cert-manager: 1.19.6 -> 1.20.3
Change-Id: Iabb070751250884fca8064f8b27d0a86a63959af
diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml
index 54257c7..4bd3ebf 100644
--- a/charts/cert-manager/values.yaml
+++ b/charts/cert-manager/values.yaml
@@ -21,7 +21,7 @@
# If a component-specific nodeSelector is also set, it will be merged and take precedence.
# +docs:property
nodeSelector: {}
-
+
# Labels to apply to all resources.
# Please note that this does not add labels to the resources created dynamically by the controllers.
# For these resources, you have to add the labels in the template in the cert-manager custom resource:
@@ -153,6 +153,13 @@
# +docs:type=unknown
# maxUnavailable: 1
+ # This configures how to act with unhealthy pods during eviction
+ # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+ # the cluster to work.
+ # +docs:property
+ # +docs:type=string
+ # unhealthyPodEvictionPolicy: AlwaysAllow
+
# A comma-separated list of feature gates that should be enabled on the
# controller pod.
featureGates: ""
@@ -160,21 +167,47 @@
# The maximum number of challenges that can be scheduled as 'processing' at once.
maxConcurrentChallenges: 60
-image:
- # The container registry to pull the manager image from.
- # +docs:property
- # registry: quay.io
+# The container registry used for all cert-manager images by default.
+# This can include path prefixes (e.g. `artifactory.example.com/docker`).
+# +docs:property
+imageRegistry: quay.io
- # The container image for the cert-manager controller.
+# The repository namespace used for all cert-manager images by default.
+# Examples:
+# - jetstack
+# - cert-manager
+# +docs:property
+imageNamespace: jetstack
+
+image:
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- repository: quay.io/jetstack/cert-manager-controller
+ # registry: ""
+
+ # The image name for the cert-manager controller.
+ # This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
+ # +docs:property
+ name: cert-manager-controller
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
+ # Example: quay.io/jetstack/cert-manager-controller
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion is used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -254,25 +287,21 @@
# kubernetesAPIBurst: 9000
# numberOfConcurrentWorkers: 200
# enableGatewayAPI: true
-# # Feature gates as of v1.18.1. Listed with their default values.
+# # Feature gates as of v1.20.0. Listed with their default values.
# # See https://cert-manager.io/docs/cli/controller/
# featureGates:
-# AdditionalCertificateOutputFormats: true # GA - default=true
# AllAlpha: false # ALPHA - default=false
# AllBeta: false # BETA - default=false
+# ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
# ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
# ExperimentalGatewayAPISupport: true # BETA - default=true
# LiteralCertificateSubject: true # BETA - default=true
# NameConstraints: true # BETA - default=true
-# OtherNames: false # ALPHA - default=false
+# OtherNames: true # BETA - default=true
# SecretsFilteredCaching: true # BETA - default=true
# ServerSideApply: false # ALPHA - default=false
# StableCertificateRequestName: true # BETA - default=true
# UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-# UseDomainQualifiedFinalizer: true # GA - default=true
-# ValidateCAA: false # ALPHA - default=false
-# DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
-# ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
# # Configure the metrics server for TLS
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
# metricsTLSConfig:
@@ -281,6 +310,13 @@
# secretName: "cert-manager-metrics-ca"
# dnsNames:
# - cert-manager-metrics
+# # Configure PEM size limits for certificate validation
+# # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+# pemSizeLimitsConfig:
+# maxCertificateSize: 36500 # Maximum size in bytes for individual certificates (default: 36500)
+# maxPrivateKeySize: 13000 # Maximum size in bytes for private keys (default: 13000)
+# maxChainLength: 95000 # Maximum size in bytes for certificate chains (default: 95000)
+# maxBundleSize: 330000 # Maximum size in bytes for certificate bundles (default: 330000)
config: {}
# Setting Nameservers for DNS01 Self Check.
@@ -320,6 +356,38 @@
# - --controllers=*,-certificaterequests-approver
extraArgs: []
+# Extra containers to add to the pod spec in the deployment of the cert-manager controller.
+# For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+#
+# extraEnv:
+# - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+# - value: http://127.0.0.1:9911
+# extraContainers:
+# - name: rolesanywhere-credential-helper
+# image: public.ecr.aws/rolesanywhere/credential-helper:latest
+# command: [aws_signing_helper]
+# args:
+# - serve
+# - --private-key
+# - /etc/cert/tls.key
+# - --certificate
+# - /etc/cert/tls.crt
+# - --role-arn
+# - $ROLE_ARN
+# - --profile-arn
+# - $PROFILE_ARN
+# - --trust-anchor-arn
+# - $TRUST_ANCHOR_ARN
+# volumeMounts:
+# - name: cert
+# mountPath: /etc/cert/
+# readOnly: true
+# volumes:
+# - name: cert
+# secret:
+# secretName: cert
+extraContainers: []
+
# Additional environment variables to pass to cert-manager controller binary.
# For example:
# extraEnv:
@@ -429,6 +497,45 @@
nodeSelector:
kubernetes.io/os: linux
+# Enables default network policies for cert-manager.
+# This provides a way for you to restrict network traffic
+# between cert-manager components and other pods.
+# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+# NOTE: an incorrect networkPolicy will cause traffic to be dropped
+networkPolicy:
+ # Create network policies for cert-manager.
+ enabled: false
+
+ # Ingress rule for the cert-manager network policy.
+ # By default all pods are allowed access to:
+ # http-metrics and http-healthz ports
+ # +docs:property
+ ingress:
+ - ports:
+ - port: http-metrics
+ protocol: TCP
+ - port: http-healthz
+ protocol: TCP
+
+
+ # Egress rule for the cert-manager network policy. By default, it allows all
+ # outbound traffic to ports 80 and 443, as well as DNS ports.
+ # +docs:property
+ egress:
+ - ports:
+ - port: 80
+ protocol: TCP
+ - port: 443
+ protocol: TCP
+ - port: 53
+ protocol: TCP
+ - port: 53
+ protocol: UDP
+ # On OpenShift and OKD, the Kubernetes API server listens on.
+ # port 6443.
+ - port: 6443
+ protocol: TCP
+
# +docs:ignore
ingressShim: {}
@@ -744,6 +851,13 @@
# +docs:type=unknown
# maxUnavailable: 1
+ # This configures how to act with unhealthy pods during eviction
+ # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+ # the cluster to work.
+ # +docs:property
+ # +docs:type=string
+ # unhealthyPodEvictionPolicy: AlwaysAllow
+
# Optional additional annotations to add to the webhook Deployment.
# +docs:property
# deploymentAnnotations: {}
@@ -896,20 +1010,32 @@
serviceIPFamilies: []
image:
- # The container registry to pull the webhook image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `webhook.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `webhook.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- # registry: quay.io
+ # registry: ""
- # The container image for the cert-manager webhook
+ # The image name for the cert-manager webhook.
# +docs:property
- repository: quay.io/jetstack/cert-manager-webhook
+ name: cert-manager-webhook
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion will be used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -973,19 +1099,26 @@
# host:
# Enables default network policies for webhooks.
+ # This provides a way for you to restrict network traffic
+ # between cert-manager components and other pods.
+ # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+ # NOTE: an incorrect networkPolicy will cause traffic to be dropped
networkPolicy:
# Create network policies for the webhooks.
enabled: false
- # Ingress rule for the webhook network policy. By default, it allows all
- # inbound traffic.
+ # Ingress rule for the webhook network policy.
+ # By default all pods are allowed access to:
+ # https, http-metrics, and http-healthz ports
# +docs:property
ingress:
- - from:
- - ipBlock:
- cidr: 0.0.0.0/0
- - ipBlock:
- cidr: "::/0"
+ - ports:
+ - port: https
+ protocol: TCP
+ - port: healthcheck
+ protocol: TCP
+ - port: http-metrics
+ protocol: TCP
# Egress rule for the webhook network policy. By default, it allows all
# outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1004,11 +1137,6 @@
# port 6443.
- port: 6443
protocol: TCP
- to:
- - ipBlock:
- cidr: 0.0.0.0/0
- - ipBlock:
- cidr: "::/0"
# Additional volumes to add to the cert-manager controller pod.
volumes: []
@@ -1021,6 +1149,15 @@
# links.
enableServiceLinks: false
+ # enableClientVerification turns on client verification of requests
+ # made to the webhook server
+ enableClientVerification: false
+ # the client CA file to be used for verification
+ clientCAFile: ""
+ # Subject names to verify for the client certificate.
+ # Multiple values may be supplied as a comma-separated list.
+ apiserverClientCertSubjects: ""
+
# +docs:section=CA Injector
cainjector:
@@ -1092,6 +1229,42 @@
- ALL
readOnlyRootFilesystem: true
+ # Enables default network policies for cainjector.
+ # This provides a way for you to restrict network traffic
+ # between cert-manager components and other pods.
+ # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+ # NOTE: an incorrect networkPolicy will cause traffic to be dropped
+ networkPolicy:
+ # Create network policies for the cainjector.
+ enabled: false
+
+ # Ingress rule for the webhook cainjector policy.
+ # By default all pods are allowed access to:
+ # http-metrics port
+ # +docs:property
+ ingress:
+ - ports:
+ - port: http-metrics
+ protocol: TCP
+
+ # Egress rule for the cainjector network policy. By default, it allows all
+ # outbound traffic to ports 80 and 443, as well as DNS ports.
+ # +docs:property
+ egress:
+ - ports:
+ - port: 80
+ protocol: TCP
+ - port: 443
+ protocol: TCP
+ - port: 53
+ protocol: TCP
+ - port: 53
+ protocol: UDP
+ # On OpenShift and OKD, the Kubernetes API server listens on.
+ # port 6443.
+ - port: 6443
+ protocol: TCP
+
podDisruptionBudget:
# Enable or disable the PodDisruptionBudget resource.
#
@@ -1115,6 +1288,13 @@
# +docs:type=unknown
# maxUnavailable: 1
+ # This configures how to act with unhealthy pods during eviction
+ # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+ # the cluster to work.
+ # +docs:property
+ # +docs:type=string
+ # unhealthyPodEvictionPolicy: AlwaysAllow
+
# Optional additional annotations to add to the cainjector Deployment.
# +docs:property
# deploymentAnnotations: {}
@@ -1209,20 +1389,32 @@
serviceLabels: {}
image:
- # The container registry to pull the cainjector image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `cainjector.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `cainjector.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- # registry: quay.io
+ # registry: ""
- # The container image for the cert-manager cainjector
+ # The image name for the cert-manager cainjector.
# +docs:property
- repository: quay.io/jetstack/cert-manager-cainjector
+ name: cert-manager-cainjector
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion will be used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -1268,20 +1460,32 @@
acmesolver:
image:
- # The container registry to pull the acmesolver image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `acmesolver.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `acmesolver.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- # registry: quay.io
+ # registry: ""
- # The container image for the cert-manager acmesolver.
+ # The image name for the cert-manager acmesolver.
# +docs:property
- repository: quay.io/jetstack/cert-manager-acmesolver
+ name: cert-manager-acmesolver
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion is used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -1401,20 +1605,32 @@
podLabels: {}
image:
- # The container registry to pull the startupapicheck image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `startupapicheck.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- # registry: quay.io
+ # registry: ""
- # The container image for the cert-manager startupapicheck.
+ # The image name for the cert-manager startupapicheck.
# +docs:property
- repository: quay.io/jetstack/cert-manager-startupapicheck
+ name: cert-manager-startupapicheck
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion is used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20