cert-manager: 1.19.6 -> 1.20.3
Change-Id: Iabb070751250884fca8064f8b27d0a86a63959af
diff --git a/charts/cert-manager/templates/NOTES.txt b/charts/cert-manager/templates/NOTES.txt
index 4d0b4b6..d5d705c 100644
--- a/charts/cert-manager/templates/NOTES.txt
+++ b/charts/cert-manager/templates/NOTES.txt
@@ -2,11 +2,10 @@
⚠️ WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
{{- end }}
-⚠️ WARNING: New default private key rotation policy for Certificate resources.
-The default private key rotation policy for Certificate resources was
-changed to `Always` in cert-manager >= v1.18.0.
-Learn more in the [1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18).
+{{- if or .Values.image.registry .Values.webhook.image.registry .Values.cainjector.image.registry .Values.startupapicheck.image.registry .Values.acmesolver.image.registry }}
+⚠️ WARNING: `*.image.registry` is deprecated. Prefer using the global `imageRegistry` value.
+{{- end }}
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
In order to begin issuing certificates, you will need to set up a ClusterIssuer
@@ -22,3 +21,9 @@
documentation:
https://cert-manager.io/docs/usage/ingress/
+
+For information on how to configure cert-manager to automatically provision
+Certificates for Gateway API resources, take a look at the `gateway resource`
+documentation:
+
+https://cert-manager.io/docs/usage/gateway/
diff --git a/charts/cert-manager/templates/_helpers.tpl b/charts/cert-manager/templates/_helpers.tpl
index f85373f..c58adeb 100644
--- a/charts/cert-manager/templates/_helpers.tpl
+++ b/charts/cert-manager/templates/_helpers.tpl
@@ -180,11 +180,65 @@
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
*/}}
{{- define "image" -}}
-{{- $defaultTag := index . 1 -}}
-{{- with index . 0 -}}
-{{- if .registry -}}{{ printf "%s/%s" .registry .repository }}{{- else -}}{{- .repository -}}{{- end -}}
-{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
-{{- end }}
+{{- /*
+Calling convention:
+
+- (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>)
+
+We intentionally pass imageRegistry/imageNamespace as explicit arguments rather than reading
+from `.Values` inside this helper, because `helm-tool lint` does not reliably track `.Values.*`
+usage through tuple/variable indirection.
+*/ -}}
+
+{{- if ne (len .) 4 -}}
+ {{- fail (printf "ERROR: template \"image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
+{{- end -}}
+
+{{- $image := index . 0 -}}
+{{- $imageRegistry := index . 1 | default "" -}}
+{{- $imageNamespace := index . 2 | default "" -}}
+{{- $defaultReference := index . 3 -}}
+
+{{- $repository := "" -}}
+{{- if $image.repository -}}
+ {{- $repository = $image.repository -}}
+
+ {{- /*
+ Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
+ */ -}}
+ {{- if $image.registry -}}
+ {{- $repository = printf "%s/%s" $image.registry $repository -}}
+ {{- end -}}
+{{- else -}}
+ {{- $name := required "ERROR: image.name must be set when image.repository is empty" $image.name -}}
+ {{- $repository = $name -}}
+
+ {{- if $imageNamespace -}}
+ {{- $repository = printf "%s/%s" $imageNamespace $repository -}}
+ {{- end -}}
+
+ {{- if $imageRegistry -}}
+ {{- $repository = printf "%s/%s" $imageRegistry $repository -}}
+ {{- end -}}
+
+ {{- /*
+ Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
+ */ -}}
+ {{- if $image.registry -}}
+ {{- $repository = printf "%s/%s" $image.registry $repository -}}
+ {{- end -}}
+{{- end -}}
+
+{{- $repository -}}
+{{- if and $image.tag $image.digest -}}
+ {{- printf ":%s@%s" $image.tag $image.digest -}}
+{{- else if $image.tag -}}
+ {{- printf ":%s" $image.tag -}}
+{{- else if $image.digest -}}
+ {{- printf "@%s" $image.digest -}}
+{{- else -}}
+ {{- printf "%s" $defaultReference -}}
+{{- end -}}
{{- end }}
{{/*
diff --git a/charts/cert-manager/templates/cainjector-deployment.yaml b/charts/cert-manager/templates/cainjector-deployment.yaml
index b5434ca..89f6afe 100644
--- a/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -76,7 +76,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-cainjector
- image: "{{ template "image" (tuple .Values.cainjector.image $.Chart.AppVersion) }}"
+ image: "{{ template "image" (tuple .Values.cainjector.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
args:
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
diff --git a/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml b/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
index 6a7d609..65c67bd 100644
--- a/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
+++ b/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
@@ -26,4 +26,7 @@
{{- if hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable" }}
maxUnavailable: {{ .Values.cainjector.podDisruptionBudget.maxUnavailable }}
{{- end }}
+ {{- with .Values.cainjector.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+ unhealthyPodEvictionPolicy: {{ . }}
+ {{- end }}
{{- end }}
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
index 39705f2..039062d 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -283,6 +283,22 @@
The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
If set, ClientID and ClientSecret must also be set.
type: string
+ zoneType:
+ description: |-
+ ZoneType determines which type of Azure DNS zone to use.
+
+ Valid values are:
+ - AzurePublicZone (default): Use a public Azure DNS zone.
+ - AzurePrivateZone: Use an Azure Private DNS zone.
+
+ If not specified, AzurePublicZone is used.
+
+ Support for Azure Private DNS zones is currently
+ experimental and may change in future releases.
+ enum:
+ - AzurePublicZone
+ - AzurePrivateZone
+ type: string
required:
- resourceGroupName
- subscriptionID
@@ -456,8 +472,8 @@
description: |-
The AccessKeyID is used for authentication.
Cannot be set when SecretAccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
type: string
accessKeyIDSecretRef:
@@ -465,8 +481,8 @@
The SecretAccessKey is used for authentication. If set, pull the AWS
access key ID from a key within a Kubernetes Secret.
Cannot be set when AccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
@@ -555,8 +571,8 @@
secretAccessKeySecretRef:
description: |-
The SecretAccessKey is used for authentication.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
@@ -1913,9 +1929,10 @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
@@ -3124,9 +3141,10 @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
@@ -3274,6 +3292,10 @@
- metadata
- spec
type: object
+ selectableFields:
+ - jsonPath: .spec.issuerRef.group
+ - jsonPath: .spec.issuerRef.kind
+ - jsonPath: .spec.issuerRef.name
served: true
storage: true
subresources:
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
index 3242fc4..59596e7 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
@@ -267,6 +267,10 @@
- metadata
- spec
type: object
+ selectableFields:
+ - jsonPath: .spec.issuerRef.group
+ - jsonPath: .spec.issuerRef.kind
+ - jsonPath: .spec.issuerRef.name
served: true
storage: true
subresources:
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
index e25ad1d..2b54283 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml
@@ -312,6 +312,10 @@
type: string
type: object
type: object
+ selectableFields:
+ - jsonPath: .spec.issuerRef.group
+ - jsonPath: .spec.issuerRef.kind
+ - jsonPath: .spec.issuerRef.name
served: true
storage: true
subresources:
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
index 6689de6..7ebc08e 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
@@ -451,9 +451,6 @@
will be generated whenever a re-issuance occurs.
Default is `Always`.
The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
- The new default can be disabled by setting the
- `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
- the controller component.
enum:
- Never
- Always
@@ -809,6 +806,10 @@
type: integer
type: object
type: object
+ selectableFields:
+ - jsonPath: .spec.issuerRef.group
+ - jsonPath: .spec.issuerRef.kind
+ - jsonPath: .spec.issuerRef.name
served: true
storage: true
subresources:
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
index a9ecd4f..f5de226 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -396,6 +396,22 @@
The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
If set, ClientID and ClientSecret must also be set.
type: string
+ zoneType:
+ description: |-
+ ZoneType determines which type of Azure DNS zone to use.
+
+ Valid values are:
+ - AzurePublicZone (default): Use a public Azure DNS zone.
+ - AzurePrivateZone: Use an Azure Private DNS zone.
+
+ If not specified, AzurePublicZone is used.
+
+ Support for Azure Private DNS zones is currently
+ experimental and may change in future releases.
+ enum:
+ - AzurePublicZone
+ - AzurePrivateZone
+ type: string
required:
- resourceGroupName
- subscriptionID
@@ -569,8 +585,8 @@
description: |-
The AccessKeyID is used for authentication.
Cannot be set when SecretAccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
type: string
accessKeyIDSecretRef:
@@ -578,8 +594,8 @@
The SecretAccessKey is used for authentication. If set, pull the AWS
access key ID from a key within a Kubernetes Secret.
Cannot be set when AccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
@@ -668,8 +684,8 @@
secretAccessKeySecretRef:
description: |-
The SecretAccessKey is used for authentication.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
@@ -2026,9 +2042,10 @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
@@ -3237,9 +3254,10 @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
@@ -3496,8 +3514,8 @@
properties:
audiences:
description: |-
- TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
- consisting of the issuer's namespace and name is always included.
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
items:
type: string
type: array
@@ -3625,16 +3643,16 @@
type: object
venafi:
description: |-
- Venafi configures this issuer to sign certificates using a Venafi TPP
- or Venafi Cloud policy zone.
+ Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted
+ or SaaS policy zone.
properties:
cloud:
description: |-
- Cloud specifies the Venafi cloud configuration settings.
- Only one of TPP or Cloud may be specified.
+ Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
+ Only one of CyberArk Certificate Manager may be specified.
properties:
apiTokenSecretRef:
- description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+ description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.
properties:
key:
description: |-
@@ -3652,7 +3670,7 @@
type: object
url:
description: |-
- URL is the base URL for Venafi Cloud.
+ URL is the base URL for CyberArk Certificate Manager SaaS.
Defaults to "https://api.venafi.cloud/".
type: string
required:
@@ -3660,13 +3678,13 @@
type: object
tpp:
description: |-
- TPP specifies Trust Protection Platform configuration settings.
- Only one of TPP or Cloud may be specified.
+ TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
+ Only one of CyberArk Certificate Manager may be specified.
properties:
caBundle:
description: |-
Base64-encoded bundle of PEM CAs which will be used to validate the certificate
- chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+ chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.
If undefined, the certificate bundle in the cert-manager controller container
is used to validate the chain.
format: byte
@@ -3674,7 +3692,7 @@
caBundleSecretRef:
description: |-
Reference to a Secret containing a base64-encoded bundle of PEM CAs
- which will be used to validate the certificate chain presented by the TPP server.
+ which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.
Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
the cert-manager controller container is used to validate the TLS connection.
@@ -3695,7 +3713,7 @@
type: object
credentialsRef:
description: |-
- CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+ CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
The secret must contain the key 'access-token' for the Access Token Authentication,
or two keys, 'username' and 'password' for the API Keys Authentication.
properties:
@@ -3709,7 +3727,7 @@
type: object
url:
description: |-
- URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+ URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,
for example: "https://tpp.example.com/vedsdk".
type: string
required:
@@ -3718,8 +3736,8 @@
type: object
zone:
description: |-
- Zone is the Venafi Policy Zone to use for this issuer.
- All requests made to the Venafi platform will be restricted by the named
+ Zone is the Certificate Manager Policy Zone to use for this issuer.
+ All requests made to the Certificate Manager platform will be restricted by the named
zone policy.
This field is required.
type: string
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
index c88b318..68a2dd0 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
@@ -395,6 +395,22 @@
The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
If set, ClientID and ClientSecret must also be set.
type: string
+ zoneType:
+ description: |-
+ ZoneType determines which type of Azure DNS zone to use.
+
+ Valid values are:
+ - AzurePublicZone (default): Use a public Azure DNS zone.
+ - AzurePrivateZone: Use an Azure Private DNS zone.
+
+ If not specified, AzurePublicZone is used.
+
+ Support for Azure Private DNS zones is currently
+ experimental and may change in future releases.
+ enum:
+ - AzurePublicZone
+ - AzurePrivateZone
+ type: string
required:
- resourceGroupName
- subscriptionID
@@ -568,8 +584,8 @@
description: |-
The AccessKeyID is used for authentication.
Cannot be set when SecretAccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
type: string
accessKeyIDSecretRef:
@@ -577,8 +593,8 @@
The SecretAccessKey is used for authentication. If set, pull the AWS
access key ID from a key within a Kubernetes Secret.
Cannot be set when AccessKeyID is set.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
@@ -667,8 +683,8 @@
secretAccessKeySecretRef:
description: |-
The SecretAccessKey is used for authentication.
- If neither the Access Key nor Key ID are set, we fall-back to using env
- vars, shared credentials file or AWS Instance metadata,
+ If neither the Access Key nor Key ID are set, we fall back to using env
+ vars, shared credentials file, or AWS Instance metadata,
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
properties:
key:
@@ -2025,9 +2041,10 @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
@@ -3236,9 +3253,10 @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
@@ -3495,8 +3513,8 @@
properties:
audiences:
description: |-
- TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token
- consisting of the issuer's namespace and name is always included.
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
items:
type: string
type: array
@@ -3624,16 +3642,16 @@
type: object
venafi:
description: |-
- Venafi configures this issuer to sign certificates using a Venafi TPP
- or Venafi Cloud policy zone.
+ Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted
+ or SaaS policy zone.
properties:
cloud:
description: |-
- Cloud specifies the Venafi cloud configuration settings.
- Only one of TPP or Cloud may be specified.
+ Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.
+ Only one of CyberArk Certificate Manager may be specified.
properties:
apiTokenSecretRef:
- description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token.
+ description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.
properties:
key:
description: |-
@@ -3651,7 +3669,7 @@
type: object
url:
description: |-
- URL is the base URL for Venafi Cloud.
+ URL is the base URL for CyberArk Certificate Manager SaaS.
Defaults to "https://api.venafi.cloud/".
type: string
required:
@@ -3659,13 +3677,13 @@
type: object
tpp:
description: |-
- TPP specifies Trust Protection Platform configuration settings.
- Only one of TPP or Cloud may be specified.
+ TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
+ Only one of CyberArk Certificate Manager may be specified.
properties:
caBundle:
description: |-
Base64-encoded bundle of PEM CAs which will be used to validate the certificate
- chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.
+ chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.
If undefined, the certificate bundle in the cert-manager controller container
is used to validate the chain.
format: byte
@@ -3673,7 +3691,7 @@
caBundleSecretRef:
description: |-
Reference to a Secret containing a base64-encoded bundle of PEM CAs
- which will be used to validate the certificate chain presented by the TPP server.
+ which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.
Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.
If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in
the cert-manager controller container is used to validate the TLS connection.
@@ -3694,7 +3712,7 @@
type: object
credentialsRef:
description: |-
- CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.
+ CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.
The secret must contain the key 'access-token' for the Access Token Authentication,
or two keys, 'username' and 'password' for the API Keys Authentication.
properties:
@@ -3708,7 +3726,7 @@
type: object
url:
description: |-
- URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,
+ URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,
for example: "https://tpp.example.com/vedsdk".
type: string
required:
@@ -3717,8 +3735,8 @@
type: object
zone:
description: |-
- Zone is the Venafi Policy Zone to use for this issuer.
- All requests made to the Venafi platform will be restricted by the named
+ Zone is the Certificate Manager Policy Zone to use for this issuer.
+ All requests made to the Certificate Manager platform will be restricted by the named
zone policy.
This field is required.
type: string
diff --git a/charts/cert-manager/templates/deployment.yaml b/charts/cert-manager/templates/deployment.yaml
index 453e823..c4d267a 100644
--- a/charts/cert-manager/templates/deployment.yaml
+++ b/charts/cert-manager/templates/deployment.yaml
@@ -67,7 +67,7 @@
priorityClassName: {{ . | quote }}
{{- end }}
{{- if (hasKey .Values.global "hostUsers") }}
- hostUsers: {{ .Values.global.hostUsers }}
+ hostUsers: {{ .Values.global.hostUsers }}
{{- end }}
{{- with .Values.securityContext }}
securityContext:
@@ -76,8 +76,8 @@
{{- if or .Values.volumes .Values.config}}
volumes:
{{- if .Values.config }}
- - name: config
- configMap:
+ - name: config
+ configMap:
name: {{ include "cert-manager.fullname" . }}
{{- end }}
{{ with .Values.volumes }}
@@ -86,7 +86,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-controller
- image: "{{ template "image" (tuple .Values.image $.Chart.AppVersion) }}"
+ image: "{{ template "image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -114,9 +114,7 @@
- --leader-election-retry-period={{ .retryPeriod }}
{{- end }}
{{- end }}
- {{- with .Values.acmesolver.image }}
- - --acme-http01-solver-image={{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}
- {{- end }}
+ - --acme-http01-solver-image={{ template "image" (tuple .Values.acmesolver.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}
{{- with .Values.extraArgs }}
{{- toYaml . | nindent 10 }}
{{- end }}
@@ -163,7 +161,7 @@
{{- if or .Values.config .Values.volumeMounts }}
volumeMounts:
{{- if .Values.config }}
- - name: config
+ - name: config
mountPath: /var/cert-manager/config
{{- end }}
{{- with .Values.volumeMounts }}
@@ -212,6 +210,9 @@
failureThreshold: {{ .failureThreshold }}
{{- end }}
{{- end }}
+ {{- if .Values.extraContainers }}
+ {{- toYaml .Values.extraContainers | nindent 8 }}
+ {{- end }}
{{- $nodeSelector := .Values.global.nodeSelector | default dict }}
{{- $nodeSelector = merge $nodeSelector (.Values.nodeSelector | default dict) }}
{{- with $nodeSelector }}
diff --git a/charts/cert-manager/templates/networkpolicy-cainjector.yaml b/charts/cert-manager/templates/networkpolicy-cainjector.yaml
new file mode 100644
index 0000000..f5a82e5
--- /dev/null
+++ b/charts/cert-manager/templates/networkpolicy-cainjector.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.cainjector.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "cainjector.fullname" . }}-allow-ingress
+ namespace: {{ include "cert-manager.namespace" . }}
+spec:
+ ingress:
+ {{- with .Values.cainjector.networkPolicy.ingress }}
+ {{- toYaml . | nindent 2 }}
+ {{- end }}
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "cainjector.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "cainjector"
+ policyTypes:
+ - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "cainjector.fullname" . }}-allow-egress
+ namespace: {{ include "cert-manager.namespace" . }}
+spec:
+ egress:
+ {{- with .Values.cainjector.networkPolicy.egress }}
+ {{- toYaml . | nindent 2 }}
+ {{- end }}
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "cainjector.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "cainjector"
+ policyTypes:
+ - Egress
+{{- end }}
diff --git a/charts/cert-manager/templates/networkpolicy-cert-manager.yaml b/charts/cert-manager/templates/networkpolicy-cert-manager.yaml
new file mode 100644
index 0000000..410c15d
--- /dev/null
+++ b/charts/cert-manager/templates/networkpolicy-cert-manager.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "cert-manager.fullname" . }}-allow-ingress
+ namespace: {{ include "cert-manager.namespace" . }}
+spec:
+ ingress:
+ {{- with .Values.networkPolicy.ingress }}
+ {{- toYaml . | nindent 2 }}
+ {{- end }}
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "controller"
+ policyTypes:
+ - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "cert-manager.fullname" . }}-allow-egress
+ namespace: {{ include "cert-manager.namespace" . }}
+spec:
+ egress:
+ {{- with .Values.networkPolicy.egress }}
+ {{- toYaml . | nindent 2 }}
+ {{- end }}
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "controller"
+ policyTypes:
+ - Egress
+{{- end }}
diff --git a/charts/cert-manager/templates/networkpolicy-egress.yaml b/charts/cert-manager/templates/networkpolicy-egress.yaml
deleted file mode 100644
index 37f90bd..0000000
--- a/charts/cert-manager/templates/networkpolicy-egress.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.webhook.networkPolicy.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
- name: {{ template "webhook.fullname" . }}-allow-egress
- namespace: {{ include "cert-manager.namespace" . }}
-spec:
- egress:
- {{- with .Values.webhook.networkPolicy.egress }}
- {{- toYaml . | nindent 2 }}
- {{- end }}
- podSelector:
- matchLabels:
- app.kubernetes.io/name: {{ include "webhook.name" . }}
- app.kubernetes.io/instance: {{ .Release.Name }}
- app.kubernetes.io/component: "webhook"
- policyTypes:
- - Egress
-{{- end }}
diff --git a/charts/cert-manager/templates/networkpolicy-webhooks.yaml b/charts/cert-manager/templates/networkpolicy-webhooks.yaml
index 3a0ed7a..7377117 100644
--- a/charts/cert-manager/templates/networkpolicy-webhooks.yaml
+++ b/charts/cert-manager/templates/networkpolicy-webhooks.yaml
@@ -1,5 +1,5 @@
{{- if .Values.webhook.networkPolicy.enabled }}
-
+---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
@@ -17,5 +17,22 @@
app.kubernetes.io/component: "webhook"
policyTypes:
- Ingress
-
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "webhook.fullname" . }}-allow-egress
+ namespace: {{ include "cert-manager.namespace" . }}
+spec:
+ egress:
+ {{- with .Values.webhook.networkPolicy.egress }}
+ {{- toYaml . | nindent 2 }}
+ {{- end }}
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "webhook.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "webhook"
+ policyTypes:
+ - Egress
{{- end }}
diff --git a/charts/cert-manager/templates/poddisruptionbudget.yaml b/charts/cert-manager/templates/poddisruptionbudget.yaml
index ae71eed..107dd72 100644
--- a/charts/cert-manager/templates/poddisruptionbudget.yaml
+++ b/charts/cert-manager/templates/poddisruptionbudget.yaml
@@ -26,4 +26,7 @@
{{- if hasKey .Values.podDisruptionBudget "maxUnavailable" }}
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
{{- end }}
+ {{- with .Values.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+ unhealthyPodEvictionPolicy: {{ . }}
+ {{- end }}
{{- end }}
diff --git a/charts/cert-manager/templates/podmonitor.yaml b/charts/cert-manager/templates/podmonitor.yaml
index 83f7e1e..72d2dfe 100644
--- a/charts/cert-manager/templates/podmonitor.yaml
+++ b/charts/cert-manager/templates/podmonitor.yaml
@@ -27,7 +27,7 @@
{{- end }}
{{- end }}
spec:
- jobLabel: {{ template "cert-manager.fullname" . }}
+ jobLabel: app.kubernetes.io/name
selector:
matchExpressions:
- key: app.kubernetes.io/name
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index 076fd05..e1a01b9 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -208,6 +208,9 @@
- apiGroups: ["acme.cert-manager.io"]
resources: ["orders/finalizers"]
verbs: ["update"]
+ - apiGroups: ["cert-manager.io"]
+ resources: ["clusterissuers/finalizers", "issuers/finalizers"]
+ verbs: ["update"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch"]
@@ -306,10 +309,10 @@
resources: ["ingresses/finalizers"]
verbs: ["update"]
- apiGroups: ["gateway.networking.k8s.io"]
- resources: ["gateways", "httproutes"]
+ resources: ["gateways", "httproutes", "listenersets"]
verbs: ["get", "list", "watch"]
- apiGroups: ["gateway.networking.k8s.io"]
- resources: ["gateways/finalizers", "httproutes/finalizers"]
+ resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"]
verbs: ["update"]
- apiGroups: [""]
resources: ["events"]
diff --git a/charts/cert-manager/templates/servicemonitor.yaml b/charts/cert-manager/templates/servicemonitor.yaml
index a29f3c6..76f358f 100644
--- a/charts/cert-manager/templates/servicemonitor.yaml
+++ b/charts/cert-manager/templates/servicemonitor.yaml
@@ -29,7 +29,7 @@
{{- end }}
{{- end }}
spec:
- jobLabel: {{ template "cert-manager.fullname" . }}
+ jobLabel: app.kubernetes.io/name
selector:
matchExpressions:
- key: app.kubernetes.io/name
diff --git a/charts/cert-manager/templates/startupapicheck-job.yaml b/charts/cert-manager/templates/startupapicheck-job.yaml
index f68d540..7f1b0ff 100644
--- a/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -48,9 +48,13 @@
securityContext:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- with .Values.global.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
containers:
- name: {{ .Chart.Name }}-startupapicheck
- image: "{{ template "image" (tuple .Values.startupapicheck.image $.Chart.AppVersion) }}"
+ image: "{{ template "image" (tuple .Values.startupapicheck.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
args:
- check
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index d2b10ae..66d6ead 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -81,7 +81,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-webhook
- image: "{{ template "image" (tuple .Values.webhook.image $.Chart.AppVersion) }}"
+ image: "{{ template "image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
args:
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -98,6 +98,15 @@
{{- if .Values.webhook.featureGates }}
- --feature-gates={{ .Values.webhook.featureGates }}
{{- end }}
+ {{- if .Values.webhook.enableClientVerification }}
+ - --enable-client-verification={{ .Values.webhook.enableClientVerification }}
+ {{- end }}
+ {{- if .Values.webhook.clientCAFile }}
+ - --client-ca-path={{ .Values.webhook.clientCAFile }}
+ {{- end }}
+ {{- if .Values.webhook.apiserverClientCertSubjects }}
+ - --client-subject-names={{ .Values.webhook.apiserverClientCertSubjects }}
+ {{- end }}
{{- $tlsConfig := default $config.tlsConfig "" }}
{{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}}
- --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
diff --git a/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml b/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
index ab2a481..2789136 100644
--- a/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
+++ b/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
@@ -26,4 +26,7 @@
{{- if hasKey .Values.webhook.podDisruptionBudget "maxUnavailable" }}
maxUnavailable: {{ .Values.webhook.podDisruptionBudget.maxUnavailable }}
{{- end }}
+ {{- with .Values.webhook.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+ unhealthyPodEvictionPolicy: {{ . }}
+ {{- end }}
{{- end }}