cert-manager-csi-driver
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
metrics:
2
# Enable the metrics server on csi-driver pods.
3
# If false, the metrics server will be disabled and the other metrics fields below will be ignored.
4
enabled: true
5
# The TCP port on which the metrics server will listen.
6
port: 9402
7
podmonitor:
8
# Create a PodMonitor to add csi-driver to Prometheus if you are using Prometheus Operator.
9
# See https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor
10
enabled: false
11
# The namespace that the pod monitor should live in, defaults
12
# to the cert-manager-csi-driver namespace.
13
# +docs:property
14
# namespace: cert-manager
15
16
# Specifies the `prometheus` label on the created PodMonitor. This is
17
# used when different Prometheus instances have label selectors matching
18
# different PodMonitors.
19
prometheusInstance: default
20
# The interval to scrape metrics.
21
interval: 60s
22
# The timeout before a metrics scrape fails.
23
scrapeTimeout: 30s
24
# Additional labels to add to the PodMonitor.
25
labels: {}
26
# Additional annotations to add to the PodMonitor.
27
annotations: {}
28
# Keep labels from scraped data, overriding server-side labels.
29
honorLabels: false
30
# EndpointAdditionalProperties allows setting additional properties on the
31
# endpoint such as relabelings, metricRelabelings etc.
32
#
33
# For example:
34
# endpointAdditionalProperties:
35
# relabelings:
36
# - action: replace
37
# sourceLabels:
38
# - __meta_kubernetes_pod_node_name
39
# targetLabel: instance
40
#
41
# +docs:property
42
endpointAdditionalProperties: {}
43
# The container registry used for csi-driver images by default.
44
# This can include path prefixes (e.g. "artifactory.example.com/docker").
45
# +docs:property
46
imageRegistry: quay.io
47
# The repository namespace used for csi-driver images by default.
48
# Examples:
49
# - jetstack
50
# - cert-manager
51
# +docs:property
52
imageNamespace: jetstack
53
image:
54
# Target image registry. This value is prepended to the target image repository, if set.
55
# For example:
56
# registry: quay.io
57
# repository: jetstack/cert-manager-csi-driver
58
# Deprecated: per-component registry prefix.
59
#
60
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
61
# This applies both when `image.repository` is set and when the repository is computed from
62
# `imageRegistry` + `imageNamespace` + `image.name`.
63
#
64
# This can produce "double registry" style references such as
65
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
66
# `imageRegistry`/`imageNamespace` values.
67
# +docs:property
68
# registry: quay.io
69
70
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
71
# and `image.name`).
72
# Example: quay.io/jetstack/cert-manager-csi-driver
73
# +docs:property
74
repository: chainguard-private/cert-manager-csi-driver-fips
75
# The image name for the csi-driver.
76
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full
77
# image reference.
78
# +docs:property
79
name: cert-manager-csi-driver
80
# Override the image tag to deploy by setting this variable.
81
# If no value is set, the chart's appVersion is used.
82
# +docs:property
83
# tag: vX.Y.Z
84
85
# Target image digest. Override any tag, if set.
86
# For example:
87
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
88
# +docs:property
89
# digest: sha256:...
90
91
# Kubernetes imagePullPolicy on Deployment.
92
pullPolicy: IfNotPresent
93
tag: latest
94
registry: cgr.dev
95
digest: sha256:f61068a6fbe96eb444c07c5c908ea3c2a28c4148f225174664af6d6c1b03fb9f
96
# Optional secrets used for pulling the csi-driver container image.
97
#
98
# For example:
99
# imagePullSecrets:
100
# - name: secret-name
101
imagePullSecrets: []
102
# Labels to apply to all resources.
103
commonLabels: {}
104
nodeDriverRegistrarImage:
105
# Target image registry. This value is prepended to the target image repository, if set.
106
# For example:
107
# registry: registry.k8s.io
108
# repository: sig-storage/csi-node-driver-registrar
109
# Deprecated: per-component registry prefix.
110
#
111
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
112
# This applies both when `image.repository` is set and when the repository is computed from
113
# `imageRegistry` + `imageNamespace` + `image.name`.
114
#
115
# This can produce "double registry" style references such as
116
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
117
# `imageRegistry`/`imageNamespace` values.
118
# +docs:property
119
# registry: registry.k8s.io
120
121
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
122
# and `image.name`).
123
# Example: quay.io/jetstack/cert-manager-csi-driver
124
# +docs:property
125
repository: chainguard-private/kubernetes-csi-node-driver-registrar-fips
126
# The image name for the node-driver-registrar.
127
# This is used to construct the full image reference if `repository` is empty.
128
# +docs:property
129
name: csi-node-driver-registrar
130
# Override the image tag to deploy by setting this variable.
131
# If no value is set, the chart's appVersion is used.
132
# +docs:property
133
# tag: vX.Y.Z
134
135
# Target image digest. Override any tag, if set.
136
# For example:
137
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
138
# +docs:property
139
# digest: sha256:...
140
141
# WARNING: For internal use only, is overwritten before releasing the chart.
142
# +docs:hidden
143
_defaultReference: :v0.0.0
144
# Kubernetes imagePullPolicy on Deployment.
145
pullPolicy: IfNotPresent
146
registry: cgr.dev
147
tag: latest
148
digest: sha256:beced5dd1e33ca4fea5b2a41b3367551fd894483370d22962d9adeced6e41f6e
149
livenessProbeImage:
150
# Target image registry. This value is prepended to the target image repository, if set.
151
# For example:
152
# registry: registry.k8s.io
153
# repository: sig-storage/livenessprobe
154
# Deprecated: per-component registry prefix.
155
#
156
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
157
# This applies both when `image.repository` is set and when the repository is computed from
158
# `imageRegistry` + `imageNamespace` + `image.name`.
159
#
160
# This can produce "double registry" style references such as
161
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
162
# `imageRegistry`/`imageNamespace` values.
163
# +docs:property
164
# registry: registry.k8s.io
165
166
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
167
# and `image.name`).
168
# Example: quay.io/jetstack/cert-manager-csi-driver
169
# +docs:property
170
repository: chainguard-private/kubernetes-csi-livenessprobe-fips
171
# The image name for the liveness probe.
172
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full
173
# image reference.
174
# +docs:property
175
name: livenessprobe
176
# Override the image tag to deploy by setting this variable.
177
# If no value is set, the chart's appVersion is used.
178
# +docs:property
179
# tag: vX.Y.Z
180
181
# Target image digest. Override any tag, if set.
182
# For example:
183
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
184
# +docs:property
185
# digest: sha256:...
186
187
# WARNING: For internal use only, is overwritten before releasing the chart.
188
# +docs:hidden
189
_defaultReference: :v0.0.0
190
# Kubernetes imagePullPolicy on Deployment.
191
pullPolicy: IfNotPresent
192
registry: cgr.dev
193
tag: latest
194
digest: sha256:8a3c32c9dd4e6de4a3903a0b9a3ace3c1c4c91e439f5b02cbe6951845245d3be
195
app:
196
# Verbosity of cert-manager-csi-driver logging.
197
logLevel: 1 # 1-5
198
# Options for CSI driver.
199
driver:
200
# Name of the driver to be registered with Kubernetes.
201
name: csi.cert-manager.io
202
# If enabled, this uses a CSI token request for creating
203
# CertificateRequests. CertificateRequests are created by mounting the
204
# pod's service accounts.
205
useTokenRequest: false
206
# If enabled, allows NodePublishVolume to succeed even when the
207
# driver is not yet ready to create certificate request. The volume is mounted
208
# immediately and certificate issuance is retried asynchronously.
209
continueOnNotReady: false
210
# Indicates the maximum queries-per-second requests to the Kubernetes apiserver.
211
# A value of 0 uses client-go's default.
212
kubernetesAPIQPS: 0
213
# The maximum burst queries-per-second of requests sent to the Kubernetes apiserver.
214
# A value of 0 uses client-go's default.
215
kubernetesAPIBurst: 0
216
# Defer certificate issuance until all specified pod readiness gates pass.
217
# Each entry has the form "<type>:<value>". Supported types:
218
# pod-ip:<family> family: any | ipv4 | ipv6
219
# pod-condition:<Type>[=<Status>] Status defaults to True
220
# pod-annotation:<key> annotation key must be present
221
# All gates must pass (AND semantics). Must be combined with
222
# continueOnNotReady: true to avoid blocking NodePublishVolume.
223
# Examples:
224
# - "pod-ip:ipv6"
225
# - "pod-condition:NetworkAttached=True"
226
# - "pod-annotation:k8s.v1.cni.cncf.io/networks-status"
227
podReadinessGates: []
228
# Configures the hostPath directory that the driver writes and mounts volumes from.
229
csiDataDir: /tmp/cert-manager-csi-driver
230
# Options for the liveness container.
231
livenessProbe:
232
# The port that will expose the liveness of the csi-driver.
233
port: 9809
234
# Overrides the path to root kubelet directory in case of a non-standard Kubernetes install.
235
kubeletRootDir: /var/lib/kubelet
236
# Optional additional annotations to add to the csi-driver DaemonSet.
237
daemonSetAnnotations: {}
238
# Optional additional annotations to add to the csi-driver pods.
239
podAnnotations: {}
240
# Optional additional labels to add to the csi-driver pods.
241
podLabels: {}
242
# Kubernetes pod resources requests/limits for cert-manager-csi-driver.
243
#
244
# For example:
245
# resources:
246
# limits:
247
# cpu: 100m
248
# memory: 128Mi
249
# requests:
250
# cpu: 100m
251
# memory: 128Mi
252
resources: {}
253
# Kubernetes node selector: node labels for pod assignment.
254
# +docs:property=nodeSelector
255
nodeSelector:
256
kubernetes.io/os: linux
257
# Kubernetes affinity: constraints for pod assignment.
258
#
259
# For example:
260
# affinity:
261
# nodeAffinity:
262
# requiredDuringSchedulingIgnoredDuringExecution:
263
# nodeSelectorTerms:
264
# - matchExpressions:
265
# - key: foo.bar.com/role
266
# operator: In
267
# values:
268
# - master
269
affinity: {}
270
# Kubernetes pod tolerations for cert-manager-csi-driver.
271
#
272
# For example:
273
# tolerations:
274
# - operator: "Exists"
275
tolerations: []
276
# Optional priority class to be used for the csi-driver pods.
277
priorityClassName: ""
278
# Configure the host network setting for the csi-driver pods.
279
# SECURITY WARNING: When set to true, pods will use the host's network namespace,
280
# which grants access to all host network interfaces and allows binding to any port.
281
# Ensure this aligns with your security requirements before enabling.
282
#
283
# Use case: In some CNI configurations (e.g., Cilium), enabling hostNetwork allows
284
# the CSI driver to start before the CNI is ready, reducing pod scheduling delays.
285
#
286
# Note: When using hostNetwork, ensure ports for liveness probe and metrics (if enabled)
287
# do not conflict with other services on your nodes.
288
hostNetwork: false
289
openshift:
290
securityContextConstraint:
291
# Include RBAC to allow the DaemonSet to "use" the specified
292
# SecurityContextConstraints.
293
#
294
# This value can either be a boolean true or false, or the string "detect".
295
# If set to "detect" then the securityContextConstraint is automatically
296
# enabled for openshift installs.
297
#
298
# +docs:type=boolean,string,null
299
enabled: detect
300
# Name of the SecurityContextConstraints to create RBAC for.
301
name: privileged
302
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.