aws-privateca-issuer

# +docs:section=AWS Private CA Issuer

# Number of replicas to run of the issuer

replicaCount: 2

image:

# Image repository

repository: cgr.dev/chainguard-private/aws-privateca-issuer

# Image pull policy

pullPolicy: IfNotPresent

# Image tag

tag: 1.12.0-r0@sha256:3fdf92a23ff61766826cb906221aa33199371c2cd8122a2ce7f61bedb6a1e8e9

# Disable waiting for CertificateRequests to be Approved before signing

disableApprovedCheck: false

# Disables Kubernetes client-side rate limiting (only use if API Priority & Fairness is enabled on the cluster).

disableClientSideRateLimiting: false

# Stops AWSPCAClusterIssuers that set neither `secretRef` nor `serviceAccountRef` from using the controller's own AWS credentials (IRSA, EKS Pod Identity, instance profile).

disableClusterIssuerAmbientCredentials: false

# Lets AWSPCAIssuers that set neither `secretRef` nor `serviceAccountRef` use the controller's own AWS credentials.

# Enabling this lets anyone who can create an AWSPCAIssuer in any namespace issue certificates using the controller's IAM identity.

enableIssuerAmbientCredentials: false

# Optional secrets used for pulling the container image

#

# For example:

# imagePullSecrets:

# - name: secret-name

imagePullSecrets: []

# Override the name of the objects created by this chart

nameOverride: ""

# Override the name of the objects created by this chart

fullnameOverride: ""

# Number deployment revisions to keep

revisionHistoryLimit: 10

serviceAccount:

# Specifies whether a service account should be created

create: true

# Annotations to add to the service account

annotations: {}

# The name of the service account to use.

# If not set and create is true, a name is generated using the fullname template

name: ""

rbac:

# Specifies whether RBAC should be created

create: true

service:

# Type of service to create

type: ClusterIP

# Port the service should listen on

port: 8080

# Annotations to add to the issuer Deployment

deploymentAnnotations: {}

# Annotations to add to the issuer Pod

podAnnotations: {}

# Pod security context

# +docs:property

podSecurityContext:

runAsUser: 65532

# Container security context

# +docs:property

securityContext:

allowPrivilegeEscalation: false

# Kubernetes pod resources requests/limits

#+docs:property

resources:

limits:

cpu: 50m

memory: 64Mi

requests:

cpu: 50m

memory: 64Mi

# Kubernetes node selector: node labels for pod assignment

nodeSelector: {}

# Kubernetes pod tolerations for cert-manager-csi-driver

#

# For example:

# tolerations:

# - operator: "Exists"

tolerations: []

# A Kubernetes Affinity; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core

#

# For example:

# affinity:

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: foo.bar.com/role

# operator: In

# values:

# - master

#+docs:property

affinity:

nodeAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

nodeSelectorTerms:

- matchExpressions:

- key: kubernetes.io/os

operator: In

values:

- linux

- key: kubernetes.io/arch

operator: In

values:

- amd64

- arm64

podAntiAffinity:

preferredDuringSchedulingIgnoredDuringExecution:

- podAffinityTerm:

labelSelector:

matchExpressions:

- key: app.kubernetes.io/name

operator: In

values:

- aws-privateca-issuer

topologyKey: kubernetes.io/hostname

weight: 100

# List of Kubernetes TopologySpreadConstraints; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core

#+docs:property

topologySpreadConstraints:

- maxSkew: 1

topologyKey: topology.kubernetes.io/zone

whenUnsatisfiable: ScheduleAnyway

labelSelector:

matchLabels:

app.kubernetes.io/name: aws-privateca-issuer

# Priority class name for the issuer pods

# If specified, this will set the priority class on pods, which can influence scheduling decisions

#

# For example:

# priorityClassName: high-priority

priorityClassName: ""

# Additional environment variables to set in the Pod

# +docs:type=object

env:

# Additional labels to add to the Pod

podLabels: {}

# Additional volumes on the operator container.

volumes: []

# Additional VolumeMounts on the operator container.

volumeMounts: []

# Extra containers to add to the pod spec in the deployment.

extraContainers: []

# Configures a disruption budget for the deployment.

#

# Expects input structure similar to https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#poddisruptionbudgetspec-v1-policy

# WITHOUT the pod selector, which is handled by the chart.

# Per https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#poddisruptionbudgetspec-v1-policy, `maxUnavailable` is mutually

# exclusive with `minAvailable`, you cannot set both.

#

# For example:

# podDisruptionBudget:

# maxUnavailable: 1

#

# Or:

# podDisruptionBudget:

# minAvailable: 1

#

# But NOT:

# podDisruptionBudget:

# minAvailable: 1

# maxUnavailable: 1

podDisruptionBudget:

maxUnavailable: 1

# +docs:section=Autoscaling

autoscaling:

# Enable auto scaling using a HorizontalPodAutoscaler

enabled: false

# Minimum number of replicas to deploy

minReplicas: 1

# Maximum number of replicas to deploy

maxReplicas: 100

# CPU threshold to scale at as a percentage of the requested CPUs

targetCPUUtilizationPercentage: 80

# Memory threshold to scale at as a percentage of the requested memory

# +docs:property

# targetMemoryUtilizationPercentage: 80

# +docs:section=Approver Role

# Options for configuring a target ServiceAccount with the role to approve

# all awspca.cert-manager.io requests.

approverRole:

# Create the ClusterRole to allow the issuer to approve certificate requests

enabled: true

# Service account give approval permission

serviceAccountName: cert-manager

# Namespace the service account resides in

namespace: cert-manager

# +docs:section=Monitoring

serviceMonitor:

# Create Prometheus ServiceMonitor

create: false

# Annotations to add to the Prometheus ServiceMonitor

annotations: {}

# Labels to add to the Prometheus ServiceMonitor

labels: {}