager-webhook
+> ""
> ```
-The container image for the cert-manager webhook
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
#### **webhook.image.tag** ~ `string`
@@ -1237,7 +1373,7 @@
#### **webhook.image.digest** ~ `string`
-Setting a digest will override any tag
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
#### **webhook.image.pullPolicy** ~ `string`
> Default value:
@@ -1323,14 +1459,18 @@
#### **webhook.networkPolicy.ingress** ~ `array`
> Default value:
> ```yaml
-> - from:
-> - ipBlock:
-> cidr: 0.0.0.0/0
-> - ipBlock:
-> cidr: ::/0
+> - ports:
+> - port: https
+> protocol: TCP
+> - port: healthcheck
+> protocol: TCP
+> - port: http-metrics
+> protocol: TCP
> ```
-Ingress rule for the webhook network policy. By default, it allows all inbound traffic.
+Ingress rule for the webhook network policy.
+By default all pods are allowed access to:
+ https, http-metrics, and http-healthz ports
#### **webhook.networkPolicy.egress** ~ `array`
> Default value:
@@ -1346,11 +1486,6 @@
> protocol: UDP
> - port: 6443
> protocol: TCP
-> to:
-> - ipBlock:
-> cidr: 0.0.0.0/0
-> - ipBlock:
-> cidr: ::/0
> ```
Egress rule for the webhook network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1376,6 +1511,27 @@
> ```
enableServiceLinks indicates whether information about services should be injected into the pod's environment variables, matching the syntax of Docker links.
+#### **webhook.enableClientVerification** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+enableClientVerification turns on client verification of requests made to the webhook server
+#### **webhook.clientCAFile** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+the client CA file to be used for verification
+#### **webhook.apiserverClientCertSubjects** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+Subject names to verify for the client certificate. Multiple values may be supplied as a comma-separated list.
### CA Injector
#### **cainjector.enabled** ~ `bool`
@@ -1466,6 +1622,43 @@
Container Security Context to be set on the cainjector component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+#### **cainjector.networkPolicy.enabled** ~ `bool`
+> Default value:
+> ```yaml
+> false
+> ```
+
+Create network policies for the cainjector.
+#### **cainjector.networkPolicy.ingress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+> - port: http-metrics
+> protocol: TCP
+> ```
+
+Ingress rule for the webhook cainjector policy.
+By default all pods are allowed access to:
+ http-metrics port
+
+#### **cainjector.networkPolicy.egress** ~ `array`
+> Default value:
+> ```yaml
+> - ports:
+> - port: 80
+> protocol: TCP
+> - port: 443
+> protocol: TCP
+> - port: 53
+> protocol: TCP
+> - port: 53
+> protocol: UDP
+> - port: 6443
+> protocol: TCP
+> ```
+
+Egress rule for the cainjector network policy. By default, it allows all outbound traffic to ports 80 and 443, as well as DNS ports.
+
#### **cainjector.podDisruptionBudget.enabled** ~ `bool`
> Default value:
> ```yaml
@@ -1490,6 +1683,11 @@
Cannot be used if `minAvailable` is set.
+#### **cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy** ~ `string`
+
+This configures how to act with unhealthy pods during eviction. Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for the cluster to work.
+
+
#### **cainjector.deploymentAnnotations** ~ `object`
Optional additional annotations to add to the cainjector Deployment.
@@ -1631,15 +1829,28 @@
Optional additional labels to add to the CA Injector metrics Service.
#### **cainjector.image.registry** ~ `string`
-The container registry to pull the cainjector image from.
+Deprecated: per-component registry prefix.
+
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `cainjector.image.repository` is set and when the repository is computed from
+`imageRegistry` + `imageNamespace` + `cainjector.image.name`.
+
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **cainjector.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-cainjector
+> ```
+
+The image name for the cert-manager cainjector.
#### **cainjector.image.repository** ~ `string`
> Default value:
> ```yaml
-> quay.io/jetstack/cert-manager-cainjector
+> ""
> ```
-The container image for the cert-manager cainjector
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
#### **cainjector.image.tag** ~ `string`
@@ -1647,7 +1858,7 @@
#### **cainjector.image.digest** ~ `string`
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
#### **cainjector.image.pullPolicy** ~ `string`
> Default value:
@@ -1712,15 +1923,28 @@
#### **acmesolver.image.registry** ~ `string`
-The container registry to pull the acmesolver image from.
+Deprecated: per-component registry prefix.
+
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `acmesolver.image.repository` is set and when the repository is computed from
+`imageRegistry` + `imageNamespace` + `acmesolver.image.name`.
+
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **acmesolver.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-acmesolver
+> ```
+
+The image name for the cert-manager acmesolver.
#### **acmesolver.image.repository** ~ `string`
> Default value:
> ```yaml
-> quay.io/jetstack/cert-manager-acmesolver
+> ""
> ```
-The container image for the cert-manager acmesolver.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
#### **acmesolver.image.tag** ~ `string`
@@ -1728,7 +1952,7 @@
#### **acmesolver.image.digest** ~ `string`
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
#### **acmesolver.image.pullPolicy** ~ `string`
> Default value:
@@ -1895,15 +2119,28 @@
Optional additional labels to add to the startupapicheck Pods.
#### **startupapicheck.image.registry** ~ `string`
-The container registry to pull the startupapicheck image from.
+Deprecated: per-component registry prefix.
+
+If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `startupapicheck.image.repository` is set and when the repository is computed from
+`imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.
+
+This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`. Prefer using the global `imageRegistry`/`imageNamespace` values.
+
+#### **startupapicheck.image.name** ~ `string`
+> Default value:
+> ```yaml
+> cert-manager-startupapicheck
+> ```
+
+The image name for the cert-manager startupapicheck.
#### **startupapicheck.image.repository** ~ `string`
> Default value:
> ```yaml
-> quay.io/jetstack/cert-manager-startupapicheck
+> ""
> ```
-The container image for the cert-manager startupapicheck.
+Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
#### **startupapicheck.image.tag** ~ `string`
@@ -1911,7 +2148,7 @@
#### **startupapicheck.image.digest** ~ `string`
-Setting a digest will override any tag.
+Setting a digest pins the image. If a tag is also set, the rendered reference will include both ("image:tag@digest"), though only the digest will be used for pulling.
#### **startupapicheck.image.pullPolicy** ~ `string`
> Default value: