cert-manager values.yaml¶
bb-common.istio.enabled¶
Type: bool
Default value
true
bb-common.istio.mtls.mode¶
Type: string
Default value
"STRICT"
bb-common.istio.sidecar.enabled¶
Type: bool
Default value
true
bb-common.istio.sidecar.outboundTrafficPolicyMode¶
Type: string
Default value
"REGISTRY_ONLY"
bb-common.istio.authorizationPolicies.enabled¶
Type: bool
Default value
true
bb-common.istio.authorizationPolicies.generateFromNetpol¶
Type: bool
Default value
true
bb-common.networkPolicies.enabled¶
Type: bool
Default value
true
bb-common.networkPolicies.ingress.definitions.kubeAPI.from[0].ipBlock.cidr¶
Type: string
Default value
"10.0.0.0/8"
bb-common.networkPolicies.ingress.definitions.kubeAPI.from[1].ipBlock.cidr¶
Type: string
Default value
"172.16.0.0/12"
bb-common.networkPolicies.ingress.definitions.kubeAPI.from[2].ipBlock.cidr¶
Type: string
Default value
"192.168.0.0/16"
bb-common.networkPolicies.ingress.to.cert-manager-webhook:10250.podSelector.matchLabels.”app.kubernetes.io/component”¶
Type: string
Default value
"webhook"
bb-common.networkPolicies.ingress.to.cert-manager-webhook:10250.podSelector.matchLabels.”app.kubernetes.io/instance”¶
Type: string
Default value
"{{ .Release.Name }}"
bb-common.networkPolicies.ingress.to.cert-manager-webhook:10250.from.definition.kubeAPI¶
Type: bool
Default value
true
bb-common.networkPolicies.ingress.to.cert-manager-metrics:9402.podSelector.matchLabels.”app.kubernetes.io/instance”¶
Type: string
Default value
"{{ .Release.Name }}"
bb-common.networkPolicies.ingress.to.cert-manager-metrics:9402.from.k8s.monitoring-monitoring-kube-prometheus@monitoring/prometheus¶
Type: bool
Default value
true
bb-common.networkPolicies.egress.from.cert-manager-controller.podSelector.matchLabels.”app.kubernetes.io/component”¶
Type: string
Default value
"controller"
bb-common.networkPolicies.egress.from.cert-manager-controller.podSelector.matchLabels.”app.kubernetes.io/instance”¶
Type: string
Default value
"{{ .Release.Name }}"
bb-common.networkPolicies.egress.from.cert-manager-controller.to.definition.kubeAPI¶
Type: bool
Default value
true
bb-common.networkPolicies.egress.from.cert-manager-webhook.podSelector.matchLabels.”app.kubernetes.io/component”¶
Type: string
Default value
"webhook"
bb-common.networkPolicies.egress.from.cert-manager-webhook.podSelector.matchLabels.”app.kubernetes.io/instance”¶
Type: string
Default value
"{{ .Release.Name }}"
bb-common.networkPolicies.egress.from.cert-manager-webhook.to.definition.kubeAPI¶
Type: bool
Default value
true
bb-common.networkPolicies.egress.from.cert-manager-cainjector.podSelector.matchLabels.”app.kubernetes.io/component”¶
Type: string
Default value
"cainjector"
bb-common.networkPolicies.egress.from.cert-manager-cainjector.podSelector.matchLabels.”app.kubernetes.io/instance”¶
Type: string
Default value
"{{ .Release.Name }}"
bb-common.networkPolicies.egress.from.cert-manager-cainjector.to.definition.kubeAPI¶
Type: bool
Default value
true
bb-common.networkPolicies.egress.from.cert-manager-startupapicheck.podSelector.matchLabels.”app.kubernetes.io/component”¶
Type: string
Default value
"startupapicheck"
bb-common.networkPolicies.egress.from.cert-manager-startupapicheck.podSelector.matchLabels.”app.kubernetes.io/instance”¶
Type: string
Default value
"{{ .Release.Name }}"
bb-common.networkPolicies.egress.from.cert-manager-startupapicheck.to.definition.kubeAPI¶
Type: bool
Default value
true
bb-common.routes.outbound¶
Type: object
Default value
{}
issuers.selfSigned.enabled¶
Type: bool
Default value
false
issuers.selfSigned.createOnInstall¶
Type: bool
Default value
false
issuers.selfSigned.scope¶
Type: string
Default value
"Issuer"
issuers.selfSigned.name¶
Type: string
Default value
""
issuers.selfSigned.labels¶
Type: object
Default value
{}
issuers.selfSigned.annotations¶
Type: object
Default value
{}
issuers.letsEncrypt.enabled¶
Type: bool
Default value
false
issuers.letsEncrypt.createOnInstall¶
Type: bool
Default value
false
issuers.letsEncrypt.scope¶
Type: string
Default value
"Issuer"
issuers.letsEncrypt.name¶
Type: string
Default value
""
issuers.letsEncrypt.labels¶
Type: object
Default value
{}
issuers.letsEncrypt.annotations¶
Type: object
Default value
{}
issuers.letsEncrypt.environment¶
Type: string
Default value
"staging"
issuers.letsEncrypt.email¶
Type: string
Default value
""
issuers.letsEncrypt.server¶
Type: string
Default value
""
issuers.letsEncrypt.privateKeySecretName¶
Type: string
Default value
""
issuers.letsEncrypt.solvers¶
Type: list
Default value
[]
issuers.letsEncrypt.networking.controllerEgress.enabled¶
Type: bool
Default value
true
issuers.letsEncrypt.networking.controllerEgress.cidrs[0].cidr¶
Type: string
Default value
"0.0.0.0/0"
issuers.letsEncrypt.networking.controllerEgress.cidrs[0].except[0]¶
Type: string
Default value
"169.254.169.254/32"
issuers.letsEncrypt.networking.serviceEntry.enabled¶
Type: bool
Default value
true
upstream.fullnameOverride¶
Type: string
Default value
"cert-manager"
upstream.crds.enabled¶
Type: bool
Default value
true
upstream.crds.keep¶
Type: bool
Default value
true
upstream.global.imagePullSecrets[0].name¶
Type: string
Default value
"private-registry"
upstream.global.priorityClassName¶
Type: string
Default value
"system-cluster-critical"
upstream.securityContext.runAsUser¶
Type: int
Default value
1001
upstream.securityContext.runAsGroup¶
Type: int
Default value
1001
upstream.securityContext.runAsNonRoot¶
Type: bool
Default value
true
upstream.securityContext.seccompProfile.type¶
Type: string
Default value
"RuntimeDefault"
upstream.replicaCount¶
Type: int
Default value
2
upstream.podDisruptionBudget.enabled¶
Type: bool
Default value
true
upstream.podDisruptionBudget.minAvailable¶
Type: int
Default value
1
upstream.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.serviceAccount.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.volumes[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.volumes[0].projected.defaultMode¶
Type: int
Default value
292
upstream.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds¶
Type: int
Default value
3607
upstream.volumes[0].projected.sources[0].serviceAccountToken.path¶
Type: string
Default value
"token"
upstream.volumes[0].projected.sources[1].configMap.name¶
Type: string
Default value
"kube-root-ca.crt"
upstream.volumes[0].projected.sources[1].configMap.items[0].key¶
Type: string
Default value
"ca.crt"
upstream.volumes[0].projected.sources[1].configMap.items[0].path¶
Type: string
Default value
"ca.crt"
upstream.volumes[0].projected.sources[2].downwardAPI.items[0].path¶
Type: string
Default value
"namespace"
upstream.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.apiVersion¶
Type: string
Default value
"v1"
upstream.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.fieldPath¶
Type: string
Default value
"metadata.namespace"
upstream.volumeMounts[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.volumeMounts[0].mountPath¶
Type: string
Default value
"/var/run/secrets/kubernetes.io/serviceaccount"
upstream.volumeMounts[0].readOnly¶
Type: bool
Default value
true
upstream.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/jetstack/cert-manager-controller"
upstream.image.tag¶
Type: string
Default value
"v1.20.3"
upstream.webhook.replicaCount¶
Type: int
Default value
3
upstream.webhook.podDisruptionBudget.enabled¶
Type: bool
Default value
true
upstream.webhook.podDisruptionBudget.minAvailable¶
Type: int
Default value
1
upstream.webhook.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.webhook.serviceAccount.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.webhook.volumes[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.webhook.volumes[0].projected.defaultMode¶
Type: int
Default value
292
upstream.webhook.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds¶
Type: int
Default value
3607
upstream.webhook.volumes[0].projected.sources[0].serviceAccountToken.path¶
Type: string
Default value
"token"
upstream.webhook.volumes[0].projected.sources[1].configMap.name¶
Type: string
Default value
"kube-root-ca.crt"
upstream.webhook.volumes[0].projected.sources[1].configMap.items[0].key¶
Type: string
Default value
"ca.crt"
upstream.webhook.volumes[0].projected.sources[1].configMap.items[0].path¶
Type: string
Default value
"ca.crt"
upstream.webhook.volumes[0].projected.sources[2].downwardAPI.items[0].path¶
Type: string
Default value
"namespace"
upstream.webhook.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.apiVersion¶
Type: string
Default value
"v1"
upstream.webhook.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.fieldPath¶
Type: string
Default value
"metadata.namespace"
upstream.webhook.volumeMounts[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.webhook.volumeMounts[0].mountPath¶
Type: string
Default value
"/var/run/secrets/kubernetes.io/serviceaccount"
upstream.webhook.volumeMounts[0].readOnly¶
Type: bool
Default value
true
upstream.webhook.podAnnotations.”ambient.istio.io/bypass-inbound-capture”¶
Type: string
Default value
"true"
upstream.webhook.podAnnotations.”traffic.sidecar.istio.io/excludeInboundPorts”¶
Type: string
Default value
"10250"
upstream.webhook.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/jetstack/cert-manager-webhook"
upstream.webhook.image.tag¶
Type: string
Default value
"v1.20.3"
upstream.webhook.securityContext.runAsUser¶
Type: int
Default value
1001
upstream.webhook.securityContext.runAsGroup¶
Type: int
Default value
1001
upstream.webhook.securityContext.runAsNonRoot¶
Type: bool
Default value
true
upstream.webhook.securityContext.seccompProfile.type¶
Type: string
Default value
"RuntimeDefault"
upstream.cainjector.replicaCount¶
Type: int
Default value
2
upstream.cainjector.podDisruptionBudget.enabled¶
Type: bool
Default value
true
upstream.cainjector.podDisruptionBudget.minAvailable¶
Type: int
Default value
1
upstream.cainjector.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.cainjector.serviceAccount.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.cainjector.volumes[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.cainjector.volumes[0].projected.defaultMode¶
Type: int
Default value
292
upstream.cainjector.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds¶
Type: int
Default value
3607
upstream.cainjector.volumes[0].projected.sources[0].serviceAccountToken.path¶
Type: string
Default value
"token"
upstream.cainjector.volumes[0].projected.sources[1].configMap.name¶
Type: string
Default value
"kube-root-ca.crt"
upstream.cainjector.volumes[0].projected.sources[1].configMap.items[0].key¶
Type: string
Default value
"ca.crt"
upstream.cainjector.volumes[0].projected.sources[1].configMap.items[0].path¶
Type: string
Default value
"ca.crt"
upstream.cainjector.volumes[0].projected.sources[2].downwardAPI.items[0].path¶
Type: string
Default value
"namespace"
upstream.cainjector.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.apiVersion¶
Type: string
Default value
"v1"
upstream.cainjector.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.fieldPath¶
Type: string
Default value
"metadata.namespace"
upstream.cainjector.volumeMounts[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.cainjector.volumeMounts[0].mountPath¶
Type: string
Default value
"/var/run/secrets/kubernetes.io/serviceaccount"
upstream.cainjector.volumeMounts[0].readOnly¶
Type: bool
Default value
true
upstream.cainjector.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/jetstack/cert-manager-cainjector"
upstream.cainjector.image.tag¶
Type: string
Default value
"v1.20.3"
upstream.cainjector.securityContext.runAsUser¶
Type: int
Default value
1001
upstream.cainjector.securityContext.runAsGroup¶
Type: int
Default value
1001
upstream.cainjector.securityContext.runAsNonRoot¶
Type: bool
Default value
true
upstream.cainjector.securityContext.seccompProfile.type¶
Type: string
Default value
"RuntimeDefault"
upstream.acmesolver.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/jetstack/cert-manager-acmesolver"
upstream.acmesolver.image.tag¶
Type: string
Default value
"v1.20.3"
upstream.startupapicheck.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.startupapicheck.serviceAccount.automountServiceAccountToken¶
Type: bool
Default value
false
upstream.startupapicheck.volumes[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.startupapicheck.volumes[0].projected.defaultMode¶
Type: int
Default value
292
upstream.startupapicheck.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds¶
Type: int
Default value
3607
upstream.startupapicheck.volumes[0].projected.sources[0].serviceAccountToken.path¶
Type: string
Default value
"token"
upstream.startupapicheck.volumes[0].projected.sources[1].configMap.name¶
Type: string
Default value
"kube-root-ca.crt"
upstream.startupapicheck.volumes[0].projected.sources[1].configMap.items[0].key¶
Type: string
Default value
"ca.crt"
upstream.startupapicheck.volumes[0].projected.sources[1].configMap.items[0].path¶
Type: string
Default value
"ca.crt"
upstream.startupapicheck.volumes[0].projected.sources[2].downwardAPI.items[0].path¶
Type: string
Default value
"namespace"
upstream.startupapicheck.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.apiVersion¶
Type: string
Default value
"v1"
upstream.startupapicheck.volumes[0].projected.sources[2].downwardAPI.items[0].fieldRef.fieldPath¶
Type: string
Default value
"metadata.namespace"
upstream.startupapicheck.volumeMounts[0].name¶
Type: string
Default value
"serviceaccount-token"
upstream.startupapicheck.volumeMounts[0].mountPath¶
Type: string
Default value
"/var/run/secrets/kubernetes.io/serviceaccount"
upstream.startupapicheck.volumeMounts[0].readOnly¶
Type: bool
Default value
true
upstream.startupapicheck.podAnnotations.”sidecar.istio.io/inject”¶
Type: string
Default value
"false"
upstream.startupapicheck.podLabels.”istio.io/dataplane-mode”¶
Type: string
Default value
"none"
upstream.startupapicheck.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/cleanstart/cert-manager-startupapicheck"
upstream.startupapicheck.image.tag¶
Type: string
Default value
"1.20.3-amd64"
upstream.startupapicheck.securityContext.runAsUser¶
Type: int
Default value
1001
upstream.startupapicheck.securityContext.runAsGroup¶
Type: int
Default value
1001
upstream.startupapicheck.securityContext.runAsNonRoot¶
Type: bool
Default value
true
upstream.startupapicheck.securityContext.seccompProfile.type¶
Type: string
Default value
"RuntimeDefault"
upstream.prometheus.enabled¶
Type: bool
Default value
true
upstream.prometheus.servicemonitor.enabled¶
Type: bool
Default value
true
upstream.prometheus.servicemonitor.endpointAdditionalProperties.scheme¶
Type: string
Default value
"https"
upstream.prometheus.servicemonitor.endpointAdditionalProperties.enableHttp2¶
Type: bool
Default value
false
upstream.prometheus.servicemonitor.endpointAdditionalProperties.tlsConfig.caFile¶
Type: string
Default value
"/etc/prom-certs/root-cert.pem"
upstream.prometheus.servicemonitor.endpointAdditionalProperties.tlsConfig.certFile¶
Type: string
Default value
"/etc/prom-certs/cert-chain.pem"
upstream.prometheus.servicemonitor.endpointAdditionalProperties.tlsConfig.keyFile¶
Type: string
Default value
"/etc/prom-certs/key.pem"
upstream.prometheus.servicemonitor.endpointAdditionalProperties.tlsConfig.insecureSkipVerify¶
Type: bool
Default value
true
upstream.prometheus.podmonitor.enabled¶
Type: bool
Default value
false
bbtests.enabled¶
Type: bool
Default value
false
bbtests.scripts.enabled¶
Type: bool
Default value
false
bbtests.scripts.envs.NAMESPACE¶
Type: string
Default value
"{{ .Release.Namespace }}"
bbtests.scripts.envs.INSTANCE_NAME¶
Type: string
Default value
"{{ .Release.Name }}"
bbtests.scripts.envs.WEBHOOK_SERVICE¶
Type: string
Default value
"{{ include \"cert-manager.webhookServiceName\" . }}"
bbtests.scripts.envs.WEBHOOK_CA_SECRET¶
Type: string
Default value
"{{ include \"cert-manager.webhookServiceName\" . }}-ca"
bbtests.scripts.envs.REQUIRE_BUILTIN_ISSUER¶
Type: string
Default value
"{{ and .Release.IsUpgrade .Values.issuers.selfSigned.enabled }}"
bbtests.scripts.envs.BUILTIN_ISSUER_NAME¶
Type: string
Default value
"{{ include \"cert-manager.selfSignedIssuerName\" . }}"
bbtests.scripts.envs.BUILTIN_ISSUER_KIND¶
Type: string
Default value
"{{ .Values.issuers.selfSigned.scope }}"
bbtests.scripts.image¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.34"