--- # Source: trust-manager/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount automountServiceAccountToken: true metadata: name: trust-manager namespace: default labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm --- # Source: trust-manager/templates/crd-trust.cert-manager.io_bundles.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: "bundles.trust.cert-manager.io" annotations: helm.sh/resource-policy: keep labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: group: trust.cert-manager.io names: kind: Bundle listKind: BundleList plural: bundles singular: bundle scope: Cluster versions: - additionalPrinterColumns: - description: Bundle ConfigMap Target Key jsonPath: .spec.target.configMap.key name: ConfigMap Target type: string - description: Bundle Secret Target Key jsonPath: .spec.target.secret.key name: Secret Target type: string - description: Bundle has been synced jsonPath: .status.conditions[?(@.type == "Synced")].status name: Synced type: string - description: Reason Bundle has Synced status jsonPath: .status.conditions[?(@.type == "Synced")].reason name: Reason type: string - description: Timestamp Bundle was created jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: spec represents the desired state of the Bundle resource. properties: sources: description: sources is a set of references to data whose data will sync to the target. items: description: |- BundleSource is the set of sources whose data will be appended and synced to the BundleTarget in all Namespaces. properties: configMap: description: |- configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a list of ConfigMap's `data` key(s) using label selector, in the trust namespace. properties: includeAllKeys: description: |- includeAllKeys is a flag to include all keys in the object's `data` field to be used. False by default. This field must not be true when `key` is set. type: boolean key: description: key of the entry in the object's `data` field to be used. maxLength: 253 minLength: 1 type: string name: description: |- name is the name of the source object in the trust namespace. This field must be left empty when `selector` is set maxLength: 253 minLength: 1 type: string selector: description: |- selector is the label selector to use to fetch a list of objects. Must not be set when `name` is set. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object x-kubernetes-map-type: atomic x-kubernetes-validations: - message: exactly one of the fields in [name selector] must be set rule: '[has(self.name),has(self.selector)].filter(x,x==true).size() == 1' inLine: description: inLine is a simple string to append as the source data. maxLength: 1048576 minLength: 1 type: string secret: description: |- secret is a reference (by name) to a Secret's `data` key(s), or to a list of Secret's `data` key(s) using label selector, in the trust namespace. properties: includeAllKeys: description: |- includeAllKeys is a flag to include all keys in the object's `data` field to be used. False by default. This field must not be true when `key` is set. type: boolean key: description: key of the entry in the object's `data` field to be used. maxLength: 253 minLength: 1 type: string name: description: |- name is the name of the source object in the trust namespace. This field must be left empty when `selector` is set maxLength: 253 minLength: 1 type: string selector: description: |- selector is the label selector to use to fetch a list of objects. Must not be set when `name` is set. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object x-kubernetes-map-type: atomic x-kubernetes-validations: - message: exactly one of the fields in [name selector] must be set rule: '[has(self.name),has(self.selector)].filter(x,x==true).size() == 1' useDefaultCAs: description: |- useDefaultCAs indicates whether the default CA bundle should be used as a source. The default CA bundle is available only if trust-manager was installed with default CA support enabled, either via the Helm chart or by starting the trust-manager controller with the "--default-package-location" flag. If default CA support was not enabled at startup, setting this field to true will result in reconciliation failure. The version of the default CA package used for this Bundle is reported in status.defaultCAVersion. type: boolean type: object x-kubernetes-map-type: atomic x-kubernetes-validations: - message: exactly one of the fields in [configMap secret inLine useDefaultCAs] must be set rule: '[has(self.configMap),has(self.secret),has(self.inLine),has(self.useDefaultCAs)].filter(x,x==true).size() == 1' maxItems: 100 minItems: 1 type: array x-kubernetes-list-type: atomic target: description: target is the target location in all namespaces to sync source data to. properties: additionalFormats: description: additionalFormats specifies any additional formats to write to the target properties: jks: description: |- jks requests a JKS-formatted binary trust bundle to be written to the target. The bundle has "changeit" as the default password. For more information refer to this link https://cert-manager.io/docs/faq/#keystore-passwords Format is deprecated: Writing JKS is subject for removal. Please migrate to PKCS12. PKCS#12 trust stores created by trust-manager are compatible with Java. minProperties: 1 properties: key: description: key is the key of the entry in the object's `data` field to be used. maxLength: 253 minLength: 1 type: string password: default: changeit description: password for JKS trust store maxLength: 128 minLength: 1 type: string required: - key type: object x-kubernetes-map-type: atomic pkcs12: description: |- pkcs12 requests a PKCS12-formatted binary trust bundle to be written to the target. The bundle is by default created without a password. For more information refer to this link https://cert-manager.io/docs/faq/#keystore-passwords minProperties: 1 properties: key: description: key is the key of the entry in the object's `data` field to be used. maxLength: 253 minLength: 1 type: string password: default: "" description: password for PKCS12 trust store maxLength: 128 minLength: 0 type: string profile: description: |- profile specifies the certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 trust store. If provided, allowed values are: `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g. because of company policy). Default value is `LegacyRC2` for backward compatibility. enum: - LegacyRC2 - LegacyDES - Modern2023 type: string required: - key type: object x-kubernetes-map-type: atomic type: object x-kubernetes-validations: - message: at least one of the fields in [jks pkcs12] must be set rule: '[has(self.jks),has(self.pkcs12)].filter(x,x==true).size() >= 1' configMap: description: |- configMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to. properties: key: description: key is the key of the entry in the object's `data` field to be used. maxLength: 253 minLength: 1 type: string metadata: description: metadata is an optional set of labels and annotations to be copied to the target. minProperties: 1 properties: annotations: additionalProperties: type: string description: annotations is a key value map to be copied to the target. minProperties: 1 type: object labels: additionalProperties: type: string description: labels is a key value map to be copied to the target. minProperties: 1 type: object type: object required: - key type: object namespaceSelector: description: |- namespaceSelector will, if set, only sync the target resource in Namespaces which match the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic secret: description: |- secret is the target Secret that all Bundle source data will be synced to. Using Secrets as targets is only supported if enabled at trust-manager startup. By default, trust-manager has no permissions for writing to secrets and can only read secrets in the trust namespace. properties: key: description: key is the key of the entry in the object's `data` field to be used. maxLength: 253 minLength: 1 type: string metadata: description: metadata is an optional set of labels and annotations to be copied to the target. minProperties: 1 properties: annotations: additionalProperties: type: string description: annotations is a key value map to be copied to the target. minProperties: 1 type: object labels: additionalProperties: type: string description: labels is a key value map to be copied to the target. minProperties: 1 type: object type: object required: - key type: object type: object x-kubernetes-validations: - message: at least one of the fields in [configMap secret] must be set rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size() >= 1' required: - sources type: object status: description: status of the Bundle. This is set and managed automatically. minProperties: 1 properties: conditions: description: conditions represent the latest available observations of the Bundle's current state. items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 10 minItems: 0 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map defaultCAVersion: description: |- defaultCAVersion is the version of the default CA package used when resolving the default CA source(s) for this Bundle (for example, when any source has useDefaultCAs set to true), if applicable. Bundles resolved from identical sets of default CA certificates will report the same defaultCAVersion value. maxLength: 253 minLength: 1 type: string type: object required: - spec type: object served: true storage: true subresources: status: {} --- # Source: trust-manager/templates/clusterrole.yaml kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm name: trust-manager rules: - apiGroups: - "trust.cert-manager.io" resources: - "bundles" verbs: ["get", "list", "watch"] # Permissions to update finalizers are required for trust-manager to work correctly # on OpenShift, even though we don't directly use finalizers at the time of writing - apiGroups: - "trust.cert-manager.io" resources: - "bundles/finalizers" verbs: ["update"] - apiGroups: - "trust.cert-manager.io" resources: - "bundles/status" verbs: ["patch"] - apiGroups: - "" resources: - "namespaces" verbs: ["get", "list", "watch"] - apiGroups: - "" resources: - "configmaps" verbs: ["get","list","create","patch","watch","delete"] - apiGroups: - "" - "events.k8s.io" resources: - "events" verbs: ["create","patch"] --- # Source: trust-manager/templates/clusterrolebinding.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm name: trust-manager roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: trust-manager subjects: - kind: ServiceAccount name: trust-manager namespace: default --- # Source: trust-manager/templates/role.yaml kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: trust-manager namespace: cert-manager labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm rules: - apiGroups: - "" resources: - "secrets" verbs: - "get" - "list" - "watch" --- # Source: trust-manager/templates/role.yaml kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: trust-manager:leaderelection namespace: default labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm rules: - apiGroups: - "coordination.k8s.io" resources: - "leases" verbs: - "get" - "create" - "update" - "watch" - "list" --- # Source: trust-manager/templates/rolebinding.yaml kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: trust-manager namespace: cert-manager labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: trust-manager subjects: - kind: ServiceAccount name: trust-manager namespace: default --- # Source: trust-manager/templates/rolebinding.yaml kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: trust-manager:leaderelection namespace: default labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: trust-manager:leaderelection subjects: - kind: ServiceAccount name: trust-manager namespace: default --- # Source: trust-manager/templates/metrics-service.yaml apiVersion: v1 kind: Service metadata: name: trust-manager-metrics namespace: default labels: app: trust-manager app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: type: ClusterIP ports: - port: 9402 targetPort: 9402 protocol: TCP name: metrics selector: app: trust-manager --- # Source: trust-manager/templates/webhook.yaml apiVersion: v1 kind: Service metadata: name: trust-manager namespace: default labels: app: trust-manager app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: type: ClusterIP ports: - port: 443 targetPort: 6443 protocol: TCP name: webhook selector: app: trust-manager --- # Source: trust-manager/templates/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: trust-manager namespace: default labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: trust-manager template: metadata: labels: app: trust-manager app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: serviceAccountName: trust-manager automountServiceAccountToken: true initContainers: - name: cert-manager-package-debian image: "quay.io/jetstack/trust-pkg-debian-bookworm:20230311-deb12u1.6" imagePullPolicy: IfNotPresent args: - "/copyandmaybepause" - "/debian-package" - "/packages" volumeMounts: - mountPath: /packages name: packages readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true seccompProfile: type: RuntimeDefault containers: - name: trust-manager image: "quay.io/jetstack/trust-manager:v0.22.1" imagePullPolicy: IfNotPresent ports: - containerPort: 6443 name: webhook # for the PodMonitor port field - containerPort: 9402 name: metrics # for the PodMonitor port field readinessProbe: httpGet: port: 6060 path: /readyz initialDelaySeconds: 3 periodSeconds: 7 args: - "--log-format=text" - "--log-level=1" - "--metrics-port=9402" - "--readiness-probe-port=6060" - "--readiness-probe-path=/readyz" - "--leader-elect=true" - "--leader-election-lease-duration=15s" - "--leader-election-renew-deadline=10s" # trust - "--trust-namespace=cert-manager" # webhook - "--webhook-host=0.0.0.0" - "--webhook-port=6443" - "--webhook-certificate-dir=/tls" - "--default-package-location=/packages/cert-manager-package-debian.json" volumeMounts: - mountPath: /tls name: tls readOnly: true - mountPath: /packages name: packages readOnly: true resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true seccompProfile: type: RuntimeDefault nodeSelector: kubernetes.io/os: linux volumes: - name: packages emptyDir: sizeLimit: 50M - name: tls secret: defaultMode: 420 secretName: trust-manager-tls --- # Source: trust-manager/templates/webhook.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: trust-manager labels: app: trust-manager app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm annotations: cert-manager.io/inject-ca-from: "default/trust-manager" webhooks: - name: trust.cert-manager.io rules: - apiGroups: - "trust.cert-manager.io" apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - bundles admissionReviewVersions: ["v1"] timeoutSeconds: 5 failurePolicy: Fail sideEffects: None clientConfig: service: name: trust-manager namespace: default path: /validate-trust-cert-manager-io-v1alpha1-bundle --- # Source: trust-manager/templates/certificate.yaml apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: trust-manager namespace: default labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: commonName: "trust-manager.default.svc" dnsNames: - "trust-manager.default.svc" secretName: trust-manager-tls privateKey: rotationPolicy: Always revisionHistoryLimit: 1 issuerRef: name: trust-manager kind: Issuer group: cert-manager.io --- # Source: trust-manager/templates/certificate.yaml apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: trust-manager namespace: default labels: app.kubernetes.io/name: trust-manager helm.sh/chart: trust-manager-v0.22.1 app.kubernetes.io/instance: trust-manager app.kubernetes.io/version: "v0.22.1" app.kubernetes.io/managed-by: Helm spec: selfSigned: {}