|
|
# Copyright The cert-manager Authors.
|
|
|
#
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
# you may not use this file except in compliance with the License.
|
|
|
# You may obtain a copy of the License at
|
|
|
#
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
#
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
# See the License for the specific language governing permissions and
|
|
|
# limitations under the License.
|
|
|
|
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
|
kind: CustomResourceDefinition
|
|
|
metadata:
|
|
|
annotations:
|
|
|
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
|
|
|
labels:
|
|
|
app: cert-manager
|
|
|
app.kubernetes.io/instance: cert-manager
|
|
|
app.kubernetes.io/name: cert-manager
|
|
|
name: certificaterequests.cert-manager.io
|
|
|
spec:
|
|
|
conversion:
|
|
|
strategy: Webhook
|
|
|
webhook:
|
|
|
clientConfig:
|
|
|
service:
|
|
|
name: cert-manager-webhook
|
|
|
namespace: cert-manager
|
|
|
path: /convert
|
|
|
conversionReviewVersions:
|
|
|
- v1
|
|
|
- v1beta1
|
|
|
group: cert-manager.io
|
|
|
names:
|
|
|
categories:
|
|
|
- cert-manager
|
|
|
kind: CertificateRequest
|
|
|
listKind: CertificateRequestList
|
|
|
plural: certificaterequests
|
|
|
shortNames:
|
|
|
- cr
|
|
|
- crs
|
|
|
singular: certificaterequest
|
|
|
scope: Namespaced
|
|
|
versions:
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1alpha2
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A CertificateRequest is used to request a signed certificate
|
|
|
from one of the configured issuers. \n All fields within the CertificateRequest's
|
|
|
`spec` are immutable after creation. A CertificateRequest will either succeed
|
|
|
or fail, as denoted by its `status.state` field. \n A CertificateRequest
|
|
|
is a one-shot resource, meaning it represents a single point in time request
|
|
|
for a certificate and cannot be re-used."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the CertificateRequest resource.
|
|
|
properties:
|
|
|
csr:
|
|
|
description: The PEM-encoded x509 certificate signing request to be
|
|
|
submitted to the CA for signing.
|
|
|
format: byte
|
|
|
type: string
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types.
|
|
|
type: string
|
|
|
isCA:
|
|
|
description: IsCA will request to mark the certificate as valid for
|
|
|
certificate signing when submitting to the issuer. This will automatically
|
|
|
add the `cert sign` usage to the list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
|
|
the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the CertificateRequest
|
|
|
will be used. If the `kind` field is set to `ClusterIssuer`, a
|
|
|
ClusterIssuer with the provided name will be used. The `name` field
|
|
|
in this stanza is required at all times. The group field refers
|
|
|
to the API group of the issuer which defaults to `cert-manager.io`
|
|
|
if empty.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- csr
|
|
|
- issuerRef
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the CertificateRequest. This is set and managed
|
|
|
automatically.
|
|
|
properties:
|
|
|
ca:
|
|
|
description: The PEM encoded x509 certificate of the signer, also
|
|
|
known as the CA (Certificate Authority). This is set on a best-effort
|
|
|
basis by different issuers. If not set, the CA is assumed to be
|
|
|
unknown/not available.
|
|
|
format: byte
|
|
|
type: string
|
|
|
certificate:
|
|
|
description: The PEM encoded x509 certificate resulting from the certificate
|
|
|
signing request. If not set, the CertificateRequest has either not
|
|
|
been completed or has failed. More information on failure can be
|
|
|
found by checking the `conditions` field.
|
|
|
format: byte
|
|
|
type: string
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of a
|
|
|
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
|
|
|
items:
|
|
|
description: CertificateRequestCondition contains condition information
|
|
|
for a CertificateRequest.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`InvalidRequest`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
failureTime:
|
|
|
description: FailureTime stores the time that this CertificateRequest
|
|
|
failed. This is used to influence garbage collection and back-off.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
type: object
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: false
|
|
|
subresources:
|
|
|
status: {}
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1alpha3
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A CertificateRequest is used to request a signed certificate
|
|
|
from one of the configured issuers. \n All fields within the CertificateRequest's
|
|
|
`spec` are immutable after creation. A CertificateRequest will either succeed
|
|
|
or fail, as denoted by its `status.state` field. \n A CertificateRequest
|
|
|
is a one-shot resource, meaning it represents a single point in time request
|
|
|
for a certificate and cannot be re-used."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the CertificateRequest resource.
|
|
|
properties:
|
|
|
csr:
|
|
|
description: The PEM-encoded x509 certificate signing request to be
|
|
|
submitted to the CA for signing.
|
|
|
format: byte
|
|
|
type: string
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types.
|
|
|
type: string
|
|
|
isCA:
|
|
|
description: IsCA will request to mark the certificate as valid for
|
|
|
certificate signing when submitting to the issuer. This will automatically
|
|
|
add the `cert sign` usage to the list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
|
|
the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the CertificateRequest
|
|
|
will be used. If the `kind` field is set to `ClusterIssuer`, a
|
|
|
ClusterIssuer with the provided name will be used. The `name` field
|
|
|
in this stanza is required at all times. The group field refers
|
|
|
to the API group of the issuer which defaults to `cert-manager.io`
|
|
|
if empty.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- csr
|
|
|
- issuerRef
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the CertificateRequest. This is set and managed
|
|
|
automatically.
|
|
|
properties:
|
|
|
ca:
|
|
|
description: The PEM encoded x509 certificate of the signer, also
|
|
|
known as the CA (Certificate Authority). This is set on a best-effort
|
|
|
basis by different issuers. If not set, the CA is assumed to be
|
|
|
unknown/not available.
|
|
|
format: byte
|
|
|
type: string
|
|
|
certificate:
|
|
|
description: The PEM encoded x509 certificate resulting from the certificate
|
|
|
signing request. If not set, the CertificateRequest has either not
|
|
|
been completed or has failed. More information on failure can be
|
|
|
found by checking the `conditions` field.
|
|
|
format: byte
|
|
|
type: string
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of a
|
|
|
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
|
|
|
items:
|
|
|
description: CertificateRequestCondition contains condition information
|
|
|
for a CertificateRequest.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`InvalidRequest`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
failureTime:
|
|
|
description: FailureTime stores the time that this CertificateRequest
|
|
|
failed. This is used to influence garbage collection and back-off.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
type: object
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: false
|
|
|
subresources:
|
|
|
status: {}
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1beta1
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A CertificateRequest is used to request a signed certificate
|
|
|
from one of the configured issuers. \n All fields within the CertificateRequest's
|
|
|
`spec` are immutable after creation. A CertificateRequest will either succeed
|
|
|
or fail, as denoted by its `status.state` field. \n A CertificateRequest
|
|
|
is a one-shot resource, meaning it represents a single point in time request
|
|
|
for a certificate and cannot be re-used."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the CertificateRequest resource.
|
|
|
properties:
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types.
|
|
|
type: string
|
|
|
isCA:
|
|
|
description: IsCA will request to mark the certificate as valid for
|
|
|
certificate signing when submitting to the issuer. This will automatically
|
|
|
add the `cert sign` usage to the list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
|
|
the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the CertificateRequest
|
|
|
will be used. If the `kind` field is set to `ClusterIssuer`, a
|
|
|
ClusterIssuer with the provided name will be used. The `name` field
|
|
|
in this stanza is required at all times. The group field refers
|
|
|
to the API group of the issuer which defaults to `cert-manager.io`
|
|
|
if empty.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
request:
|
|
|
description: The PEM-encoded x509 certificate signing request to be
|
|
|
submitted to the CA for signing.
|
|
|
format: byte
|
|
|
type: string
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- issuerRef
|
|
|
- request
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the CertificateRequest. This is set and managed
|
|
|
automatically.
|
|
|
properties:
|
|
|
ca:
|
|
|
description: The PEM encoded x509 certificate of the signer, also
|
|
|
known as the CA (Certificate Authority). This is set on a best-effort
|
|
|
basis by different issuers. If not set, the CA is assumed to be
|
|
|
unknown/not available.
|
|
|
format: byte
|
|
|
type: string
|
|
|
certificate:
|
|
|
description: The PEM encoded x509 certificate resulting from the certificate
|
|
|
signing request. If not set, the CertificateRequest has either not
|
|
|
been completed or has failed. More information on failure can be
|
|
|
found by checking the `conditions` field.
|
|
|
format: byte
|
|
|
type: string
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of a
|
|
|
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
|
|
|
items:
|
|
|
description: CertificateRequestCondition contains condition information
|
|
|
for a CertificateRequest.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`InvalidRequest`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
failureTime:
|
|
|
description: FailureTime stores the time that this CertificateRequest
|
|
|
failed. This is used to influence garbage collection and back-off.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
type: object
|
|
|
required:
|
|
|
- spec
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: false
|
|
|
subresources:
|
|
|
status: {}
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A CertificateRequest is used to request a signed certificate
|
|
|
from one of the configured issuers. \n All fields within the CertificateRequest's
|
|
|
`spec` are immutable after creation. A CertificateRequest will either succeed
|
|
|
or fail, as denoted by its `status.state` field. \n A CertificateRequest
|
|
|
is a one-shot resource, meaning it represents a single point in time request
|
|
|
for a certificate and cannot be re-used."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the CertificateRequest resource.
|
|
|
properties:
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types.
|
|
|
type: string
|
|
|
isCA:
|
|
|
description: IsCA will request to mark the certificate as valid for
|
|
|
certificate signing when submitting to the issuer. This will automatically
|
|
|
add the `cert sign` usage to the list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
|
|
the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the CertificateRequest
|
|
|
will be used. If the `kind` field is set to `ClusterIssuer`, a
|
|
|
ClusterIssuer with the provided name will be used. The `name` field
|
|
|
in this stanza is required at all times. The group field refers
|
|
|
to the API group of the issuer which defaults to `cert-manager.io`
|
|
|
if empty.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
request:
|
|
|
description: The PEM-encoded x509 certificate signing request to be
|
|
|
submitted to the CA for signing.
|
|
|
format: byte
|
|
|
type: string
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. If usages are set they SHOULD be encoded inside
|
|
|
the CSR spec Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- issuerRef
|
|
|
- request
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the CertificateRequest. This is set and managed
|
|
|
automatically.
|
|
|
properties:
|
|
|
ca:
|
|
|
description: The PEM encoded x509 certificate of the signer, also
|
|
|
known as the CA (Certificate Authority). This is set on a best-effort
|
|
|
basis by different issuers. If not set, the CA is assumed to be
|
|
|
unknown/not available.
|
|
|
format: byte
|
|
|
type: string
|
|
|
certificate:
|
|
|
description: The PEM encoded x509 certificate resulting from the certificate
|
|
|
signing request. If not set, the CertificateRequest has either not
|
|
|
been completed or has failed. More information on failure can be
|
|
|
found by checking the `conditions` field.
|
|
|
format: byte
|
|
|
type: string
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of a
|
|
|
CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
|
|
|
items:
|
|
|
description: CertificateRequestCondition contains condition information
|
|
|
for a CertificateRequest.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`InvalidRequest`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
failureTime:
|
|
|
description: FailureTime stores the time that this CertificateRequest
|
|
|
failed. This is used to influence garbage collection and back-off.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
type: object
|
|
|
required:
|
|
|
- spec
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: true
|
|
|
subresources:
|
|
|
status: {}
|
|
|
status:
|
|
|
acceptedNames:
|
|
|
kind: ""
|
|
|
plural: ""
|
|
|
conditions: []
|
|
|
storedVersions: []
|
|
|
---
|
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
|
kind: CustomResourceDefinition
|
|
|
metadata:
|
|
|
annotations:
|
|
|
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
|
|
|
labels:
|
|
|
app: cert-manager
|
|
|
app.kubernetes.io/instance: cert-manager
|
|
|
app.kubernetes.io/name: cert-manager
|
|
|
name: certificates.cert-manager.io
|
|
|
spec:
|
|
|
conversion:
|
|
|
strategy: Webhook
|
|
|
webhook:
|
|
|
clientConfig:
|
|
|
service:
|
|
|
name: cert-manager-webhook
|
|
|
namespace: cert-manager
|
|
|
path: /convert
|
|
|
conversionReviewVersions:
|
|
|
- v1
|
|
|
- v1beta1
|
|
|
group: cert-manager.io
|
|
|
names:
|
|
|
categories:
|
|
|
- cert-manager
|
|
|
kind: Certificate
|
|
|
listKind: CertificateList
|
|
|
plural: certificates
|
|
|
shortNames:
|
|
|
- cert
|
|
|
- certs
|
|
|
singular: certificate
|
|
|
scope: Namespaced
|
|
|
versions:
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.secretName
|
|
|
name: Secret
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1alpha2
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A Certificate resource should be created to ensure an up to
|
|
|
date and signed x509 certificate is stored in the Kubernetes Secret resource
|
|
|
named in `spec.secretName`. \n The stored certificate will be renewed before
|
|
|
it expires (as configured by `spec.renewBefore`)."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the Certificate resource.
|
|
|
properties:
|
|
|
commonName:
|
|
|
description: 'CommonName is a common name to be used on the Certificate.
|
|
|
The CommonName should have a length of 64 characters or fewer to
|
|
|
avoid generating invalid CSRs. This value is ignored by TLS clients
|
|
|
when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
|
|
type: string
|
|
|
dnsNames:
|
|
|
description: DNSNames is a list of DNS subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types. If overridden
|
|
|
and `renewBefore` is greater than the actual certificate duration,
|
|
|
the certificate will be automatically renewed 2/3rds of the way
|
|
|
through the certificate's duration.
|
|
|
type: string
|
|
|
emailSANs:
|
|
|
description: EmailSANs is a list of email subjectAltNames to be set
|
|
|
on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
encodeUsagesInRequest:
|
|
|
description: EncodeUsagesInRequest controls whether key usages should
|
|
|
be present in the CertificateRequest
|
|
|
type: boolean
|
|
|
ipAddresses:
|
|
|
description: IPAddresses is a list of IP address subjectAltNames to
|
|
|
be set on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
isCA:
|
|
|
description: IsCA will mark this Certificate as valid for certificate
|
|
|
signing. This will automatically add the `cert sign` usage to the
|
|
|
list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this certificate.
|
|
|
If the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the Certificate will
|
|
|
be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer
|
|
|
with the provided name will be used. The `name` field in this stanza
|
|
|
is required at all times.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
keyAlgorithm:
|
|
|
description: KeyAlgorithm is the private key algorithm of the corresponding
|
|
|
private key for this certificate. If provided, allowed values are
|
|
|
either `rsa` or `ecdsa` If `keyAlgorithm` is specified and `keySize`
|
|
|
is not provided, key size of 256 will be used for `ecdsa` key algorithm
|
|
|
and key size of 2048 will be used for `rsa` key algorithm.
|
|
|
enum:
|
|
|
- rsa
|
|
|
- ecdsa
|
|
|
type: string
|
|
|
keyEncoding:
|
|
|
description: KeyEncoding is the private key cryptography standards
|
|
|
(PKCS) for this certificate's private key to be encoded in. If provided,
|
|
|
allowed values are `pkcs1` and `pkcs8` standing for PKCS#1 and PKCS#8,
|
|
|
respectively. If KeyEncoding is not specified, then `pkcs1` will
|
|
|
be used by default.
|
|
|
enum:
|
|
|
- pkcs1
|
|
|
- pkcs8
|
|
|
type: string
|
|
|
keySize:
|
|
|
description: KeySize is the key bit size of the corresponding private
|
|
|
key for this certificate. If `keyAlgorithm` is set to `rsa`, valid
|
|
|
values are `2048`, `4096` or `8192`, and will default to `2048`
|
|
|
if not specified. If `keyAlgorithm` is set to `ecdsa`, valid values
|
|
|
are `256`, `384` or `521`, and will default to `256` if not specified.
|
|
|
No other values are allowed.
|
|
|
type: integer
|
|
|
keystores:
|
|
|
description: Keystores configures additional keystore output formats
|
|
|
stored in the `secretName` Secret resource.
|
|
|
properties:
|
|
|
jks:
|
|
|
description: JKS configures options for storing a JKS keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables JKS keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.jks` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance.
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the JKS keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
pkcs12:
|
|
|
description: PKCS12 configures options for storing a PKCS12 keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables PKCS12 keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.p12` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance.
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the PKCS12 keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
type: object
|
|
|
organization:
|
|
|
description: Organization is a list of organizations to be used on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
privateKey:
|
|
|
description: Options to control private keys used for the Certificate.
|
|
|
properties:
|
|
|
rotationPolicy:
|
|
|
description: RotationPolicy controls how private keys should be
|
|
|
regenerated when a re-issuance is being processed. If set to
|
|
|
Never, a private key will only be generated if one does not
|
|
|
already exist in the target `spec.secretName`. If one does exists
|
|
|
but it does not have the correct algorithm or size, a warning
|
|
|
will be raised to await user intervention. If set to Always,
|
|
|
a private key matching the specified requirements will be generated
|
|
|
whenever a re-issuance occurs. Default is 'Never' for backward
|
|
|
compatibility.
|
|
|
type: string
|
|
|
type: object
|
|
|
renewBefore:
|
|
|
description: The amount of time before the currently issued certificate's
|
|
|
`notAfter` time that cert-manager will begin to attempt to renew
|
|
|
the certificate. If this value is greater than the total duration
|
|
|
of the certificate (i.e. notAfter - notBefore), it will be automatically
|
|
|
renewed 2/3rds of the way through the certificate's duration.
|
|
|
type: string
|
|
|
secretName:
|
|
|
description: SecretName is the name of the secret resource that will
|
|
|
be automatically created and managed by this Certificate resource.
|
|
|
It will be populated with a private key and certificate, signed
|
|
|
by the denoted issuer.
|
|
|
type: string
|
|
|
subject:
|
|
|
description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
|
|
properties:
|
|
|
countries:
|
|
|
description: Countries to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
localities:
|
|
|
description: Cities to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizationalUnits:
|
|
|
description: Organizational Units to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
postalCodes:
|
|
|
description: Postal codes to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
provinces:
|
|
|
description: State/Provinces to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
serialNumber:
|
|
|
description: Serial number to be used on the Certificate.
|
|
|
type: string
|
|
|
streetAddresses:
|
|
|
description: Street addresses to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
type: object
|
|
|
uriSANs:
|
|
|
description: URISANs is a list of URI subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- issuerRef
|
|
|
- secretName
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the Certificate. This is set and managed automatically.
|
|
|
properties:
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of certificates.
|
|
|
Known condition types are `Ready` and `Issuing`.
|
|
|
items:
|
|
|
description: CertificateCondition contains condition information
|
|
|
for an Certificate.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`Issuing`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
lastFailureTime:
|
|
|
description: LastFailureTime is the time as recorded by the Certificate
|
|
|
controller of the most recent failure to complete a CertificateRequest
|
|
|
for this Certificate resource. If set, cert-manager will not re-request
|
|
|
another Certificate until 1 hour has elapsed from this time.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
nextPrivateKeySecretName:
|
|
|
description: The name of the Secret resource containing the private
|
|
|
key to be used for the next certificate iteration. The keymanager
|
|
|
controller will automatically set this field if the `Issuing` condition
|
|
|
is set to `True`. It will automatically unset this field when the
|
|
|
Issuing condition is not set or False.
|
|
|
type: string
|
|
|
notAfter:
|
|
|
description: The expiration time of the certificate stored in the
|
|
|
secret named by this resource in `spec.secretName`.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
notBefore:
|
|
|
description: The time after which the certificate stored in the secret
|
|
|
named by this resource in spec.secretName is valid.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
renewalTime:
|
|
|
description: RenewalTime is the time at which the certificate will
|
|
|
be next renewed. If not set, no upcoming renewal is scheduled.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
revision:
|
|
|
description: "The current 'revision' of the certificate as issued.
|
|
|
\n When a CertificateRequest resource is created, it will have the
|
|
|
`cert-manager.io/certificate-revision` set to one greater than the
|
|
|
current value of this field. \n Upon issuance, this field will be
|
|
|
set to the value of the annotation on the CertificateRequest resource
|
|
|
used to issue the certificate. \n Persisting the value on the CertificateRequest
|
|
|
resource allows the certificates controller to know whether a request
|
|
|
is part of an old issuance or if it is part of the ongoing revision's
|
|
|
issuance by checking if the revision value in the annotation is
|
|
|
greater than this field."
|
|
|
type: integer
|
|
|
type: object
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: false
|
|
|
subresources:
|
|
|
status: {}
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.secretName
|
|
|
name: Secret
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1alpha3
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A Certificate resource should be created to ensure an up to
|
|
|
date and signed x509 certificate is stored in the Kubernetes Secret resource
|
|
|
named in `spec.secretName`. \n The stored certificate will be renewed before
|
|
|
it expires (as configured by `spec.renewBefore`)."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the Certificate resource.
|
|
|
properties:
|
|
|
commonName:
|
|
|
description: 'CommonName is a common name to be used on the Certificate.
|
|
|
The CommonName should have a length of 64 characters or fewer to
|
|
|
avoid generating invalid CSRs. This value is ignored by TLS clients
|
|
|
when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
|
|
type: string
|
|
|
dnsNames:
|
|
|
description: DNSNames is a list of DNS subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types. If overridden
|
|
|
and `renewBefore` is greater than the actual certificate duration,
|
|
|
the certificate will be automatically renewed 2/3rds of the way
|
|
|
through the certificate's duration.
|
|
|
type: string
|
|
|
emailSANs:
|
|
|
description: EmailSANs is a list of email subjectAltNames to be set
|
|
|
on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
encodeUsagesInRequest:
|
|
|
description: EncodeUsagesInRequest controls whether key usages should
|
|
|
be present in the CertificateRequest
|
|
|
type: boolean
|
|
|
ipAddresses:
|
|
|
description: IPAddresses is a list of IP address subjectAltNames to
|
|
|
be set on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
isCA:
|
|
|
description: IsCA will mark this Certificate as valid for certificate
|
|
|
signing. This will automatically add the `cert sign` usage to the
|
|
|
list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this certificate.
|
|
|
If the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the Certificate will
|
|
|
be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer
|
|
|
with the provided name will be used. The `name` field in this stanza
|
|
|
is required at all times.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
keyAlgorithm:
|
|
|
description: KeyAlgorithm is the private key algorithm of the corresponding
|
|
|
private key for this certificate. If provided, allowed values are
|
|
|
either `rsa` or `ecdsa` If `keyAlgorithm` is specified and `keySize`
|
|
|
is not provided, key size of 256 will be used for `ecdsa` key algorithm
|
|
|
and key size of 2048 will be used for `rsa` key algorithm.
|
|
|
enum:
|
|
|
- rsa
|
|
|
- ecdsa
|
|
|
type: string
|
|
|
keyEncoding:
|
|
|
description: KeyEncoding is the private key cryptography standards
|
|
|
(PKCS) for this certificate's private key to be encoded in. If provided,
|
|
|
allowed values are `pkcs1` and `pkcs8` standing for PKCS#1 and PKCS#8,
|
|
|
respectively. If KeyEncoding is not specified, then `pkcs1` will
|
|
|
be used by default.
|
|
|
enum:
|
|
|
- pkcs1
|
|
|
- pkcs8
|
|
|
type: string
|
|
|
keySize:
|
|
|
description: KeySize is the key bit size of the corresponding private
|
|
|
key for this certificate. If `keyAlgorithm` is set to `rsa`, valid
|
|
|
values are `2048`, `4096` or `8192`, and will default to `2048`
|
|
|
if not specified. If `keyAlgorithm` is set to `ecdsa`, valid values
|
|
|
are `256`, `384` or `521`, and will default to `256` if not specified.
|
|
|
No other values are allowed.
|
|
|
type: integer
|
|
|
keystores:
|
|
|
description: Keystores configures additional keystore output formats
|
|
|
stored in the `secretName` Secret resource.
|
|
|
properties:
|
|
|
jks:
|
|
|
description: JKS configures options for storing a JKS keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables JKS keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.jks` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance. A file named `truststore.jks`
|
|
|
will also be created in the target Secret resource, encrypted
|
|
|
using the password stored in `passwordSecretRef` containing
|
|
|
the issuing Certificate Authority.
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the JKS keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
pkcs12:
|
|
|
description: PKCS12 configures options for storing a PKCS12 keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables PKCS12 keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.p12` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance. A file named `truststore.p12`
|
|
|
will also be created in the target Secret resource, encrypted
|
|
|
using the password stored in `passwordSecretRef` containing
|
|
|
the issuing Certificate Authority.
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the PKCS12 keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
type: object
|
|
|
privateKey:
|
|
|
description: Options to control private keys used for the Certificate.
|
|
|
properties:
|
|
|
rotationPolicy:
|
|
|
description: RotationPolicy controls how private keys should be
|
|
|
regenerated when a re-issuance is being processed. If set to
|
|
|
Never, a private key will only be generated if one does not
|
|
|
already exist in the target `spec.secretName`. If one does exists
|
|
|
but it does not have the correct algorithm or size, a warning
|
|
|
will be raised to await user intervention. If set to Always,
|
|
|
a private key matching the specified requirements will be generated
|
|
|
whenever a re-issuance occurs. Default is 'Never' for backward
|
|
|
compatibility.
|
|
|
type: string
|
|
|
type: object
|
|
|
renewBefore:
|
|
|
description: The amount of time before the currently issued certificate's
|
|
|
`notAfter` time that cert-manager will begin to attempt to renew
|
|
|
the certificate. If this value is greater than the total duration
|
|
|
of the certificate (i.e. notAfter - notBefore), it will be automatically
|
|
|
renewed 2/3rds of the way through the certificate's duration.
|
|
|
type: string
|
|
|
secretName:
|
|
|
description: SecretName is the name of the secret resource that will
|
|
|
be automatically created and managed by this Certificate resource.
|
|
|
It will be populated with a private key and certificate, signed
|
|
|
by the denoted issuer.
|
|
|
type: string
|
|
|
subject:
|
|
|
description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
|
|
properties:
|
|
|
countries:
|
|
|
description: Countries to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
localities:
|
|
|
description: Cities to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizationalUnits:
|
|
|
description: Organizational Units to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizations:
|
|
|
description: Organizations to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
postalCodes:
|
|
|
description: Postal codes to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
provinces:
|
|
|
description: State/Provinces to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
serialNumber:
|
|
|
description: Serial number to be used on the Certificate.
|
|
|
type: string
|
|
|
streetAddresses:
|
|
|
description: Street addresses to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
type: object
|
|
|
uriSANs:
|
|
|
description: URISANs is a list of URI subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- issuerRef
|
|
|
- secretName
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the Certificate. This is set and managed automatically.
|
|
|
properties:
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of certificates.
|
|
|
Known condition types are `Ready` and `Issuing`.
|
|
|
items:
|
|
|
description: CertificateCondition contains condition information
|
|
|
for an Certificate.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`Issuing`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
lastFailureTime:
|
|
|
description: LastFailureTime is the time as recorded by the Certificate
|
|
|
controller of the most recent failure to complete a CertificateRequest
|
|
|
for this Certificate resource. If set, cert-manager will not re-request
|
|
|
another Certificate until 1 hour has elapsed from this time.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
nextPrivateKeySecretName:
|
|
|
description: The name of the Secret resource containing the private
|
|
|
key to be used for the next certificate iteration. The keymanager
|
|
|
controller will automatically set this field if the `Issuing` condition
|
|
|
is set to `True`. It will automatically unset this field when the
|
|
|
Issuing condition is not set or False.
|
|
|
type: string
|
|
|
notAfter:
|
|
|
description: The expiration time of the certificate stored in the
|
|
|
secret named by this resource in `spec.secretName`.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
notBefore:
|
|
|
description: The time after which the certificate stored in the secret
|
|
|
named by this resource in spec.secretName is valid.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
renewalTime:
|
|
|
description: RenewalTime is the time at which the certificate will
|
|
|
be next renewed. If not set, no upcoming renewal is scheduled.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
revision:
|
|
|
description: "The current 'revision' of the certificate as issued.
|
|
|
\n When a CertificateRequest resource is created, it will have the
|
|
|
`cert-manager.io/certificate-revision` set to one greater than the
|
|
|
current value of this field. \n Upon issuance, this field will be
|
|
|
set to the value of the annotation on the CertificateRequest resource
|
|
|
used to issue the certificate. \n Persisting the value on the CertificateRequest
|
|
|
resource allows the certificates controller to know whether a request
|
|
|
is part of an old issuance or if it is part of the ongoing revision's
|
|
|
issuance by checking if the revision value in the annotation is
|
|
|
greater than this field."
|
|
|
type: integer
|
|
|
type: object
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: false
|
|
|
subresources:
|
|
|
status: {}
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.secretName
|
|
|
name: Secret
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1beta1
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A Certificate resource should be created to ensure an up to
|
|
|
date and signed x509 certificate is stored in the Kubernetes Secret resource
|
|
|
named in `spec.secretName`. \n The stored certificate will be renewed before
|
|
|
it expires (as configured by `spec.renewBefore`)."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the Certificate resource.
|
|
|
properties:
|
|
|
commonName:
|
|
|
description: 'CommonName is a common name to be used on the Certificate.
|
|
|
The CommonName should have a length of 64 characters or fewer to
|
|
|
avoid generating invalid CSRs. This value is ignored by TLS clients
|
|
|
when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
|
|
type: string
|
|
|
dnsNames:
|
|
|
description: DNSNames is a list of DNS subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types. If overridden
|
|
|
and `renewBefore` is greater than the actual certificate duration,
|
|
|
the certificate will be automatically renewed 2/3rds of the way
|
|
|
through the certificate's duration.
|
|
|
type: string
|
|
|
emailSANs:
|
|
|
description: EmailSANs is a list of email subjectAltNames to be set
|
|
|
on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
encodeUsagesInRequest:
|
|
|
description: EncodeUsagesInRequest controls whether key usages should
|
|
|
be present in the CertificateRequest
|
|
|
type: boolean
|
|
|
ipAddresses:
|
|
|
description: IPAddresses is a list of IP address subjectAltNames to
|
|
|
be set on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
isCA:
|
|
|
description: IsCA will mark this Certificate as valid for certificate
|
|
|
signing. This will automatically add the `cert sign` usage to the
|
|
|
list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this certificate.
|
|
|
If the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the Certificate will
|
|
|
be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer
|
|
|
with the provided name will be used. The `name` field in this stanza
|
|
|
is required at all times.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
keystores:
|
|
|
description: Keystores configures additional keystore output formats
|
|
|
stored in the `secretName` Secret resource.
|
|
|
properties:
|
|
|
jks:
|
|
|
description: JKS configures options for storing a JKS keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables JKS keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.jks` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance.
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the JKS keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
pkcs12:
|
|
|
description: PKCS12 configures options for storing a PKCS12 keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables PKCS12 keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.p12` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance.
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the PKCS12 keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
type: object
|
|
|
privateKey:
|
|
|
description: Options to control private keys used for the Certificate.
|
|
|
properties:
|
|
|
algorithm:
|
|
|
description: Algorithm is the private key algorithm of the corresponding
|
|
|
private key for this certificate. If provided, allowed values
|
|
|
are either `RSA` or `ECDSA` If `algorithm` is specified and
|
|
|
`size` is not provided, key size of 256 will be used for `ECDSA`
|
|
|
key algorithm and key size of 2048 will be used for `RSA` key
|
|
|
algorithm.
|
|
|
enum:
|
|
|
- RSA
|
|
|
- ECDSA
|
|
|
type: string
|
|
|
encoding:
|
|
|
description: The private key cryptography standards (PKCS) encoding
|
|
|
for this certificate's private key to be encoded in. If provided,
|
|
|
allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and
|
|
|
PKCS#8, respectively. Defaults to `PKCS1` if not specified.
|
|
|
enum:
|
|
|
- PKCS1
|
|
|
- PKCS8
|
|
|
type: string
|
|
|
rotationPolicy:
|
|
|
description: RotationPolicy controls how private keys should be
|
|
|
regenerated when a re-issuance is being processed. If set to
|
|
|
Never, a private key will only be generated if one does not
|
|
|
already exist in the target `spec.secretName`. If one does exists
|
|
|
but it does not have the correct algorithm or size, a warning
|
|
|
will be raised to await user intervention. If set to Always,
|
|
|
a private key matching the specified requirements will be generated
|
|
|
whenever a re-issuance occurs. Default is 'Never' for backward
|
|
|
compatibility.
|
|
|
type: string
|
|
|
size:
|
|
|
description: Size is the key bit size of the corresponding private
|
|
|
key for this certificate. If `algorithm` is set to `RSA`, valid
|
|
|
values are `2048`, `4096` or `8192`, and will default to `2048`
|
|
|
if not specified. If `algorithm` is set to `ECDSA`, valid values
|
|
|
are `256`, `384` or `521`, and will default to `256` if not
|
|
|
specified. No other values are allowed.
|
|
|
type: integer
|
|
|
type: object
|
|
|
renewBefore:
|
|
|
description: The amount of time before the currently issued certificate's
|
|
|
`notAfter` time that cert-manager will begin to attempt to renew
|
|
|
the certificate. If this value is greater than the total duration
|
|
|
of the certificate (i.e. notAfter - notBefore), it will be automatically
|
|
|
renewed 2/3rds of the way through the certificate's duration.
|
|
|
type: string
|
|
|
secretName:
|
|
|
description: SecretName is the name of the secret resource that will
|
|
|
be automatically created and managed by this Certificate resource.
|
|
|
It will be populated with a private key and certificate, signed
|
|
|
by the denoted issuer.
|
|
|
type: string
|
|
|
subject:
|
|
|
description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
|
|
properties:
|
|
|
countries:
|
|
|
description: Countries to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
localities:
|
|
|
description: Cities to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizationalUnits:
|
|
|
description: Organizational Units to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizations:
|
|
|
description: Organizations to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
postalCodes:
|
|
|
description: Postal codes to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
provinces:
|
|
|
description: State/Provinces to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
serialNumber:
|
|
|
description: Serial number to be used on the Certificate.
|
|
|
type: string
|
|
|
streetAddresses:
|
|
|
description: Street addresses to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
type: object
|
|
|
uriSANs:
|
|
|
description: URISANs is a list of URI subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- issuerRef
|
|
|
- secretName
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the Certificate. This is set and managed automatically.
|
|
|
properties:
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of certificates.
|
|
|
Known condition types are `Ready` and `Issuing`.
|
|
|
items:
|
|
|
description: CertificateCondition contains condition information
|
|
|
for an Certificate.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`Issuing`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
lastFailureTime:
|
|
|
description: LastFailureTime is the time as recorded by the Certificate
|
|
|
controller of the most recent failure to complete a CertificateRequest
|
|
|
for this Certificate resource. If set, cert-manager will not re-request
|
|
|
another Certificate until 1 hour has elapsed from this time.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
nextPrivateKeySecretName:
|
|
|
description: The name of the Secret resource containing the private
|
|
|
key to be used for the next certificate iteration. The keymanager
|
|
|
controller will automatically set this field if the `Issuing` condition
|
|
|
is set to `True`. It will automatically unset this field when the
|
|
|
Issuing condition is not set or False.
|
|
|
type: string
|
|
|
notAfter:
|
|
|
description: The expiration time of the certificate stored in the
|
|
|
secret named by this resource in `spec.secretName`.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
notBefore:
|
|
|
description: The time after which the certificate stored in the secret
|
|
|
named by this resource in spec.secretName is valid.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
renewalTime:
|
|
|
description: RenewalTime is the time at which the certificate will
|
|
|
be next renewed. If not set, no upcoming renewal is scheduled.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
revision:
|
|
|
description: "The current 'revision' of the certificate as issued.
|
|
|
\n When a CertificateRequest resource is created, it will have the
|
|
|
`cert-manager.io/certificate-revision` set to one greater than the
|
|
|
current value of this field. \n Upon issuance, this field will be
|
|
|
set to the value of the annotation on the CertificateRequest resource
|
|
|
used to issue the certificate. \n Persisting the value on the CertificateRequest
|
|
|
resource allows the certificates controller to know whether a request
|
|
|
is part of an old issuance or if it is part of the ongoing revision's
|
|
|
issuance by checking if the revision value in the annotation is
|
|
|
greater than this field."
|
|
|
type: integer
|
|
|
type: object
|
|
|
required:
|
|
|
- spec
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: false
|
|
|
subresources:
|
|
|
status: {}
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
|
|
name: Ready
|
|
|
type: string
|
|
|
- jsonPath: .spec.secretName
|
|
|
name: Secret
|
|
|
type: string
|
|
|
- jsonPath: .spec.issuerRef.name
|
|
|
name: Issuer
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
|
|
name: Status
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: "A Certificate resource should be created to ensure an up to
|
|
|
date and signed x509 certificate is stored in the Kubernetes Secret resource
|
|
|
named in `spec.secretName`. \n The stored certificate will be renewed before
|
|
|
it expires (as configured by `spec.renewBefore`)."
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
description: Desired state of the Certificate resource.
|
|
|
properties:
|
|
|
commonName:
|
|
|
description: 'CommonName is a common name to be used on the Certificate.
|
|
|
The CommonName should have a length of 64 characters or fewer to
|
|
|
avoid generating invalid CSRs. This value is ignored by TLS clients
|
|
|
when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
|
|
type: string
|
|
|
dnsNames:
|
|
|
description: DNSNames is a list of DNS subjectAltNames to be set on
|
|
|
the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
duration:
|
|
|
description: The requested 'duration' (i.e. lifetime) of the Certificate.
|
|
|
This option may be ignored/overridden by some issuer types. If overridden
|
|
|
and `renewBefore` is greater than the actual certificate duration,
|
|
|
the certificate will be automatically renewed 2/3rds of the way
|
|
|
through the certificate's duration.
|
|
|
type: string
|
|
|
emailAddresses:
|
|
|
description: EmailAddresses is a list of email subjectAltNames to
|
|
|
be set on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
encodeUsagesInRequest:
|
|
|
description: EncodeUsagesInRequest controls whether key usages should
|
|
|
be present in the CertificateRequest
|
|
|
type: boolean
|
|
|
ipAddresses:
|
|
|
description: IPAddresses is a list of IP address subjectAltNames to
|
|
|
be set on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
isCA:
|
|
|
description: IsCA will mark this Certificate as valid for certificate
|
|
|
signing. This will automatically add the `cert sign` usage to the
|
|
|
list of `usages`.
|
|
|
type: boolean
|
|
|
issuerRef:
|
|
|
description: IssuerRef is a reference to the issuer for this certificate.
|
|
|
If the `kind` field is not set, or set to `Issuer`, an Issuer resource
|
|
|
with the given name in the same namespace as the Certificate will
|
|
|
be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer
|
|
|
with the provided name will be used. The `name` field in this stanza
|
|
|
is required at all times.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
keystores:
|
|
|
description: Keystores configures additional keystore output formats
|
|
|
stored in the `secretName` Secret resource.
|
|
|
properties:
|
|
|
jks:
|
|
|
description: JKS configures options for storing a JKS keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables JKS keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.jks` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance. A file named `truststore.jks`
|
|
|
will also be created in the target Secret resource, encrypted
|
|
|
using the password stored in `passwordSecretRef` containing
|
|
|
the issuing Certificate Authority
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the JKS keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
pkcs12:
|
|
|
description: PKCS12 configures options for storing a PKCS12 keystore
|
|
|
in the `spec.secretName` Secret resource.
|
|
|
properties:
|
|
|
create:
|
|
|
description: Create enables PKCS12 keystore creation for the
|
|
|
Certificate. If true, a file named `keystore.p12` will be
|
|
|
created in the target Secret resource, encrypted using the
|
|
|
password stored in `passwordSecretRef`. The keystore file
|
|
|
will only be updated upon re-issuance. A file named `truststore.p12`
|
|
|
will also be created in the target Secret resource, encrypted
|
|
|
using the password stored in `passwordSecretRef` containing
|
|
|
the issuing Certificate Authority
|
|
|
type: boolean
|
|
|
passwordSecretRef:
|
|
|
description: PasswordSecretRef is a reference to a key in
|
|
|
a Secret resource containing the password used to encrypt
|
|
|
the PKCS12 keystore.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this field
|
|
|
may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred to.
|
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- create
|
|
|
- passwordSecretRef
|
|
|
type: object
|
|
|
type: object
|
|
|
privateKey:
|
|
|
description: Options to control private keys used for the Certificate.
|
|
|
properties:
|
|
|
algorithm:
|
|
|
description: Algorithm is the private key algorithm of the corresponding
|
|
|
private key for this certificate. If provided, allowed values
|
|
|
are either `RSA` or `ECDSA` If `algorithm` is specified and
|
|
|
`size` is not provided, key size of 256 will be used for `ECDSA`
|
|
|
key algorithm and key size of 2048 will be used for `RSA` key
|
|
|
algorithm.
|
|
|
enum:
|
|
|
- RSA
|
|
|
- ECDSA
|
|
|
type: string
|
|
|
encoding:
|
|
|
description: The private key cryptography standards (PKCS) encoding
|
|
|
for this certificate's private key to be encoded in. If provided,
|
|
|
allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and
|
|
|
PKCS#8, respectively. Defaults to `PKCS1` if not specified.
|
|
|
enum:
|
|
|
- PKCS1
|
|
|
- PKCS8
|
|
|
type: string
|
|
|
rotationPolicy:
|
|
|
description: RotationPolicy controls how private keys should be
|
|
|
regenerated when a re-issuance is being processed. If set to
|
|
|
Never, a private key will only be generated if one does not
|
|
|
already exist in the target `spec.secretName`. If one does exists
|
|
|
but it does not have the correct algorithm or size, a warning
|
|
|
will be raised to await user intervention. If set to Always,
|
|
|
a private key matching the specified requirements will be generated
|
|
|
whenever a re-issuance occurs. Default is 'Never' for backward
|
|
|
compatibility.
|
|
|
type: string
|
|
|
size:
|
|
|
description: Size is the key bit size of the corresponding private
|
|
|
key for this certificate. If `algorithm` is set to `RSA`, valid
|
|
|
values are `2048`, `4096` or `8192`, and will default to `2048`
|
|
|
if not specified. If `algorithm` is set to `ECDSA`, valid values
|
|
|
are `256`, `384` or `521`, and will default to `256` if not
|
|
|
specified. No other values are allowed.
|
|
|
type: integer
|
|
|
type: object
|
|
|
renewBefore:
|
|
|
description: The amount of time before the currently issued certificate's
|
|
|
`notAfter` time that cert-manager will begin to attempt to renew
|
|
|
the certificate. If this value is greater than the total duration
|
|
|
of the certificate (i.e. notAfter - notBefore), it will be automatically
|
|
|
renewed 2/3rds of the way through the certificate's duration.
|
|
|
type: string
|
|
|
secretName:
|
|
|
description: SecretName is the name of the secret resource that will
|
|
|
be automatically created and managed by this Certificate resource.
|
|
|
It will be populated with a private key and certificate, signed
|
|
|
by the denoted issuer.
|
|
|
type: string
|
|
|
subject:
|
|
|
description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
|
|
properties:
|
|
|
countries:
|
|
|
description: Countries to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
localities:
|
|
|
description: Cities to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizationalUnits:
|
|
|
description: Organizational Units to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
organizations:
|
|
|
description: Organizations to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
postalCodes:
|
|
|
description: Postal codes to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
provinces:
|
|
|
description: State/Provinces to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
serialNumber:
|
|
|
description: Serial number to be used on the Certificate.
|
|
|
type: string
|
|
|
streetAddresses:
|
|
|
description: Street addresses to be used on the Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
type: object
|
|
|
uris:
|
|
|
description: URIs is a list of URI subjectAltNames to be set on the
|
|
|
Certificate.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
usages:
|
|
|
description: Usages is the set of x509 usages that are requested for
|
|
|
the certificate. Defaults to `digital signature` and `key encipherment`
|
|
|
if not specified.
|
|
|
items:
|
|
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
|
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
|
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
|
|
"content commitment", "key encipherment", "key agreement", "data
|
|
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
|
|
only", "any", "server auth", "client auth", "code signing", "email
|
|
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
|
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
|
|
sgc"'
|
|
|
enum:
|
|
|
- signing
|
|
|
- digital signature
|
|
|
- content commitment
|
|
|
- key encipherment
|
|
|
- key agreement
|
|
|
- data encipherment
|
|
|
- cert sign
|
|
|
- crl sign
|
|
|
- encipher only
|
|
|
- decipher only
|
|
|
- any
|
|
|
- server auth
|
|
|
- client auth
|
|
|
- code signing
|
|
|
- email protection
|
|
|
- s/mime
|
|
|
- ipsec end system
|
|
|
- ipsec tunnel
|
|
|
- ipsec user
|
|
|
- timestamping
|
|
|
- ocsp signing
|
|
|
- microsoft sgc
|
|
|
- netscape sgc
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- issuerRef
|
|
|
- secretName
|
|
|
type: object
|
|
|
status:
|
|
|
description: Status of the Certificate. This is set and managed automatically.
|
|
|
properties:
|
|
|
conditions:
|
|
|
description: List of status conditions to indicate the status of certificates.
|
|
|
Known condition types are `Ready` and `Issuing`.
|
|
|
items:
|
|
|
description: CertificateCondition contains condition information
|
|
|
for an Certificate.
|
|
|
properties:
|
|
|
lastTransitionTime:
|
|
|
description: LastTransitionTime is the timestamp corresponding
|
|
|
to the last status change of this condition.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
message:
|
|
|
description: Message is a human readable description of the
|
|
|
details of the last transition, complementing reason.
|
|
|
type: string
|
|
|
reason:
|
|
|
description: Reason is a brief machine readable explanation
|
|
|
for the condition's last transition.
|
|
|
type: string
|
|
|
status:
|
|
|
description: Status of the condition, one of (`True`, `False`,
|
|
|
`Unknown`).
|
|
|
enum:
|
|
|
- "True"
|
|
|
- "False"
|
|
|
- Unknown
|
|
|
type: string
|
|
|
type:
|
|
|
description: Type of the condition, known values are (`Ready`,
|
|
|
`Issuing`).
|
|
|
type: string
|
|
|
required:
|
|
|
- status
|
|
|
- type
|
|
|
type: object
|
|
|
type: array
|
|
|
lastFailureTime:
|
|
|
description: LastFailureTime is the time as recorded by the Certificate
|
|
|
controller of the most recent failure to complete a CertificateRequest
|
|
|
for this Certificate resource. If set, cert-manager will not re-request
|
|
|
another Certificate until 1 hour has elapsed from this time.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
nextPrivateKeySecretName:
|
|
|
description: The name of the Secret resource containing the private
|
|
|
key to be used for the next certificate iteration. The keymanager
|
|
|
controller will automatically set this field if the `Issuing` condition
|
|
|
is set to `True`. It will automatically unset this field when the
|
|
|
Issuing condition is not set or False.
|
|
|
type: string
|
|
|
notAfter:
|
|
|
description: The expiration time of the certificate stored in the
|
|
|
secret named by this resource in `spec.secretName`.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
notBefore:
|
|
|
description: The time after which the certificate stored in the secret
|
|
|
named by this resource in spec.secretName is valid.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
renewalTime:
|
|
|
description: RenewalTime is the time at which the certificate will
|
|
|
be next renewed. If not set, no upcoming renewal is scheduled.
|
|
|
format: date-time
|
|
|
type: string
|
|
|
revision:
|
|
|
description: "The current 'revision' of the certificate as issued.
|
|
|
\n When a CertificateRequest resource is created, it will have the
|
|
|
`cert-manager.io/certificate-revision` set to one greater than the
|
|
|
current value of this field. \n Upon issuance, this field will be
|
|
|
set to the value of the annotation on the CertificateRequest resource
|
|
|
used to issue the certificate. \n Persisting the value on the CertificateRequest
|
|
|
resource allows the certificates controller to know whether a request
|
|
|
is part of an old issuance or if it is part of the ongoing revision's
|
|
|
issuance by checking if the revision value in the annotation is
|
|
|
greater than this field."
|
|
|
type: integer
|
|
|
type: object
|
|
|
required:
|
|
|
- spec
|
|
|
type: object
|
|
|
served: true
|
|
|
storage: true
|
|
|
subresources:
|
|
|
status: {}
|
|
|
status:
|
|
|
acceptedNames:
|
|
|
kind: ""
|
|
|
plural: ""
|
|
|
conditions: []
|
|
|
storedVersions: []
|
|
|
---
|
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
|
kind: CustomResourceDefinition
|
|
|
metadata:
|
|
|
annotations:
|
|
|
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
|
|
|
labels:
|
|
|
app: cert-manager
|
|
|
app.kubernetes.io/instance: cert-manager
|
|
|
app.kubernetes.io/name: cert-manager
|
|
|
name: challenges.acme.cert-manager.io
|
|
|
spec:
|
|
|
conversion:
|
|
|
strategy: Webhook
|
|
|
webhook:
|
|
|
clientConfig:
|
|
|
service:
|
|
|
name: cert-manager-webhook
|
|
|
namespace: cert-manager
|
|
|
path: /convert
|
|
|
conversionReviewVersions:
|
|
|
- v1
|
|
|
- v1beta1
|
|
|
group: acme.cert-manager.io
|
|
|
names:
|
|
|
categories:
|
|
|
- cert-manager
|
|
|
- cert-manager-acme
|
|
|
kind: Challenge
|
|
|
listKind: ChallengeList
|
|
|
plural: challenges
|
|
|
singular: challenge
|
|
|
scope: Namespaced
|
|
|
versions:
|
|
|
- additionalPrinterColumns:
|
|
|
- jsonPath: .status.state
|
|
|
name: State
|
|
|
type: string
|
|
|
- jsonPath: .spec.dnsName
|
|
|
name: Domain
|
|
|
type: string
|
|
|
- jsonPath: .status.reason
|
|
|
name: Reason
|
|
|
priority: 1
|
|
|
type: string
|
|
|
- description: CreationTimestamp is a timestamp representing the server time when
|
|
|
this object was created. It is not guaranteed to be set in happens-before
|
|
|
order across separate operations. Clients may not set this value. It is represented
|
|
|
in RFC3339 form and is in UTC.
|
|
|
jsonPath: .metadata.creationTimestamp
|
|
|
name: Age
|
|
|
type: date
|
|
|
name: v1alpha2
|
|
|
schema:
|
|
|
openAPIV3Schema:
|
|
|
description: Challenge is a type to represent a Challenge request with an
|
|
|
ACME server
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
type: string
|
|
|
kind:
|
|
|
description: 'Kind is a string value representing the REST resource this
|
|
|
object represents. Servers may infer this from the endpoint the client
|
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
properties:
|
|
|
authzURL:
|
|
|
description: AuthzURL is the URL to the ACME Authorization resource
|
|
|
that this challenge is a part of.
|
|
|
type: string
|
|
|
dnsName:
|
|
|
description: DNSName is the identifier that this challenge is for,
|
|
|
e.g. example.com. If the requested DNSName is a 'wildcard', this
|
|
|
field MUST be set to the non-wildcard domain, e.g. for `*.example.com`,
|
|
|
it must be `example.com`.
|
|
|
type: string
|
|
|
issuerRef:
|
|
|
description: IssuerRef references a properly configured ACME-type
|
|
|
Issuer which should be used to create this Challenge. If the Issuer
|
|
|
does not exist, processing will be retried. If the Issuer is not
|
|
|
an 'ACME' Issuer, an error will be returned and the Challenge will
|
|
|
be marked as failed.
|
|
|
properties:
|
|
|
group:
|
|
|
description: Group of the resource being referred to.
|
|
|
type: string
|
|
|
kind:
|
|
|
description: Kind of the resource being referred to.
|
|
|
type: string
|
|
|
name:
|
|
|
description: Name of the resource being referred to.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
key:
|
|
|
description: 'Key is the ACME challenge key for this challenge For
|
|
|
HTTP01 challenges, this is the value that must be responded with
|
|
|
to complete the HTTP01 challenge in the format: `<private key JWK
|
|
|
thumbprint>.<key from acme server for challenge>`. For DNS01 challenges,
|
|
|
this is the base64 encoded SHA256 sum of the `<private key JWK thumbprint>.<key
|
|
|
from acme server for challenge>` text that must be set as the TXT
|
|
|
record content.'
|
|
|
type: string
|
|
|
solver:
|
|
|
description: Solver contains the domain solving configuration that
|
|
|
should be used to solve this challenge resource.
|
|
|
properties:
|
|
|
dns01:
|
|
|
description: Configures cert-manager to attempt to complete authorizations
|
|
|
by performing the DNS01 challenge flow.
|
|
|
properties:
|
|
|
acmedns:
|
|
|
description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns)
|
|
|
API to manage DNS01 challenge records.
|
|
|
properties:
|
|
|
accountSecretRef:
|
|
|
description: A reference to a specific 'key' within a
|
|
|
Secret resource. In some instances, `key` is a required
|
|
|
field.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
host:
|
|
|
type: string
|
|
|
required:
|
|
|
- accountSecretRef
|
|
|
- host
|
|
|
type: object
|
|
|
akamai:
|
|
|
description: Use the Akamai DNS zone management API to manage
|
|
|
DNS01 challenge records.
|
|
|
properties:
|
|
|
accessTokenSecretRef:
|
|
|
description: A reference to a specific 'key' within a
|
|
|
Secret resource. In some instances, `key` is a required
|
|
|
field.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
clientSecretSecretRef:
|
|
|
description: A reference to a specific 'key' within a
|
|
|
Secret resource. In some instances, `key` is a required
|
|
|
field.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
clientTokenSecretRef:
|
|
|
description: A reference to a specific 'key' within a
|
|
|
Secret resource. In some instances, `key` is a required
|
|
|
field.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
serviceConsumerDomain:
|
|
|
type: string
|
|
|
required:
|
|
|
- accessTokenSecretRef
|
|
|
- clientSecretSecretRef
|
|
|
- clientTokenSecretRef
|
|
|
- serviceConsumerDomain
|
|
|
type: object
|
|
|
azuredns:
|
|
|
description: Use the Microsoft Azure DNS API to manage DNS01
|
|
|
challenge records.
|
|
|
properties:
|
|
|
clientID:
|
|
|
description: if both this and ClientSecret are left unset
|
|
|
MSI will be used
|
|
|
type: string
|
|
|
clientSecretSecretRef:
|
|
|
description: if both this and ClientID are left unset
|
|
|
MSI will be used
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
environment:
|
|
|
enum:
|
|
|
- AzurePublicCloud
|
|
|
- AzureChinaCloud
|
|
|
- AzureGermanCloud
|
|
|
- AzureUSGovernmentCloud
|
|
|
type: string
|
|
|
hostedZoneName:
|
|
|
type: string
|
|
|
resourceGroupName:
|
|
|
type: string
|
|
|
subscriptionID:
|
|
|
type: string
|
|
|
tenantID:
|
|
|
description: when specifying ClientID and ClientSecret
|
|
|
then this field is also needed
|
|
|
type: string
|
|
|
required:
|
|
|
- resourceGroupName
|
|
|
- subscriptionID
|
|
|
type: object
|
|
|
clouddns:
|
|
|
description: Use the Google Cloud DNS API to manage DNS01
|
|
|
challenge records.
|
|
|
properties:
|
|
|
hostedZoneName:
|
|
|
description: HostedZoneName is an optional field that
|
|
|
tells cert-manager in which Cloud DNS zone the challenge
|
|
|
record has to be created. If left empty cert-manager
|
|
|
will automatically choose a zone.
|
|
|
type: string
|
|
|
project:
|
|
|
type: string
|
|
|
serviceAccountSecretRef:
|
|
|
description: A reference to a specific 'key' within a
|
|
|
Secret resource. In some instances, `key` is a required
|
|
|
field.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- project
|
|
|
type: object
|
|
|
cloudflare:
|
|
|
description: Use the Cloudflare API to manage DNS01 challenge
|
|
|
records.
|
|
|
properties:
|
|
|
apiKeySecretRef:
|
|
|
description: 'API key to use to authenticate with Cloudflare.
|
|
|
Note: using an API token to authenticate is now the
|
|
|
recommended method as it allows greater control of permissions.'
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
apiTokenSecretRef:
|
|
|
description: API token used to authenticate with Cloudflare.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
email:
|
|
|
description: Email of the account, only required when
|
|
|
using API key based authentication.
|
|
|
type: string
|
|
|
type: object
|
|
|
cnameStrategy:
|
|
|
description: CNAMEStrategy configures how the DNS01 provider
|
|
|
should handle CNAME records when found in DNS zones.
|
|
|
enum:
|
|
|
- None
|
|
|
- Follow
|
|
|
type: string
|
|
|
digitalocean:
|
|
|
description: Use the DigitalOcean DNS API to manage DNS01
|
|
|
challenge records.
|
|
|
properties:
|
|
|
tokenSecretRef:
|
|
|
description: A reference to a specific 'key' within a
|
|
|
Secret resource. In some instances, `key` is a required
|
|
|
field.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- tokenSecretRef
|
|
|
type: object
|
|
|
rfc2136:
|
|
|
description: Use RFC2136 ("Dynamic Updates in the Domain Name
|
|
|
System") (https://datatracker.ietf.org/doc/rfc2136/) to
|
|
|
manage DNS01 challenge records.
|
|
|
properties:
|
|
|
nameserver:
|
|
|
description: The IP address or hostname of an authoritative
|
|
|
DNS server supporting RFC2136 in the form host:port.
|
|
|
If the host is an IPv6 address it must be enclosed in
|
|
|
square brackets (e.g [2001:db8::1])Â ; port is optional.
|
|
|
This field is required.
|
|
|
type: string
|
|
|
tsigAlgorithm:
|
|
|
description: 'The TSIG Algorithm configured in the DNS
|
|
|
supporting RFC2136. Used only when ``tsigSecretSecretRef``
|
|
|
and ``tsigKeyName`` are defined. Supported values are
|
|
|
(case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``,
|
|
|
``HMACSHA256`` or ``HMACSHA512``.'
|
|
|
type: string
|
|
|
tsigKeyName:
|
|
|
description: The TSIG Key name configured in the DNS.
|
|
|
If ``tsigSecretSecretRef`` is defined, this field is
|
|
|
required.
|
|
|
type: string
|
|
|
tsigSecretSecretRef:
|
|
|
description: The name of the secret containing the TSIG
|
|
|
value. If ``tsigKeyName`` is defined, this field is
|
|
|
required.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- nameserver
|
|
|
type: object
|
|
|
route53:
|
|
|
description: Use the AWS Route53 API to manage DNS01 challenge
|
|
|
records.
|
|
|
properties:
|
|
|
accessKeyID:
|
|
|
description: 'The AccessKeyID is used for authentication.
|
|
|
If not set we fall-back to using env vars, shared credentials
|
|
|
file or AWS Instance metadata see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials'
|
|
|
type: string
|
|
|
hostedZoneID:
|
|
|
description: If set, the provider will manage only this
|
|
|
zone in Route53 and will not do an lookup using the
|
|
|
route53:ListHostedZonesByName api call.
|
|
|
type: string
|
|
|
region:
|
|
|
description: Always set the region when using AccessKeyID
|
|
|
and SecretAccessKey
|
|
|
type: string
|
|
|
role:
|
|
|
description: Role is a Role ARN which the Route53 provider
|
|
|
will assume using either the explicit credentials AccessKeyID/SecretAccessKey
|
|
|
or the inferred credentials from environment variables,
|
|
|
shared credentials file or AWS Instance metadata
|
|
|
type: string
|
|
|
secretAccessKeySecretRef:
|
|
|
description: The SecretAccessKey is used for authentication.
|
|
|
If not set we fall-back to using env vars, shared credentials
|
|
|
file or AWS Instance metadata https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
|
|
|
properties:
|
|
|
key:
|
|
|
description: The key of the entry in the Secret resource's
|
|
|
`data` field to be used. Some instances of this
|
|
|
field may be defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: 'Name of the resource being referred
|
|
|
to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
type: object
|
|
|
required:
|
|
|
- region
|
|
|
type: object
|
|
|
webhook:
|
|
|
description: Configure an external webhook based DNS01 challenge
|
|
|
solver to manage DNS01 challenge records.
|
|
|
properties:
|
|
|
config:
|
|
|
description: Additional configuration that should be passed
|
|
|
to the webhook apiserver when challenges are processed.
|
|
|
This can contain arbitrary JSON data. Secret values
|
|
|
should not be specified in this stanza. If secret values
|
|
|
are needed (e.g. credentials for a DNS service), you
|
|
|
should use a SecretKeySelector to reference a Secret
|
|
|
resource. For details on the schema of this field, consult
|
|
|
the webhook provider implementation's documentation.
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
groupName:
|
|
|
description: The API group name that should be used when
|
|
|
POSTing ChallengePayload resources to the webhook apiserver.
|
|
|
This should be the same as the GroupName specified in
|
|
|
the webhook provider implementation.
|
|
|
type: string
|
|
|
solverName:
|
|
|
description: The name of the solver to use, as defined
|
|
|
in the webhook provider implementation. This will typically
|
|
|
be the name of the provider, e.g. 'cloudflare'.
|
|
|
type: string
|
|
|
required:
|
|
|
- groupName
|
|
|
- solverName
|
|
|
type: object
|
|
|
type: object
|
|
|
http01:
|
|
|
description: Configures cert-manager to attempt to complete authorizations
|
|
|
by performing the HTTP01 challenge flow. It is not possible
|
|
|
to obtain certificates for wildcard domain names (e.g. `*.example.com`)
|
|
|
using the HTTP01 challenge mechanism.
|
|
|
properties:
|
|
|
ingress:
|
|
|
description: The ingress based HTTP01 challenge solver will
|
|
|
solve challenges by creating or modifying Ingress resources
|
|
|
in order to route requests for '/.well-known/acme-challenge/XYZ'
|
|
|
to 'challenge solver' pods that are provisioned by cert-manager
|
|
|
for each Challenge to be completed.
|
|
|
properties:
|
|
|
class:
|
|
|
description: The ingress class to use when creating Ingress
|
|
|
resources to solve ACME challenges that use this challenge
|
|
|
solver. Only one of 'class' or 'name' may be specified.
|
|
|
type: string
|
|
|
ingressTemplate:
|
|
|
description: Optional ingress template used to configure
|
|
|
the ACME challenge solver ingress used for HTTP01 challenges
|
|
|
properties:
|
|
|
metadata:
|
|
|
description: ObjectMeta overrides for the ingress
|
|
|
used to solve HTTP01 challenges. Only the 'labels'
|
|
|
and 'annotations' fields may be set. If labels or
|
|
|
annotations overlap with in-built values, the values
|
|
|
here will override the in-built values.
|
|
|
properties:
|
|
|
annotations:
|
|
|
additionalProperties:
|
|
|
type: string
|
|
|
description: Annotations that should be added
|
|
|
to the created ACME HTTP01 solver ingress.
|
|
|
type: object
|
|
|
labels:
|
|
|
additionalProperties:
|
|
|
type: string
|
|
|
description: Labels that should be added to the
|
|
|
created ACME HTTP01 solver ingress.
|
|
|
type: object
|
|
|
type: object
|
|
|
type: object
|
|
|
name:
|
|
|
description: The name of the ingress resource that should
|
|
|
have ACME challenge solving routes inserted into it
|
|
|
in order to solve HTTP01 challenges. This is typically
|
|
|
used in conjunction with ingress controllers like ingress-gce,
|
|
|
which maintains a 1:1 mapping between external IPs and
|
|
|
ingress resources.
|
|
|
type: string
|
|
|
podTemplate:
|
|
|
description: Optional pod template used to configure the
|
|
|
ACME challenge solver pods used for HTTP01 challenges
|
|
|
properties:
|
|
|
metadata:
|
|
|
description: ObjectMeta overrides for the pod used
|
|
|
to solve HTTP01 challenges. Only the 'labels' and
|
|
|
'annotations' fields may be set. If labels or annotations
|
|
|
overlap with in-built values, the values here will
|
|
|
override the in-built values.
|
|
|
properties:
|
|
|
annotations:
|
|
|
additionalProperties:
|
|
|
type: string
|
|
|
description: Annotations that should be added
|
|
|
to the create ACME HTTP01 solver pods.
|
|
|
type: object
|
|
|
labels:
|
|
|
additionalProperties:
|
|
|
type: string
|
|
|
description: Labels that should be added to the
|
|
|
created ACME HTTP01 solver pods.
|
|
|
type: object
|
|
|
type: object
|
|
|
spec:
|
|
|
description: PodSpec defines overrides for the HTTP01
|
|
|
challenge solver pod. Only the 'priorityClassName',
|
|
|
'nodeSelector', 'affinity', 'serviceAccountName'
|
|
|
and 'tolerations' fields are supported currently.
|
|
|
All other fields will be ignored.
|
|
|
properties:
|
|
|
affinity:
|
|
|
description: If specified, the pod's scheduling
|
|
|
constraints
|
|
|
properties:
|
|
|
nodeAffinity:
|
|
|
description: Describes node affinity scheduling
|
|
|
rules for the pod.
|
|
|
properties:
|
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
|
description: The scheduler will prefer
|
|
|
to schedule pods to nodes that satisfy
|
|
|
the affinity expressions specified by
|
|
|
this field, but it may choose a node
|
|
|
that violates one or more of the expressions.
|
|
|
The node that is most preferred is the
|
|
|
one with the greatest sum of weights,
|
|
|
i.e. for each node that meets all of
|
|
|
the scheduling requirements (resource
|
|
|
request, requiredDuringScheduling affinity
|
|
|
expressions, etc.), compute a sum by
|
|
|
iterating through the elements of this
|
|
|
field and adding "weight" to the sum
|
|
|
if the node matches the corresponding
|
|
|
matchExpressions; the node(s) with the
|
|
|
highest sum are the most preferred.
|
|
|
items:
|
|
|
description: An empty preferred scheduling
|
|
|
term matches all objects with implicit
|
|
|
weight 0 (i.e. it's a no-op). A null
|
|
|
preferred scheduling term matches
|
|
|
no objects (i.e. is also a no-op).
|
|
|
properties:
|
|
|
preference:
|
|
|
description: A node selector term,
|
|
|
associated with the corresponding
|
|
|
weight.
|
|
|
properties:
|
|
|
matchExpressions:
|
|
|
description: A list of node
|
|
|
selector requirements by node's
|
|
|
labels.
|
|
|
items:
|
|
|
description: A node selector
|
|
|
requirement is a selector
|
|
|
that contains values, a
|
|
|
key, and an operator that
|
|
|
relates the key and values.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The label
|
|
|
key that the selector
|
|
|
applies to.
|
|
|
type: string
|
|
|
operator:
|
|
|
description: Represents
|
|
|
a key's relationship
|
|
|
to a set of values.
|
|
|
Valid operators are
|
|
|
In, NotIn, Exists, DoesNotExist.
|
|
|
Gt, and Lt.
|
|
|
type: string
|
|
|
values:
|
|
|
description: An array
|
|
|
of string values. If
|
|
|
the operator is In or
|
|
|
NotIn, the values array
|
|
|
must be non-empty. If
|
|
|
the operator is Exists
|
|
|
or DoesNotExist, the
|
|
|
values array must be
|
|
|
empty. If the operator
|
|
|
is Gt or Lt, the values
|
|
|
array must have a single
|
|
|
element, which will
|
|
|
be interpreted as an
|
|
|
integer. This array
|
|
|
is replaced during a
|
|
|
strategic merge patch.
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
required:
|
|
|
- key
|
|
|
- operator
|
|
|
type: object
|
|
|
type: array
|
|
|
matchFields:
|
|
|
description: A list of node
|
|
|
selector requirements by node's
|
|
|
fields.
|
|
|
items:
|
|
|
description: A node selector
|
|
|
requirement is a selector
|
|
|
that contains values, a
|
|
|
key, and an operator that
|
|
|
relates the key and values.
|
|
|
properties:
|
|
|
key:
|
|
|
description: The label
|
|
|
key that the selector
|
|
|
applies to.
|