cert-manager-istio-csr

cert-manager istio-csr

Chainguard's redistribution of the cert-manager-istio-csr Helm chart, pre-configured with hardened Chainguard Images.

istio-csr is an agent that allows Istio workload and control plane components to be secured using cert-manager.

Prerequisites

Authentication is required. First, authenticate with Chainguard:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace cert-manager

cert-manager must already be installed in the cluster, along with an Issuer for Istio (see the upstream installation guide).

Installation

helm install cert-manager-istio-csr oci://cgr.dev/ORGANIZATION/charts/cert-manager-istio-csr \
  --namespace cert-manager \
  --create-namespace \
  --set imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream cert-manager-istio-csr. All upstream configuration options apply.

For full documentation, see: https://cert-manager.io/docs/usage/istio-csr/