sigstore-fulcio
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
namespace:
2
create: false
3
name: fulcio-system
4
imagePullSecrets: []
5
init:
6
enabled: false
7
image:
8
curl:
9
registry: cgr.dev
10
repository: chainguard-private/curl
11
# -- 8.17.0
12
version: sha256:44d5c2f509aad1a82a795c695b23283df450c6c3d61044f37a65443c0cb57220
13
imagePullPolicy: IfNotPresent
14
containerResources: {}
15
config:
16
contents: {}
17
format: json
18
server:
19
replicaCount: 1
20
name: server
21
svcPort: 80
22
grpcSvcPort: 5554
23
# -- KMS type for signing key (possible values: "" / "none", "aws")
24
kmsType: none
25
secret: fulcio-server-secret
26
# -- kubernetes secret name containing IAM credentials for use with AWS KMS
27
awsKmsCredentialsSecretName: aws-kms-credentials
28
# -- AWS region if using AWS KMS for signing key
29
awsKmsRegion: us-east-1
30
logging:
31
production: false
32
image:
33
registry: cgr.dev
34
repository: chainguard-private/fulcio
35
pullPolicy: IfNotPresent
36
# crane digest ghcr.io/sigstore/fulcio:v1.9.0
37
version: 1.9.1-r2@sha256:c15da916ad062224c217641e7524a83986ac4f0f73fa1c6f9798879d6fef82ea
38
args:
39
port: 5555
40
grpcPort: 5554
41
# Valid values: googleca, pkcs11ca, fileca, kmsca, tinkca
42
certificateAuthority: fileca
43
# kms_resource: gcpkms://....
44
# kms_cert_chain: |-
45
# << your PEM encoded cert chain here. Order from active intermedate first to root last >>
46
# tink_kms_resource: gcp-kms://...
47
# tink_kms_cert_chain: |-
48
# << your PEM encoded Tink cert chain here. Order from active intermedate first to root last >>
49
# tink_enc_keyset: |-
50
# << your encrypted Tink keyset >>
51
# Required when certificateAuthority is pkcs11ca
52
hsm_caroot_id:
53
# Optional with pkcs11ca: path to the root CA on disk (AWS CloudHSM)
54
aws_hsm_root_ca_path:
55
gcp_private_ca_parent: projects/test/locations/us-east1/caPools/test
56
ct_log_url: ""
57
ct_log_origin: ""
58
disable_ct_log: false
59
serviceAccount:
60
create: true
61
name: ""
62
annotations: {}
63
mountToken: true
64
# -- Liveness probe for the fulcio server container. `httpGet.port` should
65
# match `server.args.port`.
66
livenessProbe:
67
failureThreshold: 3
68
httpGet:
69
path: /healthz
70
port: 5555
71
scheme: HTTP
72
periodSeconds: 10
73
successThreshold: 1
74
timeoutSeconds: 1
75
# -- Readiness probe for the fulcio server container. `httpGet.port` should
76
# match `server.args.port`.
77
readinessProbe:
78
failureThreshold: 3
79
httpGet:
80
path: /healthz
81
port: 5555
82
scheme: HTTP
83
periodSeconds: 10
84
successThreshold: 1
85
timeoutSeconds: 1
86
service:
87
type: ClusterIP
88
ports:
89
- name: http
90
port: 80
91
protocol: TCP
92
targetPort: 5555
93
- name: grpc
94
port: 5554
95
protocol: TCP
96
targetPort: 5554
97
- name: 2112-tcp
98
port: 2112
99
protocol: TCP
100
targetPort: 2112
101
ingress:
102
http:
103
enabled: true
104
className: "nginx"
105
annotations: {}
106
hosts:
107
- path: /
108
host: "fulcio.localhost"
109
tls: []
110
grpc:
111
enabled: false
112
className: ""
113
annotations:
114
nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
115
hosts:
116
- host: fulcio.localhost
117
path: /dev.sigstore.fulcio.v2.CA
118
tls:
119
- secretName: fulcio-grpc-ingress-tls
120
hosts:
121
- fulcio.localhost
122
ingresses:
123
- enabled: false
124
grpc: true
125
http: true
126
name: "gce-ingress"
127
className: "gce"
128
hosts:
129
- path: /
130
host: fulcio.localhost
131
annotations: {}
132
tls: []
133
staticGlobalIP: lb-ext-ip
134
frontendConfigSpec: # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_frontendconfig_parameters
135
sslPolicy: fulcio-ssl-policy
136
redirectToHttps:
137
enabled: true
138
backendConfigSpec: # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
139
securityPolicy:
140
name: fulcio-security-policy
141
logging:
142
enable: true
143
healthCheck:
144
port: 5555
145
requestPath: "/healthz"
146
type: HTTP
147
# -- Additional labels to add to the server pod
148
podLabels: {}
149
securityContext:
150
runAsNonRoot: true
151
runAsUser: 65533
152
tolerations: []
153
nodeSelector: {}
154
affinity: {}
155
neg:
156
http:
157
name: ""
158
port: 80
159
grpc:
160
name: ""
161
port: 5554
162
createcerts:
163
enabled: true
164
replicaCount: 1
165
name: createcerts
166
image:
167
registry: cgr.dev
168
repository: chainguard-private/sigstore-scaffolding-fulcio-createcerts
169
pullPolicy: IfNotPresent
170
# v0.7.33
171
version: 0.7.40-r0@sha256:d385736fa99d999ec38c16ceb9285207f85f04e86951fabaf4701f242aa8b090
172
ttlSecondsAfterFinished: 3600
173
serviceAccount:
174
create: true
175
name: ""
176
annotations: {}
177
mountToken: true
178
securityContext:
179
runAsNonRoot: true
180
runAsUser: 65533
181
annotations: {}
182
podAnnotations: {}
183
podLabels: {}
184
tolerations: []
185
nodeSelector: {}
186
affinity: {}
187
# Configure ctlog dependency
188
ctlog:
189
enabled: true
190
name: ctlog
191
forceNamespace: ctlog-system
192
fullnameOverride: ctlog
193
namespace:
194
name: ctlog-system
195
create: true
196
createtree:
197
name: ctlog-createtree
198
fullnameOverride: ctlog-createtree
199
createcerts:
200
name: ctlog-createcerts
201
fullnameOverride: ctlog-createcerts
202
createctconfig:
203
logPrefix: fulcio
204
# Force namespace of namespaced resources
205
forceNamespace: ""
206
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.