cert-manager-csi-driver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
metrics:
2
# Enable the metrics server on csi-driver pods.
3
# If false, the metrics server will be disabled and the other metrics fields below will be ignored.
4
enabled: true
5
# The TCP port on which the metrics server will listen.
6
port: 9402
7
podmonitor:
8
# Create a PodMonitor to add csi-driver to Prometheus if you are using Prometheus Operator.
9
# See https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor
10
enabled: false
11
# The namespace that the pod monitor should live in, defaults
12
# to the cert-manager-csi-driver namespace.
13
# +docs:property
14
# namespace: cert-manager
15
16
# Specifies the `prometheus` label on the created PodMonitor. This is
17
# used when different Prometheus instances have label selectors matching
18
# different PodMonitors.
19
prometheusInstance: default
20
# The interval to scrape metrics.
21
interval: 60s
22
# The timeout before a metrics scrape fails.
23
scrapeTimeout: 30s
24
# Additional labels to add to the PodMonitor.
25
labels: {}
26
# Additional annotations to add to the PodMonitor.
27
annotations: {}
28
# Keep labels from scraped data, overriding server-side labels.
29
honorLabels: false
30
# EndpointAdditionalProperties allows setting additional properties on the
31
# endpoint such as relabelings, metricRelabelings etc.
32
#
33
# For example:
34
# endpointAdditionalProperties:
35
# relabelings:
36
# - action: replace
37
# sourceLabels:
38
# - __meta_kubernetes_pod_node_name
39
# targetLabel: instance
40
#
41
# +docs:property
42
endpointAdditionalProperties: {}
43
# The container registry used for csi-driver images by default.
44
# This can include path prefixes (e.g. "artifactory.example.com/docker").
45
# +docs:property
46
imageRegistry: quay.io
47
# The repository namespace used for csi-driver images by default.
48
# Examples:
49
# - jetstack
50
# - cert-manager
51
# +docs:property
52
imageNamespace: jetstack
53
image:
54
# Target image registry. This value is prepended to the target image repository, if set.
55
# For example:
56
# registry: quay.io
57
# repository: jetstack/cert-manager-csi-driver
58
# Deprecated: per-component registry prefix.
59
#
60
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
61
# This applies both when `image.repository` is set and when the repository is computed from
62
# `imageRegistry` + `imageNamespace` + `image.name`.
63
#
64
# This can produce "double registry" style references such as
65
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
66
# `imageRegistry`/`imageNamespace` values.
67
# +docs:property
68
# registry: quay.io
69
70
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
71
# and `image.name`).
72
# Example: quay.io/jetstack/cert-manager-csi-driver
73
# +docs:property
74
repository: chainguard-private/cert-manager-csi-driver-fips
75
# The image name for the csi-driver.
76
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full
77
# image reference.
78
# +docs:property
79
name: cert-manager-csi-driver
80
# Override the image tag to deploy by setting this variable.
81
# If no value is set, the chart's appVersion is used.
82
# +docs:property
83
# tag: vX.Y.Z
84
85
# Target image digest. Override any tag, if set.
86
# For example:
87
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
88
# +docs:property
89
# digest: sha256:...
90
91
# Kubernetes imagePullPolicy on Deployment.
92
pullPolicy: IfNotPresent
93
tag: latest
94
registry: cgr.dev
95
digest: sha256:5b5362ce3d9e17dcaacf16a501826dea439b2b60899ed4e4ebabc49620db952b
96
# Optional secrets used for pulling the csi-driver container image.
97
#
98
# For example:
99
# imagePullSecrets:
100
# - name: secret-name
101
imagePullSecrets: []
102
# Labels to apply to all resources.
103
commonLabels: {}
104
nodeDriverRegistrarImage:
105
# Target image registry. This value is prepended to the target image repository, if set.
106
# For example:
107
# registry: registry.k8s.io
108
# repository: sig-storage/csi-node-driver-registrar
109
# Deprecated: per-component registry prefix.
110
#
111
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
112
# This applies both when `image.repository` is set and when the repository is computed from
113
# `imageRegistry` + `imageNamespace` + `image.name`.
114
#
115
# This can produce "double registry" style references such as
116
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
117
# `imageRegistry`/`imageNamespace` values.
118
# +docs:property
119
# registry: registry.k8s.io
120
121
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
122
# and `image.name`).
123
# Example: quay.io/jetstack/cert-manager-csi-driver
124
# +docs:property
125
repository: chainguard-private/kubernetes-csi-node-driver-registrar-fips
126
# The image name for the node-driver-registrar.
127
# This is used to construct the full image reference if `repository` is empty.
128
# +docs:property
129
name: csi-node-driver-registrar
130
# Override the image tag to deploy by setting this variable.
131
# If no value is set, the chart's appVersion is used.
132
# +docs:property
133
# tag: vX.Y.Z
134
135
# Target image digest. Override any tag, if set.
136
# For example:
137
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
138
# +docs:property
139
# digest: sha256:...
140
141
# WARNING: For internal use only, is overwritten before releasing the chart.
142
# +docs:hidden
143
_defaultReference: :v0.0.0
144
# Kubernetes imagePullPolicy on Deployment.
145
pullPolicy: IfNotPresent
146
registry: cgr.dev
147
tag: latest
148
digest: sha256:941e1db3dc9dc7350bb672591fa35b1159ecb831b069619c248d2d040e3490fe
149
livenessProbeImage:
150
# Target image registry. This value is prepended to the target image repository, if set.
151
# For example:
152
# registry: registry.k8s.io
153
# repository: sig-storage/livenessprobe
154
# Deprecated: per-component registry prefix.
155
#
156
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
157
# This applies both when `image.repository` is set and when the repository is computed from
158
# `imageRegistry` + `imageNamespace` + `image.name`.
159
#
160
# This can produce "double registry" style references such as
161
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
162
# `imageRegistry`/`imageNamespace` values.
163
# +docs:property
164
# registry: registry.k8s.io
165
166
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
167
# and `image.name`).
168
# Example: quay.io/jetstack/cert-manager-csi-driver
169
# +docs:property
170
repository: chainguard-private/kubernetes-csi-livenessprobe-fips
171
# The image name for the liveness probe.
172
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full
173
# image reference.
174
# +docs:property
175
name: livenessprobe
176
# Override the image tag to deploy by setting this variable.
177
# If no value is set, the chart's appVersion is used.
178
# +docs:property
179
# tag: vX.Y.Z
180
181
# Target image digest. Override any tag, if set.
182
# For example:
183
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
184
# +docs:property
185
# digest: sha256:...
186
187
# WARNING: For internal use only, is overwritten before releasing the chart.
188
# +docs:hidden
189
_defaultReference: :v0.0.0
190
# Kubernetes imagePullPolicy on Deployment.
191
pullPolicy: IfNotPresent
192
registry: cgr.dev
193
tag: latest
194
digest: sha256:93ad7c69c7c4f40709650681e989f43be7ea9ef43500d613ae019328e847b683
195
app:
196
# Verbosity of cert-manager-csi-driver logging.
197
logLevel: 1 # 1-5
198
# Options for CSI driver.
199
driver:
200
# Name of the driver to be registered with Kubernetes.
201
name: csi.cert-manager.io
202
# If enabled, this uses a CSI token request for creating
203
# CertificateRequests. CertificateRequests are created by mounting the
204
# pod's service accounts.
205
useTokenRequest: false
206
# If enabled, allows NodePublishVolume to succeed even when the
207
# driver is not yet ready to create certificate request. The volume is mounted
208
# immediately and certificate issuance is retried asynchronously.
209
continueOnNotReady: false
210
# Indicates the maximum queries-per-second requests to the Kubernetes apiserver.
211
# A value of 0 uses client-go's default.
212
kubernetesAPIQPS: 0
213
# The maximum burst queries-per-second of requests sent to the Kubernetes apiserver.
214
# A value of 0 uses client-go's default.
215
kubernetesAPIBurst: 0
216
# Defer certificate issuance until all specified pod readiness gates pass.
217
# Each entry has the form "<type>:<value>". Supported types:
218
# pod-ip:<family> family: any | ipv4 | ipv6
219
# pod-condition:<Type>[=<Status>] Status defaults to True
220
# pod-annotation:<key> annotation key must be present
221
# All gates must pass (AND semantics). Must be combined with
222
# continueOnNotReady: true to avoid blocking NodePublishVolume.
223
# Examples:
224
# - "pod-ip:ipv6"
225
# - "pod-condition:NetworkAttached=True"
226
# - "pod-annotation:k8s.v1.cni.cncf.io/networks-status"
227
podReadinessGates: []
228
# Base duration between gate-pending retries. The wait between the first
229
# failed gate check and the next attempt.
230
# +docs:property=app.driver.gateBackoff.duration
231
# duration: 1s
232
233
# Multiplier applied to the previous wait after each failed gate check.
234
# Must be >= 1. With factor=1, the wait stays constant at `duration`.
235
# +docs:property=app.driver.gateBackoff.factor
236
# factor: 2.0
237
238
# Random jitter applied as +/- this fraction of the current wait. Must be
239
# in [0, 1]. With jitter=0, retries are deterministic. NOTE: jitter=0
240
# cannot be set via this chart (the template only renders the flag when
241
# truthy, so 0 is indistinguishable from unset here); use --gate-backoff-jitter=0
242
# directly on the binary if you need this.
243
# +docs:property=app.driver.gateBackoff.jitter
244
# jitter: 0.5
245
246
# Upper bound on the wait between gate-pending retries; the exponential
247
# growth from `factor` is capped here. Must be 0 (uncapped) or >=
248
# `duration`. NOTE: cap=0 (uncapped) cannot be set via this chart (the
249
# template only renders the flag when truthy, so 0 is indistinguishable
250
# from unset here); use --gate-backoff-cap=0 directly on the binary if
251
# you need this.
252
# +docs:property=app.driver.gateBackoff.cap
253
# cap: 10s
254
255
# Backoff applied between gate-pending retries (i.e. when ReadyToRequest
256
# reports a readiness gate is not yet met). Distinct from csi-lib's
257
# renewal backoff, which protects against signer failures and is left at
258
# csi-lib's defaults. Leave *all* four fields above commented out to
259
# defer entirely to csi-lib's own GateBackoffConfig defaults instead of
260
# pinning to a copy of them here.
261
#
262
# NOTE this is all-or-nothing, not per-field: uncommenting *any one*
263
# field above pins all four fields (including any left commented out,
264
# which fall back to the CLI's own defaults, not csi-lib's) to the CLI's
265
# current values for the driver's lifetime. Only set a field here to
266
# intentionally override csi-lib's tuning for a slower or faster
267
# gate-resolution profile; be aware that doing so also freezes the other
268
# three fields at today's CLI defaults even if csi-lib's own defaults
269
# change in a future release.
270
gateBackoff: {}
271
# Configures the hostPath directory that the driver writes and mounts volumes from.
272
csiDataDir: /tmp/cert-manager-csi-driver
273
# Options for the liveness container.
274
livenessProbe:
275
# The port that will expose the liveness of the csi-driver.
276
port: 9809
277
# Overrides the path to root kubelet directory in case of a non-standard Kubernetes install.
278
kubeletRootDir: /var/lib/kubelet
279
# Optional additional annotations to add to the csi-driver DaemonSet.
280
daemonSetAnnotations: {}
281
# Optional additional annotations to add to the csi-driver pods.
282
podAnnotations: {}
283
# Optional additional labels to add to the csi-driver pods.
284
podLabels: {}
285
# Kubernetes pod resources requests/limits for cert-manager-csi-driver.
286
#
287
# For example:
288
# resources:
289
# limits:
290
# cpu: 100m
291
# memory: 128Mi
292
# requests:
293
# cpu: 100m
294
# memory: 128Mi
295
resources: {}
296
# Kubernetes node selector: node labels for pod assignment.
297
# +docs:property=nodeSelector
298
nodeSelector:
299
kubernetes.io/os: linux
300
# Kubernetes affinity: constraints for pod assignment.
301
#
302
# For example:
303
# affinity:
304
# nodeAffinity:
305
# requiredDuringSchedulingIgnoredDuringExecution:
306
# nodeSelectorTerms:
307
# - matchExpressions:
308
# - key: foo.bar.com/role
309
# operator: In
310
# values:
311
# - master
312
affinity: {}
313
# Kubernetes pod tolerations for cert-manager-csi-driver.
314
#
315
# For example:
316
# tolerations:
317
# - operator: "Exists"
318
tolerations: []
319
# Optional priority class to be used for the csi-driver pods.
320
priorityClassName: ""
321
# Configure the host network setting for the csi-driver pods.
322
# SECURITY WARNING: When set to true, pods will use the host's network namespace,
323
# which grants access to all host network interfaces and allows binding to any port.
324
# Ensure this aligns with your security requirements before enabling.
325
#
326
# Use case: In some CNI configurations (e.g., Cilium), enabling hostNetwork allows
327
# the CSI driver to start before the CNI is ready, reducing pod scheduling delays.
328
#
329
# Note: When using hostNetwork, ensure ports for liveness probe and metrics (if enabled)
330
# do not conflict with other services on your nodes.
331
hostNetwork: false
332
openshift:
333
securityContextConstraint:
334
# Include RBAC to allow the DaemonSet to "use" the specified
335
# SecurityContextConstraints.
336
#
337
# This value can either be a boolean true or false, or the string "detect".
338
# If set to "detect" then the securityContextConstraint is automatically
339
# enabled for openshift installs.
340
#
341
# +docs:type=boolean,string,null
342
enabled: detect
343
# Name of the SecurityContextConstraints to create RBAC for.
344
name: privileged
345
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.