Specification of the desired state of the Certificate resource.
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
additionalOutputFormats
[]object
Defines extra output formats of the private key and signed certificate chain
to be written to this Certificate's target Secret.
type
string required
Type is the name of the format type that should be written to the
Certificate's target Secret.
enum: DER, CombinedPEM
commonName
string
Requested common name X509 certificate subject attribute.
More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
NOTE: TLS clients will ignore this value when any subject alternative name is
set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
Cannot be set if the `literalSubject` field is set.
dnsNames
[]string
Requested DNS subject alternative names.
duration
string
Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
issuer may choose to ignore the requested duration, just like any other
requested attribute.
If unset, this defaults to 90 days.
Minimum accepted duration is 1 hour.
Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
emailAddresses
[]string
Requested email subject alternative names.
encodeUsagesInRequest
boolean
Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
This option defaults to true, and should only be disabled if the target
issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
ipAddresses
[]string
Requested IP address subject alternative names.
isCA
boolean
Requested basic constraints isCA value.
The isCA value is used to set the `isCA` field on the created CertificateRequest
resources. Note that the issuer may choose to ignore the requested isCA value, just
like any other requested attribute.
If true, this will automatically add the `cert sign` usage to the list
of requested `usages`.
issuerRef
object required
Reference to the issuer responsible for issuing the certificate.
If the issuer is namespace-scoped, it must be in the same namespace
as the Certificate. If the issuer is cluster-scoped, it can be used
from any namespace.
The `name` field of the reference must always be specified.
group
string
Group of the issuer being referred to.
Defaults to 'cert-manager.io'.
kind
string
Kind of the issuer being referred to.
Defaults to 'Issuer'.
name
string required
Name of the issuer being referred to.
keystores
object
Additional keystore output formats to be stored in the Certificate's Secret.
jks
object
JKS configures options for storing a JKS keystore in the
`spec.secretName` Secret resource.
alias
string
Alias specifies the alias of the key in the keystore, required by the JKS format.
If not provided, the default alias `certificate` will be used.
create
boolean required
Create enables JKS keystore creation for the Certificate.
If true, a file named `keystore.jks` will be created in the target
Secret resource, encrypted using the password stored in
`passwordSecretRef` or `password`.
The keystore file will be updated immediately.
If the issuer provided a CA certificate, a file named `truststore.jks`
will also be created in the target Secret resource, encrypted using the
password stored in `passwordSecretRef`
containing the issuing Certificate Authority
password
string
Password provides a literal password used to encrypt the JKS keystore.
Mutually exclusive with passwordSecretRef.
One of password or passwordSecretRef must provide a password with a non-zero length.
passwordSecretRef
object
PasswordSecretRef is a reference to a non-empty key in a Secret resource
containing the password used to encrypt the JKS keystore.
Mutually exclusive with password.
One of password or passwordSecretRef must provide a password with a non-zero length.
key
string
The key of the entry in the Secret resource's `data` field to be used.
Some instances of this field may be defaulted, in others it may be
required.
name
string required
Name of the resource being referred to.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
pkcs12
object
PKCS12 configures options for storing a PKCS12 keystore in the
`spec.secretName` Secret resource.
create
boolean required
Create enables PKCS12 keystore creation for the Certificate.
If true, a file named `keystore.p12` will be created in the target
Secret resource, encrypted using the password stored in
`passwordSecretRef` or in `password`.
The keystore file will be updated immediately.
If the issuer provided a CA certificate, a file named `truststore.p12` will
also be created in the target Secret resource, encrypted using the
password stored in `passwordSecretRef` containing the issuing Certificate
Authority
password
string
Password provides a literal password used to encrypt the PKCS#12 keystore.
Mutually exclusive with passwordSecretRef.
One of password or passwordSecretRef must provide a password with a non-zero length.
passwordSecretRef
object
PasswordSecretRef is a reference to a non-empty key in a Secret resource
containing the password used to encrypt the PKCS#12 keystore.
Mutually exclusive with password.
One of password or passwordSecretRef must provide a password with a non-zero length.
key
string
The key of the entry in the Secret resource's `data` field to be used.
Some instances of this field may be defaulted, in others it may be
required.
name
string required
Name of the resource being referred to.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
profile
string
Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
If provided, allowed values are:
`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
(e.g., because of company policy). Please note that the security of the algorithm is not that important
in reality, because the unencrypted certificate and private key are also stored in the Secret.
enum: LegacyRC2, LegacyDES, Modern2023
literalSubject
string
Requested X.509 certificate subject, represented using the LDAP "String
Representation of a Distinguished Name" [1].
Important: the LDAP string format also specifies the order of the attributes
in the subject, this is important when issuing certs for LDAP authentication.
Example: `CN=foo,DC=corp,DC=example,DC=com`
More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
More info: https://github.com/cert-manager/cert-manager/issues/3203
More info: https://github.com/cert-manager/cert-manager/issues/4424
Cannot be set if the `subject` or `commonName` field is set.
nameConstraints
object
x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
This is an Alpha Feature and is only enabled with the
`--feature-gates=NameConstraints=true` option set on both
the controller and webhook components.
critical
boolean
if true then the name constraints are marked critical.
excluded
object
Excluded contains the constraints which must be disallowed. Any name matching a
restriction in the excluded field is invalid regardless
of information appearing in the permitted
dnsDomains
[]string
DNSDomains is a list of DNS domains that are permitted or excluded.
emailAddresses
[]string
EmailAddresses is a list of Email Addresses that are permitted or excluded.
ipRanges
[]string
IPRanges is a list of IP Ranges that are permitted or excluded.
This should be a valid CIDR notation.
uriDomains
[]string
URIDomains is a list of URI domains that are permitted or excluded.
permitted
object
Permitted contains the constraints in which the names must be located.
dnsDomains
[]string
DNSDomains is a list of DNS domains that are permitted or excluded.
emailAddresses
[]string
EmailAddresses is a list of Email Addresses that are permitted or excluded.
ipRanges
[]string
IPRanges is a list of IP Ranges that are permitted or excluded.
This should be a valid CIDR notation.
uriDomains
[]string
URIDomains is a list of URI domains that are permitted or excluded.
otherNames
[]object
`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
oid
string
OID is the object identifier for the otherName SAN.
The object identifier must be expressed as a dotted string, for
example, "1.2.840.113556.1.4.221".
utf8Value
string
utf8Value is the string value of the otherName SAN.
The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
privateKey
object
Private key options. These include the key algorithm and size, the used
encoding and the rotation policy.
algorithm
string
Algorithm is the private key algorithm of the corresponding private key
for this certificate.
If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
If `algorithm` is specified and `size` is not provided,
key size of 2048 will be used for `RSA` key algorithm and
key size of 256 will be used for `ECDSA` key algorithm.
key size is ignored when using the `Ed25519` key algorithm.
enum: RSA, ECDSA, Ed25519
encoding
string
The private key cryptography standards (PKCS) encoding for this
certificate's private key to be encoded in.
If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
and PKCS#8, respectively.
Defaults to `PKCS1` if not specified.
enum: PKCS1, PKCS8
rotationPolicy
string
RotationPolicy controls how private keys should be regenerated when a
re-issuance is being processed.
If set to `Never`, a private key will only be generated if one does not
already exist in the target `spec.secretName`. If one does exist but it
does not have the correct algorithm or size, a warning will be raised
to await user intervention.
If set to `Always`, a private key matching the specified requirements
will be generated whenever a re-issuance occurs.
Default is `Always`.
The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
enum: Never, Always
size
integer
Size is the key bit size of the corresponding private key for this certificate.
If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
and will default to `2048` if not specified.
If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
and will default to `256` if not specified.
If `algorithm` is set to `Ed25519`, Size is ignored.
No other values are allowed.
renewBefore
string
How long before the currently issued certificate's expiry cert-manager should
renew the certificate. For example, if a certificate is valid for 60 minutes,
and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
50 minutes after it was issued (i.e. when there are 10 minutes remaining until
the certificate is no longer valid).
NOTE: The actual lifetime of the issued certificate is used to determine the
renewal time. If an issuer returns a certificate with a different lifetime than
the one requested, cert-manager will use the lifetime of the issued certificate.
If unset, this defaults to 1/3 of the issued certificate's lifetime.
Minimum accepted value is 5 minutes.
Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
Cannot be set if the `renewBeforePercentage` field is set.
renewBeforePercentage
integer
`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
rather than an absolute duration. For example, if a certificate is valid for 60
minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to
renew the certificate 45 minutes after it was issued (i.e. when there are 15
minutes (25%) remaining until the certificate is no longer valid).
NOTE: The actual lifetime of the issued certificate is used to determine the
renewal time. If an issuer returns a certificate with a different lifetime than
the one requested, cert-manager will use the lifetime of the issued certificate.
Value must be an integer in the range (0,100). The minimum effective
`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
minutes.
Cannot be set if the `renewBefore` field is set.
format: int32
revisionHistoryLimit
integer
The maximum number of CertificateRequest revisions that are maintained in
the Certificate's history. Each revision represents a single `CertificateRequest`
created by this Certificate, either when it was created, renewed, or Spec
was changed. Revisions will be removed by oldest first if the number of
revisions exceeds this number.
If set, revisionHistoryLimit must be a value of `1` or greater.
Default value is `1`.
format: int32
secretName
string required
Name of the Secret resource that will be automatically created and
managed by this Certificate resource. It will be populated with a
private key and certificate, signed by the denoted issuer. The Secret
resource lives in the same namespace as the Certificate resource.
secretTemplate
object
Defines annotations and labels to be copied to the Certificate's Secret.
Labels and annotations on the Secret will be changed as they appear on the
SecretTemplate when added or removed. SecretTemplate annotations are added
in conjunction with, and cannot overwrite, the base set of annotations
cert-manager sets on the Certificate's Secret.
annotations
object
Annotations is a key value map to be copied to the target Kubernetes Secret.
labels
object
Labels is a key value map to be copied to the target Kubernetes Secret.
signatureAlgorithm
string
Signature algorithm to use.
Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
Allowed values for Ed25519 keys: PureEd25519.
enum: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA, ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512, PureEd25519
subject
object
Requested set of X509 certificate subject attributes.
More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
The common name attribute is specified separately in the `commonName` field.
Cannot be set if the `literalSubject` field is set.
countries
[]string
Countries to be used on the Certificate.
localities
[]string
Cities to be used on the Certificate.
organizationalUnits
[]string
Organizational Units to be used on the Certificate.
organizations
[]string
Organizations to be used on the Certificate.
postalCodes
[]string
Postal codes to be used on the Certificate.
provinces
[]string
State/Provinces to be used on the Certificate.
serialNumber
string
Serial number to be used on the Certificate.
streetAddresses
[]string
Street addresses to be used on the Certificate.
uris
[]string
Requested URI subject alternative names.
usages
[]string
Requested key usages and extended key usages.
These usages are used to set the `usages` field on the created CertificateRequest
resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
will additionally be encoded in the `request` field which contains the CSR blob.
If unset, defaults to `digital signature` and `key encipherment`.