cert-manager-istio-csr
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# nameOverride replaces the name of the chart in the Chart.yaml file when this
2
# is used to construct Kubernetes object names.
3
# +docs:property
4
# nameOverride: istio-csr
5
6
# The number of replicas of istio-csr to run.
7
replicaCount: 1
8
# The container registry used for istio-csr images by default.
9
# This can include path prefixes (e.g. "artifactory.example.com/docker").
10
# +docs:property
11
imageRegistry: quay.io
12
# The repository namespace used for istio-csr images by default.
13
# Examples:
14
# - jetstack
15
# - cert-manager
16
# +docs:property
17
imageNamespace: jetstack
18
image:
19
# Target image registry. This value is prepended to the target image repository, if set.
20
# For example:
21
# registry: quay.io
22
# repository: jetstack/cert-manager-istio-csr
23
# Deprecated: per-component registry prefix.
24
#
25
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
26
# This applies both when `image.repository` is set and when the repository is computed from
27
# `imageRegistry` + `imageNamespace` + `image.name`.
28
#
29
# This can produce "double registry" style references such as
30
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
31
# `imageRegistry`/`imageNamespace` values.
32
# +docs:property
33
# registry: quay.io
34
35
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
36
# and `image.name`).
37
# Example: quay.io/jetstack/cert-manager-istio-csr
38
# +docs:property
39
repository: cgr.dev/chainguard-private/cert-manager-istio-csr
40
# The image name for istio-csr.
41
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full
42
# image reference.
43
# +docs:property
44
name: cert-manager-istio-csr
45
# Override the image tag to deploy by setting this variable.
46
# If no value is set, the chart's appVersion is used.
47
# +docs:property
48
# tag: vX.Y.Z
49
50
# Target image digest. Override any tag, if set.
51
# For example:
52
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
53
# +docs:property
54
# digest: sha256:...
55
56
# Kubernetes imagePullPolicy on Deployment.
57
pullPolicy: IfNotPresent
58
tag: 0.17.0
59
digest: sha256:bcb019990217706c49429ea9b1c8e23b7e4d3eee0c2b158e6b65066fe123b3aa
60
# Optional secrets used for pulling the istio-csr container image.
61
imagePullSecrets: []
62
service:
63
# Service type to expose the istio-csr gRPC service.
64
type: ClusterIP
65
# Service port to expose the istio-csr gRPC service.
66
port: 443
67
# Service nodePort to expose the istio-csr gRPC service.
68
# +docs:type=number
69
# +docs:property
70
# nodePort:
71
app:
72
# Verbosity of istio-csr logging.
73
logLevel: 1 # 1-5
74
# Output format of istio-csr logging.
75
logFormat: text # text or json
76
metrics:
77
# Port for exposing Prometheus metrics on 0.0.0.0 on path '/metrics'.
78
port: 9402
79
# Service to expose metrics endpoint.
80
service:
81
# Create a Service resource to expose the metrics endpoint.
82
enabled: true
83
# Service type to expose metrics.
84
type: ClusterIP
85
# The ServiceMonitor resource for this Service.
86
servicemonitor:
87
# Create a Prometheus ServiceMonitor resource.
88
enabled: false
89
# The value for the "prometheus" label on the ServiceMonitor. This allows
90
# for multiple Prometheus instances selecting different ServiceMonitors
91
# using label selectors.
92
prometheusInstance: default
93
# The interval at which Prometheus will scrape for metrics.
94
interval: 10s
95
# The timeout on each metric probe request.
96
scrapeTimeout: 5s
97
# Additional labels to give the ServiceMonitor resource.
98
labels: {}
99
# DEPRECATED: moved to app.runtimeConfiguration.name
100
#
101
# Name of a ConfigMap in the installation namespace to watch, providing
102
# runtime configuration of an issuer to use.
103
#
104
# The "issuer-name", "issuer-kind" and "issuer-group" keys must be present in
105
# the ConfigMap for it to be used.
106
#
107
# +docs:hidden
108
runtimeIssuanceConfigMap: ""
109
runtimeConfiguration:
110
# Create the runtime-configuration ConfigMap.
111
create: false
112
# Name of a ConfigMap in the installation namespace to watch, providing
113
# runtime configuration of an issuer to use.
114
#
115
# If create is set to true, then this name is used to create the ConfigMap,
116
# otherwise the ConfigMap must exist, and the "issuer-name", "issuer-kind"
117
# and "issuer-group" keys must be present in it.
118
name: ""
119
issuer:
120
# Issuer name set on created CertificateRequests for both istio-csr's
121
# serving certificate and incoming gRPC CSRs.
122
name: istio-ca
123
# Issuer kind set on created CertificateRequests for both istio-csr's
124
# serving certificate and incoming gRPC CSRs.
125
kind: Issuer
126
# Issuer group name set on created CertificateRequests for both
127
# istio-csr's serving certificate and incoming gRPC CSRs.
128
group: cert-manager.io
129
readinessProbe:
130
# Container port to expose the istio-csr HTTP readiness probe on the default network interface.
131
port: 6060
132
# Path to expose the istio-csr HTTP readiness probe on the default network interface.
133
path: "/readyz"
134
certmanager:
135
# Namespace to create CertificateRequests for both istio-csr's serving
136
# certificate and incoming gRPC CSRs.
137
namespace: istio-system
138
# Don't delete created CertificateRequests once they have been signed.
139
# WARNING: Do not enable this option in production, or environments with
140
# any non-trivial number of workloads for an extended period of time. Doing
141
# so will balloon the resource consumption of both ETCD and the API server,
142
# leading to errors and slow down. This option is intended for debugging
143
# purposes only, for limited periods of time.
144
preserveCertificateRequests: false
145
# Additional annotations to include on certificate requests.
146
# Takes key/value pairs in the format:
147
# additionalAnnotations:
148
# - name: custom.cert-manager.io/policy-name
149
# value: istio-csr
150
additionalAnnotations: []
151
issuer:
152
# Enable the default issuer, this is the issuer used when no runtime
153
# configuration is provided.
154
#
155
# When enabled, the istio-csr Pod will not be "Ready" until the issuer
156
# has been used to issue the istio-csr GRPC certificate.
157
#
158
# For istio-csr to function, either this or runtime configuration must be
159
# enabled.
160
enabled: true
161
# Issuer name set on created CertificateRequests for both istio-csr's
162
# serving certificate and incoming gRPC CSRs.
163
name: istio-ca
164
# Issuer kind set on created CertificateRequests for both istio-csr's
165
# serving certificate and incoming gRPC CSRs.
166
kind: Issuer
167
# Issuer group name set on created CertificateRequests for both
168
# istio-csr's serving certificate and incoming gRPC CSRs.
169
group: cert-manager.io
170
tls:
171
# The Istio cluster's trust domain.
172
trustDomain: "cluster.local"
173
# An optional file location to a PEM encoded root CA that the root CA
174
# ConfigMap in all namespaces will be populated with. If empty, the CA
175
# returned from cert-manager for the serving certificate will be used.
176
rootCAFile: # /var/certs/ca.pem
177
# The DNS names to request for the server's serving certificate which is
178
# presented to istio-agents. istio-agents must route to istio-csr using one
179
# of these DNS names.
180
certificateDNSNames:
181
- cert-manager-istio-csr.cert-manager.svc
182
# Requested duration of the gRPC serving certificate. Will be automatically
183
# renewed.
184
# Based on [NIST 800-204A recommendations (SM-DR13)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-204A.pdf).
185
certificateDuration: 1h
186
# Minimum TLS version for the gRPC serving listener (Kubernetes-style name, e.g. VersionTLS12).
187
# If unset, TLS 1.2 is used but a future version will increase the default.
188
# +docs:property
189
# servingTLSMinVersion: VersionTLS12
190
191
# Cipher suites for the gRPC serving listener (TLS_CIPHER_SUITE names). If empty, Go defaults apply.
192
# Only affects TLS 1.2; TLS 1.3 cipher suites are not configurable in Go.
193
# Acceptable names match Kubernetes component-base (same as kube-apiserver --tls-cipher-suites);
194
# see [TLSCipherPossibleValues](https://pkg.go.dev/k8s.io/component-base/cli/flag#TLSCipherPossibleValues).
195
# Some listed values are considered insecure — prefer [PreferredTLSCipherNames](https://pkg.go.dev/k8s.io/component-base/cli/flag#PreferredTLSCipherNames).
196
# +docs:property
197
servingTLSCipherSuites: []
198
# TLS key exchange curves for the gRPC listener (e.g. X25519, CurveP256, or decimal CurveID). If empty, Go defaults apply.
199
# +docs:property
200
servingTLSCurvePreferences: []
201
# If true, create the istiod certificate using a cert-manager certificate as part
202
# of the install. If set to "dynamic", will create the cert dynamically when
203
# istio-csr pods start up. If false, no cert is created.
204
# +docs:type=boolean,string,null
205
istiodCertificateEnable: true
206
# Requested duration of istio's Certificate. Will be automatically renewed.
207
# Default is based on [NIST 800-204A recommendations (SM-DR13)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-204A.pdf).
208
# Warning: cert-manager does not allow a duration on Certificates less than 1 hour.
209
istiodCertificateDuration: 1h
210
# Amount of time to wait before trying to renew the istiod certificate.
211
# Must be smaller than the certificate's duration.
212
istiodCertificateRenewBefore: 30m
213
# Private key algorithm to use. For backwards compatibility, defaults to the same value as app.server.serving.signatureAlgorithm
214
istiodPrivateKeyAlgorithm: ""
215
# Parameter for the istiod certificate key. For RSA, must be a number of bits >= 2048. For ECDSA, can only be 256 or 384, corresponding to P-256 and P-384 respectively.
216
istiodPrivateKeySize: 2048
217
# Provide additional DNS names to request on the istiod certificate. Useful if istiod
218
# should be accessible via multiple DNS names and/or outside of the cluster.
219
istiodAdditionalDNSNames: []
220
server:
221
authenticators:
222
# Enable the client certificate authenticator. This will allow workloads to use preexisting certificates to
223
# authenticate with istio-csr when rotating their certificate.
224
enableClientCert: false
225
# The istio cluster ID to verify incoming CSRs.
226
clusterID: "Kubernetes"
227
# Maximum validity duration that can be requested for a certificate.
228
# istio-csr will request a duration of the smaller of this value, and that of
229
# the incoming gRPC CSR.
230
# Based on [NIST 800-204A recommendations (SM-DR13)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-204A.pdf).
231
maxCertificateDuration: 1h
232
serving:
233
# Container address to serve the istio-csr gRPC service.
234
address: 0.0.0.0
235
# Container port to serve the istio-csr gRPC service.
236
port: 6443
237
# Parameter for the serving certificate key. For RSA, must be a number of bits >= 2048. For ECDSA, can only be 256 or 384, corresponding to P-256 and P-384 respectively.
238
certificateKeySize: 2048
239
# The type of private key to generate for the serving certificate. Only RSA (default) and ECDSA are supported.
240
# NB: This variable is named incorrectly; it controls private key algorithm, not signature algorithm.
241
signatureAlgorithm: "RSA"
242
# A comma-separated list of service accounts that are allowed to use node authentication for CSRs, e.g. "istio-system/ztunnel".
243
caTrustedNodeAccounts: ""
244
istio:
245
# The istio revisions that are currently installed in the cluster.
246
# Changing this field will modify the DNS names that will be requested for
247
# the istiod certificate (if enabled).
248
# The common name for the istiod certificate is hard coded to the `default` revision
249
# DNS name.
250
# Some issuers may require that the common name on certificates match one
251
# of the DNS names. If 1. Your issuer has this constraint, and 2. You are
252
# not using `default` as a revision, add the `default` revision here
253
# anyway. The resulting certificate will include a DNS name that won't be
254
# used, but will pass this constraint.
255
revisions: ["default"]
256
# The namespace where the istio control-plane is running.
257
namespace: istio-system
258
controller:
259
leaderElectionNamespace: istio-system
260
# If set, limit where istio-csr creates configmaps with root CA certificates. If unset, configmap created in ALL namespaces.
261
# Example: maistra.io/member-of=istio-system
262
# +docs:type=string
263
# +docs:property
264
# configmapNamespaceSelector:
265
266
# Allows you to disable the default Kubernetes client rate limiter if
267
# istio-csr is exceeding the default QPS (5) and Burst (10) limits.
268
# For example, in large clusters with many Istio workloads, restarting the Pods may cause
269
# istio-csr to send bursts of Kubernetes API requests that exceed the limits of
270
# the default Kubernetes client rate limiter, and istio-csr will become slow to issue
271
# certificates for your workloads.
272
# Only disable client rate limiting if the Kubernetes API server supports
273
# [API Priority and Fairness](https://kubernetes.io/docs/concepts/cluster-administration/flow-control/),
274
# to avoid overloading the server.
275
disableKubernetesClientRateLimiter: false
276
# Maximum number of concurrent reconciles that the controller executes with. Defaults to 1.
277
# Example: 4
278
# +docs:type=number
279
# +docs:property
280
# maxConcurrentReconciles:
281
# Optional extra labels for deployment.
282
deploymentLabels: {}
283
# Optional extra annotations for deployment.
284
deploymentAnnotations: {}
285
# Optional extra labels for pod.
286
podLabels: {}
287
# Optional extra annotations for pod.
288
podAnnotations: {}
289
# Optional extra volumes. Useful for mounting custom root CAs.
290
#
291
# For example:
292
# volumes:
293
# - name: root-ca
294
# secret:
295
# secretName: root-cert
296
volumes: []
297
# Optional extra volume mounts. Useful for mounting custom root CAs.
298
#
299
# For example:
300
# volumeMounts:
301
# - name: root-ca
302
# mountPath: /etc/tls
303
volumeMounts: []
304
# Kubernetes [pod resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
305
#
306
# For example:
307
# resources:
308
# limits:
309
# cpu: 100m
310
# memory: 128Mi
311
# requests:
312
# cpu: 100m
313
# memory: 128Mi
314
resources: {}
315
# Configure the priority class of the pod. For more information, see [PriorityClass](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass).
316
priorityClassName: ""
317
# Kubernetes [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
318
#
319
# See the default values for an example.
320
# +docs:property
321
securityContext:
322
allowPrivilegeEscalation: false
323
readOnlyRootFilesystem: true
324
runAsNonRoot: true
325
capabilities:
326
drop:
327
- ALL
328
seccompProfile:
329
type: RuntimeDefault
330
# Expects input structure as per [specification](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core).
331
#
332
# For example:
333
# affinity:
334
# nodeAffinity:
335
# requiredDuringSchedulingIgnoredDuringExecution:
336
# nodeSelectorTerms:
337
# - matchExpressions:
338
# - key: foo.bar.com/role
339
# operator: In
340
# values:
341
# - master
342
affinity: {}
343
# Expects input structure as per [specification](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core).
344
#
345
# For example:
346
# tolerations:
347
# - key: foo.bar.com/role
348
# operator: Equal
349
# value: master
350
# effect: NoSchedule
351
tolerations: []
352
# List of Kubernetes TopologySpreadConstraints. For more information, see [TopologySpreadConstraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
353
# For example:
354
# topologySpreadConstraints:
355
# - maxSkew: 2
356
# topologyKey: topology.kubernetes.io/zone
357
# whenUnsatisfiable: ScheduleAnyway
358
# labelSelector:
359
# matchLabels:
360
# app.kubernetes.io/name: cert-manager-istio-csr
361
# app.kubernetes.io/instance: istio-csr
362
topologySpreadConstraints: []
363
# Kubernetes node selector: node labels for pod assignment.
364
# +docs:property=nodeSelector
365
nodeSelector:
366
kubernetes.io/os: linux
367
# Labels to apply to all resources.
368
commonLabels: {}
369
# Create resources alongside installing istio-csr, via Helm values. Can accept an array of YAML-formatted
370
# resources. Each array entry can include multiple YAML documents, separated by '---'.
371
#
372
# For example:
373
# extraObjects:
374
# - |
375
# apiVersion: v1
376
# kind: ConfigMap
377
# metadata:
378
# name: '{{ template "cert-manager-istio-csr.fullname" . }}-extra-configmap'
379
extraObjects: []
380
# Configures a disruption budget for istio-csr.
381
podDisruptionBudget:
382
# Enable or disable the PodDisruptionBudget resource for istio-csr.
383
enabled: false
384
# This configures the minimum available pods for disruptions. It can either be set to
385
# an integer (e.g., 1) or a percentage value (e.g., 25%).
386
# It cannot be used if `maxUnavailable` is set.
387
# +docs:property
388
# +docs:type=string,integer
389
# minAvailable: 0
390
391
# This configures the maximum unavailable pods for disruptions. It can either be set to
392
# an integer (e.g., 1) or a percentage value (e.g., 25%).
393
# it cannot be used if `minAvailable` is set.
394
# +docs:property
395
# +docs:type=string,integer
396
maxUnavailable: 1
397
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.