A Carvel package for cert-manager, a cloud-native solution to automatically provision and manage X.509 certificates in Kubernetes.
-
Kubernetes 1.28+
-
Carvel
kctrlCLI. -
Carvel kapp-controller deployed in your Kubernetes cluster. You can install it with Carvel
kapp(recommended choice) orkubectl.kapp deploy -a kapp-controller -y \ -f https://github.com/carvel-dev/kapp-controller/releases/latest/download/release.yml
Add the Kadras package repository to your Kubernetes cluster:
kctrl package repository add -r kadras-packages \
--url ghcr.io/kadras-io/kadras-packages \
-n kadras-system --create-namespaceInstallation without package repository
The recommended way of installing the cert-manager package is via the Kadras package repository. If you prefer not using the repository, you can add the package definition directly usingkapp or kubectl.
kubectl create namespace kadras-system
kapp deploy -a cert-manager-package -n kadras-system -y \
-f https://github.com/kadras-io/package-for-cert-manager/releases/latest/download/metadata.yml \
-f https://github.com/kadras-io/package-for-cert-manager/releases/latest/download/package.ymlInstall the cert-manager package:
kctrl package install -i cert-manager \
-p cert-manager.packages.kadras.io \
-v ${VERSION} \
-n kadras-systemNote You can find the
${VERSION}value by retrieving the list of package versions available in the Kadras package repository installed on your cluster.kctrl package available list -p cert-manager.packages.kadras.io -n kadras-system
Verify the installed packages and their status:
kctrl package installed list -n kadras-systemDocumentation, tutorials and examples for this package are available in the docs folder. For documentation specific to cert-manager, check out cert-manager.io.
The cert-manager package can be customized via a values.yml file.
letsencrypt:
include: true
production: true
email: [email protected]Reference the values.yml file from the kctrl command when installing or upgrading the package.
kctrl package install -i cert-manager \
-p cert-manager.packages.kadras.io \
-v ${VERSION} \
-n kadras-system \
--values-file values.ymlThe cert-manager package has the following configurable properties.
Configurable properties
| Config | Default | Description |
|---|---|---|
namespace |
cert-manager |
The namespace in which to deploy cert-manager. |
policies.include |
false |
Whether to include the out-of-the-box Kyverno policies to validate and secure the package installation. |
Settings for the corporate proxy.
| Config | Default | Description |
|---|---|---|
proxy.http_proxy |
"" |
The HTTPS proxy to use for network traffic. |
proxy.https_proxy |
"" |
The HTTP proxy to use for network traffic. |
proxy.no_proxy |
"" |
A comma-separated list of hostnames, IP addresses, or IP ranges in CIDR format that should not use the proxy. |
Settings for the cert-manager controller.
| Config | Default | Description |
|---|---|---|
controller.loglevel |
2 |
Number of the log level verbosity. |
controller.replicas |
1 |
The number of replicas. In order to enable high availability, 2 replicas are recommended. |
Settings for the cert-manager cainjector.
| Config | Default | Description |
|---|---|---|
cainjector.loglevel |
2 |
Number of the log level verbosity. |
cainjector.replicas |
1 |
The number of replicas. In order to enable high availability, 2 replicas are recommended. |
Settings for the cert-manager webhook.
| Config | Default | Description |
|---|---|---|
webhook.loglevel |
2 |
Number of the log level verbosity. |
webhook.replicas |
1 |
The number of replicas. In order to enable high availability, at least 3 replicas are recommended. |
webhook.host_network |
false |
Whether to run the webhook in the host network so that it can be reached by the cert-manager controller in environments like AWS EKS. More information: https://cert-manager.io/docs/installation/compatibility. |
webhook.secure_port |
6443 |
The port where the webhook is exposed. The default port needs changing in environments like AWS EKS and AWS Fargate. More information: https://cert-manager.io/docs/installation/compatibility. |
Leader election configuration for the cert-manager controller and cainjector Deployments.
| Config | Default | Description |
|---|---|---|
leader_election.namespace |
kube-system |
Namespace used to perform leader election. The default namespace needs changing in environments like GKE. More information: https://cert-manager.io/docs/installation/compatibility. |
Issues configuration.
| Config | Default | Description |
|---|---|---|
private_pki.include |
true |
Whether to include a ClusterIssuer for a private PKI. |
letsencrypt.include |
false |
Whether to include a ClusterIssuer for Let's Encrypt. |
letsencrypt.production |
false |
Whether to use Let's Encrypt staging (recommended for non-production environments) or production. |
letsencrypt.email |
"" |
The email address that Let's Encrypt will use to send info on expiring certificates or other issues. |
letsencrypt.challenge.type |
http01 |
The type of challenge used by the ACME CA Server. Valid options: http01, dns01. |
letsencrypt.challenge.secret.name |
"" |
Name of the Secret containing the credentials needed for the dns01 challenge. |
letsencrypt.challenge.secret.key |
"" |
The key within the Secret that contains the credentials needed for the dns01 challenge. |
letsencrypt.challenge.secret.namespace |
"" |
Namespace containing the Secret with the credentials needed for the dns01 challenge. |
letsencrypt.challenge.dns_provider |
http01 |
The DNS provider to use for the ACME dns01 challenge. Valid options: digital_ocean. |
The security process for reporting vulnerabilities is described in SECURITY.md.
This project is licensed under the Apache License 2.0. See LICENSE for more information.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent