Gitiles
Code Review Sign In
code.v1.dodo.cloud / pcloud / 0144c13f81906eeda7290404472ae242766f3c54 / . / charts / cert-manager / templates / crd-cert-manager.io_certificates.yaml
blob: c77f7da2775fde036148276064dc01dd7126d9f3 [file] [log] [blame]
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "certificates.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 kind: Certificate
18 listKind: CertificateList
19 plural: certificates
20 shortNames:
21 - cert
22 - certs
23 singular: certificate
24 scope: Namespaced
25 versions:
26 - additionalPrinterColumns:
27 - jsonPath: .status.conditions[?(@.type == "Ready")].status
28 name: Ready
29 type: string
30 - jsonPath: .spec.secretName
31 name: Secret
32 type: string
33 - jsonPath: .spec.issuerRef.name
34 name: Issuer
35 priority: 1
36 type: string
37 - jsonPath: .status.conditions[?(@.type == "Ready")].message
38 name: Status
39 priority: 1
40 type: string
41 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
42 jsonPath: .metadata.creationTimestamp
43 name: Age
44 type: date
45 name: v1
46 schema:
47 openAPIV3Schema:
48 description: |-
49 A Certificate resource should be created to ensure an up to date and signed
50 X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
51
52 The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
53 properties:
54 apiVersion:
55 description: |-
56 APIVersion defines the versioned schema of this representation of an object.
57 Servers should convert recognized schemas to the latest internal value, and
58 may reject unrecognized values.
59 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
60 type: string
61 kind:
62 description: |-
63 Kind is a string value representing the REST resource this object represents.
64 Servers may infer this from the endpoint the client submits requests to.
65 Cannot be updated.
66 In CamelCase.
67 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
68 type: string
69 metadata:
70 type: object
71 spec:
72 description: |-
73 Specification of the desired state of the Certificate resource.
74 https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
75 properties:
76 additionalOutputFormats:
77 description: |-
78 Defines extra output formats of the private key and signed certificate chain
79 to be written to this Certificate's target Secret.
80 items:
81 description: |-
82 CertificateAdditionalOutputFormat defines an additional output format of a
83 Certificate resource. These contain supplementary data formats of the signed
84 certificate chain and paired private key.
85 properties:
86 type:
87 description: |-
88 Type is the name of the format type that should be written to the
89 Certificate's target Secret.
90 enum:
91 - DER
92 - CombinedPEM
93 type: string
94 required:
95 - type
96 type: object
97 type: array
98 x-kubernetes-list-type: atomic
99 commonName:
100 description: |-
101 Requested common name X509 certificate subject attribute.
102 More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
103 NOTE: TLS clients will ignore this value when any subject alternative name is
104 set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
105
106 Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
107 Cannot be set if the `literalSubject` field is set.
108 type: string
109 dnsNames:
110 description: Requested DNS subject alternative names.
111 items:
112 type: string
113 type: array
114 x-kubernetes-list-type: atomic
115 duration:
116 description: |-
117 Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
118 issuer may choose to ignore the requested duration, just like any other
119 requested attribute.
120
121 If unset, this defaults to 90 days.
122 Minimum accepted duration is 1 hour.
123 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
124 type: string
125 emailAddresses:
126 description: Requested email subject alternative names.
127 items:
128 type: string
129 type: array
130 x-kubernetes-list-type: atomic
131 encodeUsagesInRequest:
132 description: |-
133 Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
134
135 This option defaults to true, and should only be disabled if the target
136 issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
137 type: boolean
138 ipAddresses:
139 description: Requested IP address subject alternative names.
140 items:
141 type: string
142 type: array
143 x-kubernetes-list-type: atomic
144 isCA:
145 description: |-
146 Requested basic constraints isCA value.
147 The isCA value is used to set the `isCA` field on the created CertificateRequest
148 resources. Note that the issuer may choose to ignore the requested isCA value, just
149 like any other requested attribute.
150
151 If true, this will automatically add the `cert sign` usage to the list
152 of requested `usages`.
153 type: boolean
154 issuerRef:
155 description: |-
156 Reference to the issuer responsible for issuing the certificate.
157 If the issuer is namespace-scoped, it must be in the same namespace
158 as the Certificate. If the issuer is cluster-scoped, it can be used
159 from any namespace.
160
161 The `name` field of the reference must always be specified.
162 properties:
163 group:
164 description: |-
165 Group of the issuer being referred to.
166 Defaults to 'cert-manager.io'.
167 type: string
168 kind:
169 description: |-
170 Kind of the issuer being referred to.
171 Defaults to 'Issuer'.
172 type: string
173 name:
174 description: Name of the issuer being referred to.
175 type: string
176 required:
177 - name
178 type: object
179 keystores:
180 description: Additional keystore output formats to be stored in the Certificate's Secret.
181 properties:
182 jks:
183 description: |-
184 JKS configures options for storing a JKS keystore in the
185 `spec.secretName` Secret resource.
186 properties:
187 alias:
188 description: |-
189 Alias specifies the alias of the key in the keystore, required by the JKS format.
190 If not provided, the default alias `certificate` will be used.
191 type: string
192 create:
193 description: |-
194 Create enables JKS keystore creation for the Certificate.
195 If true, a file named `keystore.jks` will be created in the target
196 Secret resource, encrypted using the password stored in
197 `passwordSecretRef` or `password`.
198 The keystore file will be updated immediately.
199 If the issuer provided a CA certificate, a file named `truststore.jks`
200 will also be created in the target Secret resource, encrypted using the
201 password stored in `passwordSecretRef`
202 containing the issuing Certificate Authority
203 type: boolean
204 password:
205 description: |-
206 Password provides a literal password used to encrypt the JKS keystore.
207 Mutually exclusive with passwordSecretRef.
208 One of password or passwordSecretRef must provide a password with a non-zero length.
209 type: string
210 passwordSecretRef:
211 description: |-
212 PasswordSecretRef is a reference to a non-empty key in a Secret resource
213 containing the password used to encrypt the JKS keystore.
214 Mutually exclusive with password.
215 One of password or passwordSecretRef must provide a password with a non-zero length.
216 properties:
217 key:
218 description: |-
219 The key of the entry in the Secret resource's `data` field to be used.
220 Some instances of this field may be defaulted, in others it may be
221 required.
222 type: string
223 name:
224 description: |-
225 Name of the resource being referred to.
226 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
227 type: string
228 required:
229 - name
230 type: object
231 required:
232 - create
233 type: object
234 pkcs12:
235 description: |-
236 PKCS12 configures options for storing a PKCS12 keystore in the
237 `spec.secretName` Secret resource.
238 properties:
239 create:
240 description: |-
241 Create enables PKCS12 keystore creation for the Certificate.
242 If true, a file named `keystore.p12` will be created in the target
243 Secret resource, encrypted using the password stored in
244 `passwordSecretRef` or in `password`.
245 The keystore file will be updated immediately.
246 If the issuer provided a CA certificate, a file named `truststore.p12` will
247 also be created in the target Secret resource, encrypted using the
248 password stored in `passwordSecretRef` containing the issuing Certificate
249 Authority
250 type: boolean
251 password:
252 description: |-
253 Password provides a literal password used to encrypt the PKCS#12 keystore.
254 Mutually exclusive with passwordSecretRef.
255 One of password or passwordSecretRef must provide a password with a non-zero length.
256 type: string
257 passwordSecretRef:
258 description: |-
259 PasswordSecretRef is a reference to a non-empty key in a Secret resource
260 containing the password used to encrypt the PKCS#12 keystore.
261 Mutually exclusive with password.
262 One of password or passwordSecretRef must provide a password with a non-zero length.
263 properties:
264 key:
265 description: |-
266 The key of the entry in the Secret resource's `data` field to be used.
267 Some instances of this field may be defaulted, in others it may be
268 required.
269 type: string
270 name:
271 description: |-
272 Name of the resource being referred to.
273 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
274 type: string
275 required:
276 - name
277 type: object
278 profile:
279 description: |-
280 Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
281 used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
282
283 If provided, allowed values are:
284 `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
285 `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
286 `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
287 (e.g., because of company policy). Please note that the security of the algorithm is not that important
288 in reality, because the unencrypted certificate and private key are also stored in the Secret.
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame]289 `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.
290 Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.
291 The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.
292 Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,
293 or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]294 enum:
295 - LegacyRC2
296 - LegacyDES
297 - Modern2023
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame]298 - Modern2026
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]299 type: string
300 required:
301 - create
302 type: object
303 type: object
304 literalSubject:
305 description: |-
306 Requested X.509 certificate subject, represented using the LDAP "String
307 Representation of a Distinguished Name" [1].
308 Important: the LDAP string format also specifies the order of the attributes
309 in the subject, this is important when issuing certs for LDAP authentication.
310 Example: `CN=foo,DC=corp,DC=example,DC=com`
311 More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
312 More info: https://github.com/cert-manager/cert-manager/issues/3203
313 More info: https://github.com/cert-manager/cert-manager/issues/4424
314
315 Cannot be set if the `subject` or `commonName` field is set.
316 type: string
317 nameConstraints:
318 description: |-
319 x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
320 More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
321
322 This is an Alpha Feature and is only enabled with the
323 `--feature-gates=NameConstraints=true` option set on both
324 the controller and webhook components.
325 properties:
326 critical:
327 description: if true then the name constraints are marked critical.
328 type: boolean
329 excluded:
330 description: |-
331 Excluded contains the constraints which must be disallowed. Any name matching a
332 restriction in the excluded field is invalid regardless
333 of information appearing in the permitted
334 properties:
335 dnsDomains:
336 description: DNSDomains is a list of DNS domains that are permitted or excluded.
337 items:
338 type: string
339 type: array
340 x-kubernetes-list-type: atomic
341 emailAddresses:
342 description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
343 items:
344 type: string
345 type: array
346 x-kubernetes-list-type: atomic
347 ipRanges:
348 description: |-
349 IPRanges is a list of IP Ranges that are permitted or excluded.
350 This should be a valid CIDR notation.
351 items:
352 type: string
353 type: array
354 x-kubernetes-list-type: atomic
355 uriDomains:
356 description: URIDomains is a list of URI domains that are permitted or excluded.
357 items:
358 type: string
359 type: array
360 x-kubernetes-list-type: atomic
361 type: object
362 permitted:
363 description: Permitted contains the constraints in which the names must be located.
364 properties:
365 dnsDomains:
366 description: DNSDomains is a list of DNS domains that are permitted or excluded.
367 items:
368 type: string
369 type: array
370 x-kubernetes-list-type: atomic
371 emailAddresses:
372 description: EmailAddresses is a list of Email Addresses that are permitted or excluded.
373 items:
374 type: string
375 type: array
376 x-kubernetes-list-type: atomic
377 ipRanges:
378 description: |-
379 IPRanges is a list of IP Ranges that are permitted or excluded.
380 This should be a valid CIDR notation.
381 items:
382 type: string
383 type: array
384 x-kubernetes-list-type: atomic
385 uriDomains:
386 description: URIDomains is a list of URI domains that are permitted or excluded.
387 items:
388 type: string
389 type: array
390 x-kubernetes-list-type: atomic
391 type: object
392 type: object
393 otherNames:
394 description: |-
395 `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
396 Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
397 Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
398 You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
399 items:
400 properties:
401 oid:
402 description: |-
403 OID is the object identifier for the otherName SAN.
404 The object identifier must be expressed as a dotted string, for
405 example, "1.2.840.113556.1.4.221".
406 type: string
407 utf8Value:
408 description: |-
409 utf8Value is the string value of the otherName SAN.
410 The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
411 type: string
412 type: object
413 type: array
414 x-kubernetes-list-type: atomic
415 privateKey:
416 description: |-
417 Private key options. These include the key algorithm and size, the used
418 encoding and the rotation policy.
419 properties:
420 algorithm:
421 description: |-
422 Algorithm is the private key algorithm of the corresponding private key
423 for this certificate.
424
425 If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
426 If `algorithm` is specified and `size` is not provided,
427 key size of 2048 will be used for `RSA` key algorithm and
428 key size of 256 will be used for `ECDSA` key algorithm.
429 key size is ignored when using the `Ed25519` key algorithm.
430 enum:
431 - RSA
432 - ECDSA
433 - Ed25519
434 type: string
435 encoding:
436 description: |-
437 The private key cryptography standards (PKCS) encoding for this
438 certificate's private key to be encoded in.
439
440 If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
441 and PKCS#8, respectively.
442 Defaults to `PKCS1` if not specified.
443 enum:
444 - PKCS1
445 - PKCS8
446 type: string
447 rotationPolicy:
448 description: |-
449 RotationPolicy controls how private keys should be regenerated when a
450 re-issuance is being processed.
451
452 If set to `Never`, a private key will only be generated if one does not
453 already exist in the target `spec.secretName`. If one does exist but it
454 does not have the correct algorithm or size, a warning will be raised
455 to await user intervention.
456 If set to `Always`, a private key matching the specified requirements
457 will be generated whenever a re-issuance occurs.
458 Default is `Always`.
459 The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]460 enum:
461 - Never
462 - Always
463 type: string
464 size:
465 description: |-
466 Size is the key bit size of the corresponding private key for this certificate.
467
468 If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
469 and will default to `2048` if not specified.
470 If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
471 and will default to `256` if not specified.
472 If `algorithm` is set to `Ed25519`, Size is ignored.
473 No other values are allowed.
474 type: integer
475 type: object
476 renewBefore:
477 description: |-
478 How long before the currently issued certificate's expiry cert-manager should
479 renew the certificate. For example, if a certificate is valid for 60 minutes,
480 and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
481 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
482 the certificate is no longer valid).
483
484 NOTE: The actual lifetime of the issued certificate is used to determine the
485 renewal time. If an issuer returns a certificate with a different lifetime than
486 the one requested, cert-manager will use the lifetime of the issued certificate.
487
488 If unset, this defaults to 1/3 of the issued certificate's lifetime.
489 Minimum accepted value is 5 minutes.
490 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
491 Cannot be set if the `renewBeforePercentage` field is set.
492 type: string
493 renewBeforePercentage:
494 description: |-
495 `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
496 rather than an absolute duration. For example, if a certificate is valid for 60
497 minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to
498 renew the certificate 45 minutes after it was issued (i.e. when there are 15
499 minutes (25%) remaining until the certificate is no longer valid).
500
501 NOTE: The actual lifetime of the issued certificate is used to determine the
502 renewal time. If an issuer returns a certificate with a different lifetime than
503 the one requested, cert-manager will use the lifetime of the issued certificate.
504
505 Value must be an integer in the range (0,100). The minimum effective
506 `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
507 minutes.
508 Cannot be set if the `renewBefore` field is set.
509 format: int32
510 type: integer
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame]511 renewal:
512 description: |-
513 `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is
514 `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.
515 properties:
516 policy:
517 description: '`policy` must be one of `Disabled`, `RenewBefore`.'
518 enum:
519 - RenewBefore
520 - Disabled
521 type: string
522 windows:
523 description: '`windows` mentions the behavior of when the renewal must happen.'
524 items:
525 description: CertificateRenewalWindows is the definition for renewal windows
526 properties:
527 cron:
528 description: |-
529 `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:
530 * * * * *
531 | | | | |
532 | | | | day of the week (0–6) (Sunday to Saturday;
533 | | | month (1–12) 7 is also Sunday on some systems)
534 | | day of the month (1–31)
535 | hour (0–23)
536 minute (0–59)
537 minLength: 1
538 type: string
539 timezone:
540 description: |-
541 `timezone` is IANA compliant timezone. For example America/Denver.
542 If this field is not set, timezone is treated as UTC.
543 minLength: 1
544 type: string
545 windowDuration:
546 description: |-
547 `windowDuration` is how long the cron definition is active for.
548 Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
549 pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$
550 type: string
551 required:
552 - cron
553 - windowDuration
554 type: object
555 type: array
556 x-kubernetes-list-type: atomic
557 type: object
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]558 revisionHistoryLimit:
559 description: |-
560 The maximum number of CertificateRequest revisions that are maintained in
561 the Certificate's history. Each revision represents a single `CertificateRequest`
562 created by this Certificate, either when it was created, renewed, or Spec
563 was changed. Revisions will be removed by oldest first if the number of
564 revisions exceeds this number.
565
566 If set, revisionHistoryLimit must be a value of `1` or greater.
567 Default value is `1`.
568 format: int32
569 type: integer
570 secretName:
571 description: |-
572 Name of the Secret resource that will be automatically created and
573 managed by this Certificate resource. It will be populated with a
574 private key and certificate, signed by the denoted issuer. The Secret
575 resource lives in the same namespace as the Certificate resource.
576 type: string
577 secretTemplate:
578 description: |-
579 Defines annotations and labels to be copied to the Certificate's Secret.
580 Labels and annotations on the Secret will be changed as they appear on the
581 SecretTemplate when added or removed. SecretTemplate annotations are added
582 in conjunction with, and cannot overwrite, the base set of annotations
583 cert-manager sets on the Certificate's Secret.
584 properties:
585 annotations:
586 additionalProperties:
587 type: string
588 description: Annotations is a key value map to be copied to the target Kubernetes Secret.
589 type: object
590 labels:
591 additionalProperties:
592 type: string
593 description: Labels is a key value map to be copied to the target Kubernetes Secret.
594 type: object
595 type: object
596 signatureAlgorithm:
597 description: |-
598 Signature algorithm to use.
599 Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
600 Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
601 Allowed values for Ed25519 keys: PureEd25519.
602 enum:
603 - SHA256WithRSA
604 - SHA384WithRSA
605 - SHA512WithRSA
606 - ECDSAWithSHA256
607 - ECDSAWithSHA384
608 - ECDSAWithSHA512
609 - PureEd25519
610 type: string
611 subject:
612 description: |-
613 Requested set of X509 certificate subject attributes.
614 More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
615
616 The common name attribute is specified separately in the `commonName` field.
617 Cannot be set if the `literalSubject` field is set.
618 properties:
619 countries:
620 description: Countries to be used on the Certificate.
621 items:
622 type: string
623 type: array
624 x-kubernetes-list-type: atomic
625 localities:
626 description: Cities to be used on the Certificate.
627 items:
628 type: string
629 type: array
630 x-kubernetes-list-type: atomic
631 organizationalUnits:
632 description: Organizational Units to be used on the Certificate.
633 items:
634 type: string
635 type: array
636 x-kubernetes-list-type: atomic
637 organizations:
638 description: Organizations to be used on the Certificate.
639 items:
640 type: string
641 type: array
642 x-kubernetes-list-type: atomic
643 postalCodes:
644 description: Postal codes to be used on the Certificate.
645 items:
646 type: string
647 type: array
648 x-kubernetes-list-type: atomic
649 provinces:
650 description: State/Provinces to be used on the Certificate.
651 items:
652 type: string
653 type: array
654 x-kubernetes-list-type: atomic
655 serialNumber:
656 description: Serial number to be used on the Certificate.
657 type: string
658 streetAddresses:
659 description: Street addresses to be used on the Certificate.
660 items:
661 type: string
662 type: array
663 x-kubernetes-list-type: atomic
664 type: object
665 uris:
666 description: Requested URI subject alternative names.
667 items:
668 type: string
669 type: array
670 x-kubernetes-list-type: atomic
671 usages:
672 description: |-
673 Requested key usages and extended key usages.
674 These usages are used to set the `usages` field on the created CertificateRequest
675 resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
676 will additionally be encoded in the `request` field which contains the CSR blob.
677
678 If unset, defaults to `digital signature` and `key encipherment`.
679 items:
680 description: |-
681 KeyUsage specifies valid usage contexts for keys.
682 See:
683 https://tools.ietf.org/html/rfc5280#section-4.2.1.3
684 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
685
686 Valid KeyUsage values are as follows:
687 "signing",
688 "digital signature",
689 "content commitment",
690 "key encipherment",
691 "key agreement",
692 "data encipherment",
693 "cert sign",
694 "crl sign",
695 "encipher only",
696 "decipher only",
697 "any",
698 "server auth",
699 "client auth",
700 "code signing",
701 "email protection",
702 "s/mime",
703 "ipsec end system",
704 "ipsec tunnel",
705 "ipsec user",
706 "timestamping",
707 "ocsp signing",
708 "microsoft sgc",
709 "netscape sgc"
710 enum:
711 - signing
712 - digital signature
713 - content commitment
714 - key encipherment
715 - key agreement
716 - data encipherment
717 - cert sign
718 - crl sign
719 - encipher only
720 - decipher only
721 - any
722 - server auth
723 - client auth
724 - code signing
725 - email protection
726 - s/mime
727 - ipsec end system
728 - ipsec tunnel
729 - ipsec user
730 - timestamping
731 - ocsp signing
732 - microsoft sgc
733 - netscape sgc
734 type: string
735 type: array
736 x-kubernetes-list-type: atomic
737 required:
738 - issuerRef
739 - secretName
740 type: object
741 status:
742 description: |-
743 Status of the Certificate.
744 This is set and managed automatically.
745 Read-only.
746 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
747 properties:
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame]748 acme:
749 description: ACME stores information that is fetched from the ACME CA server.
750 properties:
751 ari:
752 description: |-
753 ARI stores the ACME Renewal Information that is fetched from the ACME server
754 in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.
755 properties:
756 explanationURL:
757 description: |-
758 ExplanationURL is a human-readable URL that may explain why the suggested window
759 has its current value.
760 type: string
761 lastChecked:
762 description: LastChecked is the time at which the ACME server was last checked for renewal information.
763 format: date-time
764 type: string
765 lastError:
766 description: LastError is the last error encountered when checking the ACME server for renewal information, if any.
767 type: string
768 nextCheck:
769 description: NextCheck is the time at which the ACME server will next be checked for renewal information.
770 format: date-time
771 type: string
772 suggestedWindow:
773 description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.
774 properties:
775 end:
776 description: End is the end of the suggested renewal window.
777 format: date-time
778 type: string
779 start:
780 description: Start is the start of the suggested renewal window.
781 format: date-time
782 type: string
783 required:
784 - end
785 - start
786 type: object
787 type: object
788 type: object
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]789 conditions:
790 description: |-
791 List of status conditions to indicate the status of certificates.
792 Known condition types are `Ready` and `Issuing`.
793 items:
794 description: CertificateCondition contains condition information for a Certificate.
795 properties:
796 lastTransitionTime:
797 description: |-
798 LastTransitionTime is the timestamp corresponding to the last status
799 change of this condition.
800 format: date-time
801 type: string
802 message:
803 description: |-
804 Message is a human readable description of the details of the last
805 transition, complementing reason.
806 type: string
807 observedGeneration:
808 description: |-
809 If set, this represents the .metadata.generation that the condition was
810 set based upon.
811 For instance, if .metadata.generation is currently 12, but the
812 .status.condition[x].observedGeneration is 9, the condition is out of date
813 with respect to the current state of the Certificate.
814 format: int64
815 type: integer
816 reason:
817 description: |-
818 Reason is a brief machine readable explanation for the condition's last
819 transition.
820 type: string
821 status:
822 description: Status of the condition, one of (`True`, `False`, `Unknown`).
823 enum:
824 - "True"
825 - "False"
826 - Unknown
827 type: string
828 type:
829 description: Type of the condition, known values are (`Ready`, `Issuing`).
830 type: string
831 required:
832 - status
833 - type
834 type: object
835 type: array
836 x-kubernetes-list-map-keys:
837 - type
838 x-kubernetes-list-type: map
839 failedIssuanceAttempts:
840 description: |-
841 The number of continuous failed issuance attempts up till now. This
842 field gets removed (if set) on a successful issuance and gets set to
843 1 if unset and an issuance has failed. If an issuance has failed, the
844 delay till the next issuance will be calculated using formula
845 time.Hour * 2 ^ (failedIssuanceAttempts - 1).
846 type: integer
847 lastFailureTime:
848 description: |-
849 LastFailureTime is set only if the latest issuance for this
850 Certificate failed and contains the time of the failure. If an
851 issuance has failed, the delay till the next issuance will be
852 calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
853 1). If the latest issuance has succeeded this field will be unset.
854 format: date-time
855 type: string
856 nextPrivateKeySecretName:
857 description: |-
858 The name of the Secret resource containing the private key to be used
859 for the next certificate iteration.
860 The keymanager controller will automatically set this field if the
861 `Issuing` condition is set to `True`.
862 It will automatically unset this field when the Issuing condition is
863 not set or False.
864 type: string
865 notAfter:
866 description: |-
867 The expiration time of the certificate stored in the secret named
868 by this resource in `spec.secretName`.
869 format: date-time
870 type: string
871 notBefore:
872 description: |-
873 The time after which the certificate stored in the secret named
874 by this resource in `spec.secretName` is valid.
875 format: date-time
876 type: string
877 renewalTime:
878 description: |-
879 RenewalTime is the time at which the certificate will be next
880 renewed.
881 If not set, no upcoming renewal is scheduled.
882 format: date-time
883 type: string
884 revision:
885 description: |-
886 The current 'revision' of the certificate as issued.
887
888 When a CertificateRequest resource is created, it will have the
889 `cert-manager.io/certificate-revision` set to one greater than the
890 current value of this field.
891
892 Upon issuance, this field will be set to the value of the annotation
893 on the CertificateRequest resource used to issue the certificate.
894
895 Persisting the value on the CertificateRequest resource allows the
896 certificates controller to know whether a request is part of an old
897 issuance or if it is part of the ongoing revision's issuance by
898 checking if the revision value in the annotation is greater than this
899 field.
900 type: integer
901 type: object
902 type: object
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame]903 selectableFields:
904 - jsonPath: .spec.issuerRef.group
905 - jsonPath: .spec.issuerRef.kind
906 - jsonPath: .spec.issuerRef.name
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]907 served: true
908 storage: true
909 subresources:
910 status: {}
911{{- end }}