cert-manager: 1.20.3 -> 1.21.0
Change-Id: I50161b8cfd621c1b07de87358fe8c14d1b14f711
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
index f5de226..6b401c4 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -3328,6 +3328,24 @@
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
type: array
x-kubernetes-list-type: atomic
@@ -3442,6 +3460,62 @@
- roleId
- secretRef
type: object
+ aws:
+ description: |-
+ AWS authenticates with Vault using AWS IAM authentication.
+ This allows authentication using IAM roles for service accounts (IRSA),
+ EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+ properties:
+ iamRoleArn:
+ description: |-
+ The ARN of the AWS IAM role to assume using the Kubernetes service account
+ token. Required when using IRSA (serviceAccountRef is set).
+ This role must have a trust policy that allows the OIDC provider to assume it.
+ type: string
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/aws" will be used.
+ type: string
+ region:
+ description: |-
+ The AWS region to use for authentication. If not specified, the region
+ will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+ variables, falling back to "us-east-1" if not set.
+ type: string
+ role:
+ description: A required field containing the Vault Role to assume when authenticating.
+ minLength: 1
+ type: string
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a web identity
+ token for IRSA (IAM Roles for Service Accounts) authentication.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ vaultHeaderValue:
+ description: |-
+ The Vault header value to include in the STS signing request.
+ This is used to prevent replay attacks.
+ type: string
+ required:
+ - role
+ type: object
clientCertificate:
description: |-
ClientCertificate authenticates with Vault by presenting a client
@@ -3676,6 +3750,46 @@
required:
- apiTokenSecretRef
type: object
+ ngts:
+ description: |-
+ NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+ using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+ properties:
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+ Client ID and Client Secret. The secret must contain the keys 'client-id' and
+ 'client-secret'.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ tokenEndpoint:
+ description: |-
+ TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+ for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+ Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+ type: string
+ tsgID:
+ description: |-
+ TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+ for example "1234567890". The tsg_id: prefix is added automatically.
+ This field is required.
+ type: string
+ url:
+ description: |-
+ URL is the base URL for the NGTS API endpoint.
+ Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+ type: string
+ required:
+ - credentialsRef
+ - tsgID
+ type: object
tpp:
description: |-
TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -3744,6 +3858,9 @@
required:
- zone
type: object
+ x-kubernetes-validations:
+ - message: exactly one of tpp, cloud, or ngts must be configured
+ rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
type: object
status:
description: Status of the ClusterIssuer. This is set and managed automatically.