cert-exporter

cert-exporter

Chainguard's redistribution of the cert-exporter Helm chart, pre-configured with hardened Chainguard Images. cert-exporter is a Prometheus exporter that publishes certificate expirations for certificates on disk and in Kubernetes secrets.

Prerequisites

Authentication is required. First, authenticate with Chainguard:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace cert-exporter

Installation

helm install cert-exporter oci://cgr.dev/ORGANIZATION/charts/cert-exporter \
  --namespace cert-exporter \
  --create-namespace \
  --set certManager.imagePullSecrets[0].name=cgr-pull-secret

To use the FIPS-validated image variant, pull from the cert-exporter-fips chart repository:

helm install cert-exporter oci://cgr.dev/ORGANIZATION/charts/cert-exporter-fips \
  --namespace cert-exporter \
  --create-namespace \
  --set certManager.imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream cert-exporter Helm chart. All upstream configuration options apply.

For full documentation, see: https://github.com/joe-elliott/cert-exporter/tree/master/helm/cert-exporter