| {{- if or .Values.crds.enabled .Values.installCRDs }} |
| apiVersion: apiextensions.k8s.io/v1 |
| kind: CustomResourceDefinition |
| metadata: |
| name: "certificates.cert-manager.io" |
| {{- if .Values.crds.keep }} |
| annotations: |
| helm.sh/resource-policy: keep |
| {{- end }} |
| labels: |
| {{- include "cert-manager.crd-labels" . | nindent 4 }} |
| spec: |
| group: cert-manager.io |
| names: |
| categories: |
| - cert-manager |
| kind: Certificate |
| listKind: CertificateList |
| plural: certificates |
| shortNames: |
| - cert |
| - certs |
| singular: certificate |
| scope: Namespaced |
| versions: |
| - additionalPrinterColumns: |
| - jsonPath: .status.conditions[?(@.type == "Ready")].status |
| name: Ready |
| type: string |
| - jsonPath: .spec.secretName |
| name: Secret |
| type: string |
| - jsonPath: .spec.issuerRef.name |
| name: Issuer |
| priority: 1 |
| type: string |
| - jsonPath: .status.conditions[?(@.type == "Ready")].message |
| name: Status |
| priority: 1 |
| type: string |
| - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. |
| jsonPath: .metadata.creationTimestamp |
| name: Age |
| type: date |
| name: v1 |
| schema: |
| openAPIV3Schema: |
| description: |- |
| A Certificate resource should be created to ensure an up to date and signed |
| X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. |
| |
| The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). |
| properties: |
| apiVersion: |
| description: |- |
| APIVersion defines the versioned schema of this representation of an object. |
| Servers should convert recognized schemas to the latest internal value, and |
| may reject unrecognized values. |
| More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| type: string |
| kind: |
| description: |- |
| Kind is a string value representing the REST resource this object represents. |
| Servers may infer this from the endpoint the client submits requests to. |
| Cannot be updated. |
| In CamelCase. |
| More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| type: string |
| metadata: |
| type: object |
| spec: |
| description: |- |
| Specification of the desired state of the Certificate resource. |
| https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| properties: |
| additionalOutputFormats: |
| description: |- |
| Defines extra output formats of the private key and signed certificate chain |
| to be written to this Certificate's target Secret. |
| items: |
| description: |- |
| CertificateAdditionalOutputFormat defines an additional output format of a |
| Certificate resource. These contain supplementary data formats of the signed |
| certificate chain and paired private key. |
| properties: |
| type: |
| description: |- |
| Type is the name of the format type that should be written to the |
| Certificate's target Secret. |
| enum: |
| - DER |
| - CombinedPEM |
| type: string |
| required: |
| - type |
| type: object |
| type: array |
| x-kubernetes-list-type: atomic |
| commonName: |
| description: |- |
| Requested common name X509 certificate subject attribute. |
| More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 |
| NOTE: TLS clients will ignore this value when any subject alternative name is |
| set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). |
| |
| Should have a length of 64 characters or fewer to avoid generating invalid CSRs. |
| Cannot be set if the `literalSubject` field is set. |
| type: string |
| dnsNames: |
| description: Requested DNS subject alternative names. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| duration: |
| description: |- |
| Requested 'duration' (i.e. lifetime) of the Certificate. Note that the |
| issuer may choose to ignore the requested duration, just like any other |
| requested attribute. |
| |
| If unset, this defaults to 90 days. |
| Minimum accepted duration is 1 hour. |
| Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. |
| type: string |
| emailAddresses: |
| description: Requested email subject alternative names. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| encodeUsagesInRequest: |
| description: |- |
| Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. |
| |
| This option defaults to true, and should only be disabled if the target |
| issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. |
| type: boolean |
| ipAddresses: |
| description: Requested IP address subject alternative names. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| isCA: |
| description: |- |
| Requested basic constraints isCA value. |
| The isCA value is used to set the `isCA` field on the created CertificateRequest |
| resources. Note that the issuer may choose to ignore the requested isCA value, just |
| like any other requested attribute. |
| |
| If true, this will automatically add the `cert sign` usage to the list |
| of requested `usages`. |
| type: boolean |
| issuerRef: |
| description: |- |
| Reference to the issuer responsible for issuing the certificate. |
| If the issuer is namespace-scoped, it must be in the same namespace |
| as the Certificate. If the issuer is cluster-scoped, it can be used |
| from any namespace. |
| |
| The `name` field of the reference must always be specified. |
| properties: |
| group: |
| description: |- |
| Group of the issuer being referred to. |
| Defaults to 'cert-manager.io'. |
| type: string |
| kind: |
| description: |- |
| Kind of the issuer being referred to. |
| Defaults to 'Issuer'. |
| type: string |
| name: |
| description: Name of the issuer being referred to. |
| type: string |
| required: |
| - name |
| type: object |
| keystores: |
| description: Additional keystore output formats to be stored in the Certificate's Secret. |
| properties: |
| jks: |
| description: |- |
| JKS configures options for storing a JKS keystore in the |
| `spec.secretName` Secret resource. |
| properties: |
| alias: |
| description: |- |
| Alias specifies the alias of the key in the keystore, required by the JKS format. |
| If not provided, the default alias `certificate` will be used. |
| type: string |
| create: |
| description: |- |
| Create enables JKS keystore creation for the Certificate. |
| If true, a file named `keystore.jks` will be created in the target |
| Secret resource, encrypted using the password stored in |
| `passwordSecretRef` or `password`. |
| The keystore file will be updated immediately. |
| If the issuer provided a CA certificate, a file named `truststore.jks` |
| will also be created in the target Secret resource, encrypted using the |
| password stored in `passwordSecretRef` |
| containing the issuing Certificate Authority |
| type: boolean |
| password: |
| description: |- |
| Password provides a literal password used to encrypt the JKS keystore. |
| Mutually exclusive with passwordSecretRef. |
| One of password or passwordSecretRef must provide a password with a non-zero length. |
| type: string |
| passwordSecretRef: |
| description: |- |
| PasswordSecretRef is a reference to a non-empty key in a Secret resource |
| containing the password used to encrypt the JKS keystore. |
| Mutually exclusive with password. |
| One of password or passwordSecretRef must provide a password with a non-zero length. |
| properties: |
| key: |
| description: |- |
| The key of the entry in the Secret resource's `data` field to be used. |
| Some instances of this field may be defaulted, in others it may be |
| required. |
| type: string |
| name: |
| description: |- |
| Name of the resource being referred to. |
| More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
| type: string |
| required: |
| - name |
| type: object |
| required: |
| - create |
| type: object |
| pkcs12: |
| description: |- |
| PKCS12 configures options for storing a PKCS12 keystore in the |
| `spec.secretName` Secret resource. |
| properties: |
| create: |
| description: |- |
| Create enables PKCS12 keystore creation for the Certificate. |
| If true, a file named `keystore.p12` will be created in the target |
| Secret resource, encrypted using the password stored in |
| `passwordSecretRef` or in `password`. |
| The keystore file will be updated immediately. |
| If the issuer provided a CA certificate, a file named `truststore.p12` will |
| also be created in the target Secret resource, encrypted using the |
| password stored in `passwordSecretRef` containing the issuing Certificate |
| Authority |
| type: boolean |
| password: |
| description: |- |
| Password provides a literal password used to encrypt the PKCS#12 keystore. |
| Mutually exclusive with passwordSecretRef. |
| One of password or passwordSecretRef must provide a password with a non-zero length. |
| type: string |
| passwordSecretRef: |
| description: |- |
| PasswordSecretRef is a reference to a non-empty key in a Secret resource |
| containing the password used to encrypt the PKCS#12 keystore. |
| Mutually exclusive with password. |
| One of password or passwordSecretRef must provide a password with a non-zero length. |
| properties: |
| key: |
| description: |- |
| The key of the entry in the Secret resource's `data` field to be used. |
| Some instances of this field may be defaulted, in others it may be |
| required. |
| type: string |
| name: |
| description: |- |
| Name of the resource being referred to. |
| More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
| type: string |
| required: |
| - name |
| type: object |
| profile: |
| description: |- |
| Profile specifies the key and certificate encryption algorithms and the HMAC algorithm |
| used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. |
| |
| If provided, allowed values are: |
| `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. |
| `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. |
| `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms |
| (e.g., because of company policy). Please note that the security of the algorithm is not that important |
| in reality, because the unencrypted certificate and private key are also stored in the Secret. |
| `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. |
| Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. |
| The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. |
| Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, |
| or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements. |
| enum: |
| - LegacyRC2 |
| - LegacyDES |
| - Modern2023 |
| - Modern2026 |
| type: string |
| required: |
| - create |
| type: object |
| type: object |
| literalSubject: |
| description: |- |
| Requested X.509 certificate subject, represented using the LDAP "String |
| Representation of a Distinguished Name" [1]. |
| Important: the LDAP string format also specifies the order of the attributes |
| in the subject, this is important when issuing certs for LDAP authentication. |
| Example: `CN=foo,DC=corp,DC=example,DC=com` |
| More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 |
| More info: https://github.com/cert-manager/cert-manager/issues/3203 |
| More info: https://github.com/cert-manager/cert-manager/issues/4424 |
| |
| Cannot be set if the `subject` or `commonName` field is set. |
| type: string |
| nameConstraints: |
| description: |- |
| x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. |
| More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 |
| |
| This is an Alpha Feature and is only enabled with the |
| `--feature-gates=NameConstraints=true` option set on both |
| the controller and webhook components. |
| properties: |
| critical: |
| description: if true then the name constraints are marked critical. |
| type: boolean |
| excluded: |
| description: |- |
| Excluded contains the constraints which must be disallowed. Any name matching a |
| restriction in the excluded field is invalid regardless |
| of information appearing in the permitted |
| properties: |
| dnsDomains: |
| description: DNSDomains is a list of DNS domains that are permitted or excluded. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| emailAddresses: |
| description: EmailAddresses is a list of Email Addresses that are permitted or excluded. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| ipRanges: |
| description: |- |
| IPRanges is a list of IP Ranges that are permitted or excluded. |
| This should be a valid CIDR notation. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| uriDomains: |
| description: URIDomains is a list of URI domains that are permitted or excluded. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| type: object |
| permitted: |
| description: Permitted contains the constraints in which the names must be located. |
| properties: |
| dnsDomains: |
| description: DNSDomains is a list of DNS domains that are permitted or excluded. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| emailAddresses: |
| description: EmailAddresses is a list of Email Addresses that are permitted or excluded. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| ipRanges: |
| description: |- |
| IPRanges is a list of IP Ranges that are permitted or excluded. |
| This should be a valid CIDR notation. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| uriDomains: |
| description: URIDomains is a list of URI domains that are permitted or excluded. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| type: object |
| type: object |
| otherNames: |
| description: |- |
| `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 |
| Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. |
| Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 |
| You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. |
| items: |
| properties: |
| oid: |
| description: |- |
| OID is the object identifier for the otherName SAN. |
| The object identifier must be expressed as a dotted string, for |
| example, "1.2.840.113556.1.4.221". |
| type: string |
| utf8Value: |
| description: |- |
| utf8Value is the string value of the otherName SAN. |
| The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. |
| type: string |
| type: object |
| type: array |
| x-kubernetes-list-type: atomic |
| privateKey: |
| description: |- |
| Private key options. These include the key algorithm and size, the used |
| encoding and the rotation policy. |
| properties: |
| algorithm: |
| description: |- |
| Algorithm is the private key algorithm of the corresponding private key |
| for this certificate. |
| |
| If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. |
| If `algorithm` is specified and `size` is not provided, |
| key size of 2048 will be used for `RSA` key algorithm and |
| key size of 256 will be used for `ECDSA` key algorithm. |
| key size is ignored when using the `Ed25519` key algorithm. |
| enum: |
| - RSA |
| - ECDSA |
| - Ed25519 |
| type: string |
| encoding: |
| description: |- |
| The private key cryptography standards (PKCS) encoding for this |
| certificate's private key to be encoded in. |
| |
| If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 |
| and PKCS#8, respectively. |
| Defaults to `PKCS1` if not specified. |
| enum: |
| - PKCS1 |
| - PKCS8 |
| type: string |
| rotationPolicy: |
| description: |- |
| RotationPolicy controls how private keys should be regenerated when a |
| re-issuance is being processed. |
| |
| If set to `Never`, a private key will only be generated if one does not |
| already exist in the target `spec.secretName`. If one does exist but it |
| does not have the correct algorithm or size, a warning will be raised |
| to await user intervention. |
| If set to `Always`, a private key matching the specified requirements |
| will be generated whenever a re-issuance occurs. |
| Default is `Always`. |
| The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. |
| enum: |
| - Never |
| - Always |
| type: string |
| size: |
| description: |- |
| Size is the key bit size of the corresponding private key for this certificate. |
| |
| If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, |
| and will default to `2048` if not specified. |
| If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, |
| and will default to `256` if not specified. |
| If `algorithm` is set to `Ed25519`, Size is ignored. |
| No other values are allowed. |
| type: integer |
| type: object |
| renewBefore: |
| description: |- |
| How long before the currently issued certificate's expiry cert-manager should |
| renew the certificate. For example, if a certificate is valid for 60 minutes, |
| and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate |
| 50 minutes after it was issued (i.e. when there are 10 minutes remaining until |
| the certificate is no longer valid). |
| |
| NOTE: The actual lifetime of the issued certificate is used to determine the |
| renewal time. If an issuer returns a certificate with a different lifetime than |
| the one requested, cert-manager will use the lifetime of the issued certificate. |
| |
| If unset, this defaults to 1/3 of the issued certificate's lifetime. |
| Minimum accepted value is 5 minutes. |
| Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. |
| Cannot be set if the `renewBeforePercentage` field is set. |
| type: string |
| renewBeforePercentage: |
| description: |- |
| `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage |
| rather than an absolute duration. For example, if a certificate is valid for 60 |
| minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to |
| renew the certificate 45 minutes after it was issued (i.e. when there are 15 |
| minutes (25%) remaining until the certificate is no longer valid). |
| |
| NOTE: The actual lifetime of the issued certificate is used to determine the |
| renewal time. If an issuer returns a certificate with a different lifetime than |
| the one requested, cert-manager will use the lifetime of the issued certificate. |
| |
| Value must be an integer in the range (0,100). The minimum effective |
| `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 |
| minutes. |
| Cannot be set if the `renewBefore` field is set. |
| format: int32 |
| type: integer |
| renewal: |
| description: |- |
| `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is |
| `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`. |
| properties: |
| policy: |
| description: '`policy` must be one of `Disabled`, `RenewBefore`.' |
| enum: |
| - RenewBefore |
| - Disabled |
| type: string |
| windows: |
| description: '`windows` mentions the behavior of when the renewal must happen.' |
| items: |
| description: CertificateRenewalWindows is the definition for renewal windows |
| properties: |
| cron: |
| description: |- |
| `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below: |
| * * * * * |
| | | | | | |
| | | | | day of the week (0–6) (Sunday to Saturday; |
| | | | month (1–12) 7 is also Sunday on some systems) |
| | | day of the month (1–31) |
| | hour (0–23) |
| minute (0–59) |
| minLength: 1 |
| type: string |
| timezone: |
| description: |- |
| `timezone` is IANA compliant timezone. For example America/Denver. |
| If this field is not set, timezone is treated as UTC. |
| minLength: 1 |
| type: string |
| windowDuration: |
| description: |- |
| `windowDuration` is how long the cron definition is active for. |
| Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. |
| pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$ |
| type: string |
| required: |
| - cron |
| - windowDuration |
| type: object |
| type: array |
| x-kubernetes-list-type: atomic |
| type: object |
| revisionHistoryLimit: |
| description: |- |
| The maximum number of CertificateRequest revisions that are maintained in |
| the Certificate's history. Each revision represents a single `CertificateRequest` |
| created by this Certificate, either when it was created, renewed, or Spec |
| was changed. Revisions will be removed by oldest first if the number of |
| revisions exceeds this number. |
| |
| If set, revisionHistoryLimit must be a value of `1` or greater. |
| Default value is `1`. |
| format: int32 |
| type: integer |
| secretName: |
| description: |- |
| Name of the Secret resource that will be automatically created and |
| managed by this Certificate resource. It will be populated with a |
| private key and certificate, signed by the denoted issuer. The Secret |
| resource lives in the same namespace as the Certificate resource. |
| type: string |
| secretTemplate: |
| description: |- |
| Defines annotations and labels to be copied to the Certificate's Secret. |
| Labels and annotations on the Secret will be changed as they appear on the |
| SecretTemplate when added or removed. SecretTemplate annotations are added |
| in conjunction with, and cannot overwrite, the base set of annotations |
| cert-manager sets on the Certificate's Secret. |
| properties: |
| annotations: |
| additionalProperties: |
| type: string |
| description: Annotations is a key value map to be copied to the target Kubernetes Secret. |
| type: object |
| labels: |
| additionalProperties: |
| type: string |
| description: Labels is a key value map to be copied to the target Kubernetes Secret. |
| type: object |
| type: object |
| signatureAlgorithm: |
| description: |- |
| Signature algorithm to use. |
| Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA. |
| Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512. |
| Allowed values for Ed25519 keys: PureEd25519. |
| enum: |
| - SHA256WithRSA |
| - SHA384WithRSA |
| - SHA512WithRSA |
| - ECDSAWithSHA256 |
| - ECDSAWithSHA384 |
| - ECDSAWithSHA512 |
| - PureEd25519 |
| type: string |
| subject: |
| description: |- |
| Requested set of X509 certificate subject attributes. |
| More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 |
| |
| The common name attribute is specified separately in the `commonName` field. |
| Cannot be set if the `literalSubject` field is set. |
| properties: |
| countries: |
| description: Countries to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| localities: |
| description: Cities to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| organizationalUnits: |
| description: Organizational Units to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| organizations: |
| description: Organizations to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| postalCodes: |
| description: Postal codes to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| provinces: |
| description: State/Provinces to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| serialNumber: |
| description: Serial number to be used on the Certificate. |
| type: string |
| streetAddresses: |
| description: Street addresses to be used on the Certificate. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| type: object |
| uris: |
| description: Requested URI subject alternative names. |
| items: |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| usages: |
| description: |- |
| Requested key usages and extended key usages. |
| These usages are used to set the `usages` field on the created CertificateRequest |
| resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages |
| will additionally be encoded in the `request` field which contains the CSR blob. |
| |
| If unset, defaults to `digital signature` and `key encipherment`. |
| items: |
| description: |- |
| KeyUsage specifies valid usage contexts for keys. |
| See: |
| https://tools.ietf.org/html/rfc5280#section-4.2.1.3 |
| https://tools.ietf.org/html/rfc5280#section-4.2.1.12 |
| |
| Valid KeyUsage values are as follows: |
| "signing", |
| "digital signature", |
| "content commitment", |
| "key encipherment", |
| "key agreement", |
| "data encipherment", |
| "cert sign", |
| "crl sign", |
| "encipher only", |
| "decipher only", |
| "any", |
| "server auth", |
| "client auth", |
| "code signing", |
| "email protection", |
| "s/mime", |
| "ipsec end system", |
| "ipsec tunnel", |
| "ipsec user", |
| "timestamping", |
| "ocsp signing", |
| "microsoft sgc", |
| "netscape sgc" |
| enum: |
| - signing |
| - digital signature |
| - content commitment |
| - key encipherment |
| - key agreement |
| - data encipherment |
| - cert sign |
| - crl sign |
| - encipher only |
| - decipher only |
| - any |
| - server auth |
| - client auth |
| - code signing |
| - email protection |
| - s/mime |
| - ipsec end system |
| - ipsec tunnel |
| - ipsec user |
| - timestamping |
| - ocsp signing |
| - microsoft sgc |
| - netscape sgc |
| type: string |
| type: array |
| x-kubernetes-list-type: atomic |
| required: |
| - issuerRef |
| - secretName |
| type: object |
| status: |
| description: |- |
| Status of the Certificate. |
| This is set and managed automatically. |
| Read-only. |
| More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| properties: |
| acme: |
| description: ACME stores information that is fetched from the ACME CA server. |
| properties: |
| ari: |
| description: |- |
| ARI stores the ACME Renewal Information that is fetched from the ACME server |
| in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled. |
| properties: |
| explanationURL: |
| description: |- |
| ExplanationURL is a human-readable URL that may explain why the suggested window |
| has its current value. |
| type: string |
| lastChecked: |
| description: LastChecked is the time at which the ACME server was last checked for renewal information. |
| format: date-time |
| type: string |
| lastError: |
| description: LastError is the last error encountered when checking the ACME server for renewal information, if any. |
| type: string |
| nextCheck: |
| description: NextCheck is the time at which the ACME server will next be checked for renewal information. |
| format: date-time |
| type: string |
| suggestedWindow: |
| description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773. |
| properties: |
| end: |
| description: End is the end of the suggested renewal window. |
| format: date-time |
| type: string |
| start: |
| description: Start is the start of the suggested renewal window. |
| format: date-time |
| type: string |
| required: |
| - end |
| - start |
| type: object |
| type: object |
| type: object |
| conditions: |
| description: |- |
| List of status conditions to indicate the status of certificates. |
| Known condition types are `Ready` and `Issuing`. |
| items: |
| description: CertificateCondition contains condition information for a Certificate. |
| properties: |
| lastTransitionTime: |
| description: |- |
| LastTransitionTime is the timestamp corresponding to the last status |
| change of this condition. |
| format: date-time |
| type: string |
| message: |
| description: |- |
| Message is a human readable description of the details of the last |
| transition, complementing reason. |
| type: string |
| observedGeneration: |
| description: |- |
| If set, this represents the .metadata.generation that the condition was |
| set based upon. |
| For instance, if .metadata.generation is currently 12, but the |
| .status.condition[x].observedGeneration is 9, the condition is out of date |
| with respect to the current state of the Certificate. |
| format: int64 |
| type: integer |
| reason: |
| description: |- |
| Reason is a brief machine readable explanation for the condition's last |
| transition. |
| type: string |
| status: |
| description: Status of the condition, one of (`True`, `False`, `Unknown`). |
| enum: |
| - "True" |
| - "False" |
| - Unknown |
| type: string |
| type: |
| description: Type of the condition, known values are (`Ready`, `Issuing`). |
| type: string |
| required: |
| - status |
| - type |
| type: object |
| type: array |
| x-kubernetes-list-map-keys: |
| - type |
| x-kubernetes-list-type: map |
| failedIssuanceAttempts: |
| description: |- |
| The number of continuous failed issuance attempts up till now. This |
| field gets removed (if set) on a successful issuance and gets set to |
| 1 if unset and an issuance has failed. If an issuance has failed, the |
| delay till the next issuance will be calculated using formula |
| time.Hour * 2 ^ (failedIssuanceAttempts - 1). |
| type: integer |
| lastFailureTime: |
| description: |- |
| LastFailureTime is set only if the latest issuance for this |
| Certificate failed and contains the time of the failure. If an |
| issuance has failed, the delay till the next issuance will be |
| calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - |
| 1). If the latest issuance has succeeded this field will be unset. |
| format: date-time |
| type: string |
| nextPrivateKeySecretName: |
| description: |- |
| The name of the Secret resource containing the private key to be used |
| for the next certificate iteration. |
| The keymanager controller will automatically set this field if the |
| `Issuing` condition is set to `True`. |
| It will automatically unset this field when the Issuing condition is |
| not set or False. |
| type: string |
| notAfter: |
| description: |- |
| The expiration time of the certificate stored in the secret named |
| by this resource in `spec.secretName`. |
| format: date-time |
| type: string |
| notBefore: |
| description: |- |
| The time after which the certificate stored in the secret named |
| by this resource in `spec.secretName` is valid. |
| format: date-time |
| type: string |
| renewalTime: |
| description: |- |
| RenewalTime is the time at which the certificate will be next |
| renewed. |
| If not set, no upcoming renewal is scheduled. |
| format: date-time |
| type: string |
| revision: |
| description: |- |
| The current 'revision' of the certificate as issued. |
| |
| When a CertificateRequest resource is created, it will have the |
| `cert-manager.io/certificate-revision` set to one greater than the |
| current value of this field. |
| |
| Upon issuance, this field will be set to the value of the annotation |
| on the CertificateRequest resource used to issue the certificate. |
| |
| Persisting the value on the CertificateRequest resource allows the |
| certificates controller to know whether a request is part of an old |
| issuance or if it is part of the ongoing revision's issuance by |
| checking if the revision value in the annotation is greater than this |
| field. |
| type: integer |
| type: object |
| type: object |
| selectableFields: |
| - jsonPath: .spec.issuerRef.group |
| - jsonPath: .spec.issuerRef.kind |
| - jsonPath: .spec.issuerRef.name |
| served: true |
| storage: true |
| subresources: |
| status: {} |
| {{- end }} |