cert-manager: 1.20.3 -> 1.21.0
Change-Id: I50161b8cfd621c1b07de87358fe8c14d1b14f711
diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml
index 4bd3ebf..be1388d 100644
--- a/charts/cert-manager/values.yaml
+++ b/charts/cert-manager/values.yaml
@@ -23,12 +23,14 @@
nodeSelector: {}
# Labels to apply to all resources.
- # Please note that this does not add labels to the resources created dynamically by the controllers.
- # For these resources, you have to add the labels in the template in the cert-manager custom resource:
- # For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
- # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).
- # For example, secretTemplate in CertificateSpec
- # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
+ # These labels are also applied to dynamically-created ACME HTTP01 solver resources
+ # (pods, services, ingresses, or Gateway API HTTPRoutes).
+ # The following ACME identity label keys are reserved and will be
+ # silently ignored on dynamically-created resources: acme.cert-manager.io/http-domain,
+ # acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver.
+ # For per-Issuer-specific labels, use the HTTP01 ingress solver podTemplate and
+ # ingressTemplate fields for pod/ingress resources, or the gatewayHTTPRoute
+ # solver labels field for Gateway API HTTPRoute resources.
commonLabels: {}
# The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
@@ -90,6 +92,13 @@
# +docs:property
# retryPeriod: 15s
+ # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+ #
+ # For example:
+ # runtimeClassName: gvisor
+ # +docs:property
+ runtimeClassName: ""
+
# This option is equivalent to setting crds.enabled=true and crds.keep=true.
# Deprecated: use crds.enabled and crds.keep instead.
installCRDs: false
@@ -286,7 +295,8 @@
# kubernetesAPIQPS: 9000
# kubernetesAPIBurst: 9000
# numberOfConcurrentWorkers: 200
-# enableGatewayAPI: true
+# gatewayAPI:
+# enable: true
# # Feature gates as of v1.20.0. Listed with their default values.
# # See https://cert-manager.io/docs/cli/controller/
# featureGates:
@@ -317,6 +327,9 @@
# maxPrivateKeySize: 13000 # Maximum size in bytes for private keys (default: 13000)
# maxChainLength: 95000 # Maximum size in bytes for certificate chains (default: 95000)
# maxBundleSize: 330000 # Maximum size in bytes for certificate bundles (default: 330000)
+# # Configure certificate request backoff durations
+# certificateRequestMinimumBackoffDuration: 1h
+# certificateRequestMaximumBackoffDuration: 32h
config: {}
# Setting Nameservers for DNS01 Self Check.
@@ -580,6 +593,13 @@
# - master
affinity: {}
+# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+#
+# For example:
+# runtimeClassName: gvisor
+# +docs:property
+runtimeClassName: ""
+
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
#
# For example:
@@ -651,14 +671,6 @@
# different ServiceMonitors.
prometheusInstance: default
- # The target port to set on the ServiceMonitor. This must match the port that the
- # cert-manager controller is listening on for metrics.
- # +docs:type=string,integer
- targetPort: http-metrics
-
- # The path to scrape for metrics.
- path: /metrics
-
# The interval to scrape metrics.
interval: 60s
@@ -703,9 +715,6 @@
# different PodMonitors.
prometheusInstance: default
- # The path to scrape for metrics.
- path: /metrics
-
# The interval to scrape metrics.
interval: 60s
@@ -974,6 +983,13 @@
# - master
affinity: {}
+ # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+ #
+ # For example:
+ # runtimeClassName: gvisor
+ # +docs:property
+ runtimeClassName: ""
+
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
#
# For example:
@@ -1359,6 +1375,13 @@
# - master
affinity: {}
+ # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+ #
+ # For example:
+ # runtimeClassName: gvisor
+ # +docs:property
+ runtimeClassName: ""
+
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
#
# For example:
@@ -1492,6 +1515,13 @@
# Kubernetes imagePullPolicy on Deployment.
pullPolicy: IfNotPresent
+ # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+ #
+ # For example:
+ # runtimeClassName: gvisor
+ # +docs:property
+ runtimeClassName: ""
+
# +docs:section=Startup API Check
# This startupapicheck is a Helm post-install hook that waits for the webhook
# endpoints to become available.
@@ -1529,6 +1559,17 @@
# Job backoffLimit
backoffLimit: 4
+ # Limits the lifetime of a Job that has finished execution (either Complete
+ # or Failed). If this field is set, once the Job finishes, it will be
+ # automatically cleaned up after ttlSecondsAfterFinished seconds. This is
+ # disabled by default (field is not set) to preserve backward compatibility
+ # and avoid issues with GitOps tools (e.g. Argo CD) that may attempt to
+ # reconcile or recreate Jobs after they are automatically deleted.
+ # For more information, see [Automatic Cleanup for Finished Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/).
+ # +docs:property
+ # +docs:type=integer
+ # ttlSecondsAfterFinished:
+
# Optional additional annotations to add to the startupapicheck Job.
# +docs:property
jobAnnotations:
@@ -1557,7 +1598,7 @@
# value: 'some value'
extraEnv: []
- # Resources to provide to the cert-manager controller pod.
+ # Resources to provide to the cert-manager startupapicheck pod.
#
# For example:
# requests:
@@ -1591,6 +1632,13 @@
# - master
affinity: {}
+ # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+ #
+ # For example:
+ # runtimeClassName: gvisor
+ # +docs:property
+ runtimeClassName: ""
+
# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
#
# For example: