trust-manager

# +docs:section=Global

global:

rbac:

# Create required ClusterRoles, Roles, ClusterRoleBindings and RoleBindings for trust-manager.

create: true

# Aggregate read access to Bundles into the "cluster-reader" ClusterRole, mirroring how cert-manager aggregates its cluster-scoped ClusterIssuers. Bundle is a cluster-scoped resource, so this only takes effect for subjects bound via a ClusterRoleBinding.

# For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles).

aggregateClusterRoles: true

# +docs:section=CRDs

crds:

# This option decides if the CRDs should be installed

# as part of the Helm installation.

enabled: true

# This option makes it so that the "helm.sh/resource-policy": keep

# annotation is added to the CRD. This will prevent Helm from uninstalling

# the CRD when the Helm release is uninstalled.

# WARNING: when the CRDs are removed, all cert-manager custom resources

# (Certificates, Issuers, ...) will be removed too by the garbage collector.

keep: true

# +docs:section=Trust Manager

# The number of replicas of trust-manager to run.

#

# For example:

# Use integer to set a fixed number of replicas

# replicaCount: 2

#

# Use null, if you want to omit the replicas field and use the Kubernetes default value.

# replicaCount: null

#

# Use a string if you want to insert a variable for post-processing of the rendered template.

# replicaCount: ${REPLICAS_OVERRIDE:=3}

#

# +docs:type=number,string,null

replicaCount: 1

# The number of old ReplicaSets to retain to allow rollback.

# This is used to control the number of old ReplicaSets that are retained to allow rollback.

# If set to 0, no old ReplicaSets are retained.

# +docs:type=number,null

revisionHistoryLimit: 10

nameOverride: ""

# The namespace to install trust-manager into.

# If not set, the namespace of the release is used.

# This is helpful when installing trust-manager as a chart dependency (sub chart).

namespace: ""

# For Private docker registries, authentication is needed. Registry secrets are applied to the service account.

imagePullSecrets: []

# The container registry used for trust-manager images by default.

# This can include path prefixes (e.g. "artifactory.example.com/docker").

# +docs:property

imageRegistry: quay.io

# The repository namespace used for trust-manager images by default.

# Examples:

# - jetstack

# - cert-manager

# +docs:property

imageNamespace: jetstack

image:

# Target image registry. This value is prepended to the target image repository, if set.

# For example:

# registry: legacy.example.io

# Deprecated: per-component registry prefix.

#

# If set, this value is *prepended* to the image repository that the chart would otherwise render.

# This applies both when `image.repository` is set and when the repository is computed from

# `imageRegistry` + `imageNamespace` + `image.name`.

#

# This can produce "double registry" style references such as

# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global

# `imageRegistry`/`imageNamespace` values.

# +docs:property

# registry: quay.io

# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,

# and `image.name`).

# Example: quay.io/jetstack/trust-manager

# +docs:property

repository: cgr.dev/chainguard-private/trust-manager-fips

# The image name for trust-manager.

# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full

# image reference.

# +docs:property

name: trust-manager

# Override the image tag to deploy by setting this variable.

# If no value is set, the chart's appVersion is used.

# +docs:property

# tag: vX.Y.Z

# Target image digest. Override any tag, if set.

# For example:

# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

# +docs:property

# digest: sha256:...

# Kubernetes imagePullPolicy on Deployment.

pullPolicy: IfNotPresent

tag: 0.26.0-r0

digest: sha256:e727aca91fa3575a7d1352352ac1ee2f53f4bcb942bcddff5615b0789a7ac0b1

defaultPackage:

# Whether to load the default trust package during pod initialization, and include it in main container args. This container enables the 'useDefaultCAs' source on Bundles.

enabled: true

# Kubernetes pod resource limits for default package init container.

#

# For example:

# resources:

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

resources: {}

# Security Context to be set on the trust-manager default package init container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).

# +docs:property

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

seccompProfile:

type: RuntimeDefault

defaultPackageImage:

# Target image registry. This value is prepended to the target image repository, if set.

# For example:

# registry: quay.io

# repository: jetstack/cert-manager-package-debian

# Deprecated: per-component registry prefix.

#

# If set, this value is *prepended* to the image repository that the chart would otherwise render.

# This applies both when `image.repository` is set and when the repository is computed from

# `imageRegistry` + `imageNamespace` + `image.name`.

#

# This can produce "double registry" style references such as

# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global

# `imageRegistry`/`imageNamespace` values.

# +docs:property

# registry: quay.io

# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,

# and `image.name`).

# Example: quay.io/jetstack/trust-manager

# +docs:property

repository: cgr.dev/chainguard-private/cert-manager-package-12-fips

# The image name for trust-manager.

# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full

# image reference.

# +docs:property

name: trust-pkg-debian-trixie

# Override the image tag of the default package image.

# Is set at chart build time to the version specified in ./make/00_debian_trixie_version.mk.

# +docs:property

# tag: vX.Y.Z

# Target image digest. Override any tag, if set.

# For example:

# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

# +docs:property

# digest: sha256:...

# WARNING: For internal use only, is overwritten before releasing the chart.

# +docs:hidden

_defaultReference: :20250419-deb12u2.1

# imagePullPolicy for the default package image.

pullPolicy: IfNotPresent

tag: 20250419.12.2.1-r1

digest: sha256:0fefcbaeeff98b787173872dc9c5972ec8db6499cb3539486bf472e4407a946c

# Automounting API credentials for the trust-manager pod.

# +docs:property

automountServiceAccountToken: true

serviceAccount:

# Specifies whether a service account should be created.

create: true

# The name of the service account to use.

# If not set and create is true, a name is generated using the fullname template.

# +docs:property

# name: ""

# Automount API credentials for a Service Account.

# +docs:property

automountServiceAccountToken: true

# Additional volumes to add to the trust-manager pod.

volumes: []

# Additional volume mounts to add to the trust-manager container.

volumeMounts: []

secretTargets:

# If set to true, enable writing trust bundles to Kubernetes Secrets as a target.

# Enabling this alone changes no RBAC: the Secret rules are emitted only once authorizedSecrets or

# authorizedSecretsAll is configured. Once one of them is, trust-manager is granted read access to

# all Secrets in scope: cluster-wide by default, or — when app.targetNamespaces is set — only in those

# namespaces plus the trust namespace.

enabled: false

# If set to true, grant read/write permission to all secrets across the cluster. Use with caution!

# If set, ignores the authorizedSecrets list.

authorizedSecretsAll: false

# A list of secret names which trust-manager will be permitted to write (patch and delete) within the configured scope (cluster-wide by default, or — when app.targetNamespaces is set — the target namespaces plus the trust namespace).

# Read access is NOT limited to these names: configuring this list (or authorizedSecretsAll) grants

# trust-manager read (get/list/watch) on all Secrets in scope (cluster-wide, or — when app.targetNamespaces

# is set — those namespaces plus the trust namespace). Only patching and deleting are restricted to these

# names. Kubernetes RBAC ignores resourceNames for the create verb, because the API server does not

# know the object's name at authorization time. If the list is empty (and authorizedSecretsAll is false),

# trust-manager can't write to secrets and can only read secrets in the trust namespace for use as sources.

authorizedSecrets: []

# Kubernetes pod resource limits for trust.

#

# For example:

# resources:

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

resources: {}

# Security Context to be set on the trust-manager Pod. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).

podSecurityContext: {}

# Configure the priority class of the pod. For more information, see [PriorityClass](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass).

priorityClassName: ""

# Configure the nodeSelector; defaults to any Linux node (trust-manager doesn't support Windows nodes)

# +docs:property

nodeSelector:

kubernetes.io/os: linux

# Kubernetes Affinity. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).

# For example:

# affinity:

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: foo.bar.com/role

# operator: In

# values:

# - master

affinity: {}

# List of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).

# For example:

# tolerations:

# - key: foo.bar.com/role

# operator: Equal

# value: master

# effect: NoSchedule

tolerations: []

# List of Kubernetes TopologySpreadConstraints. For more information, see [TopologySpreadConstraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).

# For example:

# topologySpreadConstraints:

# - maxSkew: 2

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: ScheduleAnyway

# labelSelector:

# matchLabels:

# app.kubernetes.io/name: trust-manager

topologySpreadConstraints: []

filterExpiredCertificates:

# Whether to filter expired certificates from the trust bundle.

enabled: false

filterNonCACerts:

# Filter non-CA certificates, only CAs are used in the resulting Bundle.

enabled: false

app:

# Minimum TLS version supported. If omitted, the default Go minimum version will be used.

minTLSVersion: ""

# Comma-separated list of cipher suites for the webhook server. If omitted, the default Go cipher suites will be used.

# Only affects TLS 1.2; TLS 1.3 cipher suites are not configurable in Go.

# Acceptable names match Kubernetes component-base (same as kube-apiserver --tls-cipher-suites);

# see [TLSCipherPossibleValues](https://pkg.go.dev/k8s.io/component-base/cli/flag#TLSCipherPossibleValues).

# Some listed values are considered insecure — prefer [PreferredTLSCipherNames](https://pkg.go.dev/k8s.io/component-base/cli/flag#PreferredTLSCipherNames).

cipherSuites: ""

# Comma-separated list of numeric Go crypto/tls CurveID values for the webhook server (for example 23,29 for P-256 and X25519).

# Applies to TLS 1.2 and TLS 1.3 key exchange. Unlike cipherSuites, this still takes effect when the webhook is TLS 1.3-only.

# The order of the list is ignored. If omitted, the default Go curves will be used. See https://pkg.go.dev/crypto/tls#CurveID.

curvePreferences: ""

# The format of trust-manager logging. Accepted values are text or json.

logFormat: text

# The verbosity of trust-manager logging. This takes a value from 1-5, with the higher value being more verbose.

logLevel: 1

leaderElection:

# Whether to enable leader election for trust-manager.

enabled: true

# The duration that non-leader candidates will wait to force acquire leadership.

# The default should be sufficient in a healthy cluster but can be slightly increased to prevent trust-manager from restart-looping when the API server is overloaded.

leaseDuration: 15s

# The interval between attempts by the acting leader to renew a leadership slot before it stops leading.

# This MUST be less than or equal to the lease duration.

# The default should be sufficient in a healthy cluster but can be slightly increased to prevent trust-manager from restart-looping when the API server is overloaded.

renewDeadline: 10s

readinessProbe:

# The container port on which to expose the trust-manager HTTP readiness probe using the default network interface.

port: 6060

# The path on which to expose the trust-manager HTTP readiness probe using the default network interface.

path: "/readyz"

trust:

# The namespace used as the trust source. Note that the namespace _must_ exist

# before installing trust-manager.

namespace: cert-manager

# List of target namespaces that trust-manager can write to. By default, trust-manager can write targets in any namespace.

# +docs:property

# targetNamespaces: ["ns-1", "ns-2"]

# Security Context to be set on the trust-manager app container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).

# +docs:property

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

seccompProfile:

type: RuntimeDefault

# Pod labels to add to trust-manager pods.

# On a key collision these win over commonLabels. The "app" label cannot be

# overridden, because it must match the selectors that target these Pods.

podLabels: {}

# Pod annotations to add to trust-manager pods.

podAnnotations: {}

# +docs:section=Webhook

webhook:

# Host that the webhook listens on.

host: 0.0.0.0

# Port that the webhook listens on.

port: 6443

# Timeout of webhook HTTP request.

timeoutSeconds: 5

service:

# The type of Kubernetes Service used by the Webhook.

type: ClusterIP

# Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

ipFamilyPolicy: ""

# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

ipFamilies: []

# The nodePort set on the Service used by the webhook.

# +docs:property

# nodePort: 8080

tls:

helmCert:

# Whether to issue a webhook cert using Helm, which removes the need to install cert-manager.

# Helm-issued certificates can be challenging to rotate and maintain, and the issued cert will have a duration of 10 years and be modified when trust-manager is updated.

# It's safer and easier to rely on cert-manager for issuing the webhook cert - avoid using Helm-generated certs in production.

enabled: false

approverPolicy:

# Whether to create an approver-policy CertificateRequestPolicy allowing auto-approval of the trust-manager webhook certificate. If you have approver-policy installed, you almost certainly want to enable this.

enabled: false

# The namespace in which cert-manager was installed. Only used if `app.webhook.tls.approverPolicy.enabled` is true.

certManagerNamespace: "cert-manager"

# The name of cert-manager's Service Account. Only used if `app.webhook.tls.approverPolicy.enabled` is true.

certManagerServiceAccount: "cert-manager"

# Configure certificate duration and add labels/annotations to secrets created by Certificate resources when using cert-manager provisioned TLS certificate.

certificate:

# Certificate duration, if unset/empty the default from cert-manager will be used. Example configuration to set 1 year: duration: 8766h

duration: ""

secretTemplate: {}

# For example:

# annotations:

# my-secret-annotation-1: "foo"

# my-secret-annotation-2: "bar"

# labels:

# my-secret-label: foo

# This value specifies if the app should be started in hostNetwork mode. It is required for use in some managed Kubernetes clusters (such as AWS EKS) with custom CNI.

hostNetwork: false

# +docs:section=Metrics

metrics:

# The port for exposing Prometheus metrics on 0.0.0.0 on path '/metrics'.

port: 9402

# The service to expose metrics endpoint.

service:

# Create a Service resource to expose the metrics endpoint.

enabled: true

# The Service type to expose metrics.

type: ClusterIP

# Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

ipFamilyPolicy: ""

# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

ipFamilies: []

# The ServiceMonitor resource for this Service.

servicemonitor:

# Create a Prometheus ServiceMonitor for trust-manager.

enabled: false

# Sets the value of the "prometheus" label on the ServiceMonitor.

# This is used so that separate Prometheus instances can select different ServiceMonitors using labels.

prometheusInstance: default

# The interval to scrape the metrics.

interval: 10s

# The timeout for a metrics scrape.

scrapeTimeout: 5s

# Additional labels to add to the ServiceMonitor.

labels: {}

# EndpointAdditionalProperties allows setting additional properties on the

# endpoint such as relabelings, metricRelabelings etc.

#

# For example:

# endpointAdditionalProperties:

# relabelings:

# - action: replace

# sourceLabels:

# - __meta_kubernetes_pod_node_name

# targetLabel: instance

#

# +docs:property

endpointAdditionalProperties: {}

podDisruptionBudget:

# Enable or disable the PodDisruptionBudget resource.

#

# This prevents downtime during voluntary disruptions such as during a Node upgrade.

# For example, the PodDisruptionBudget will block `kubectl drain`

# if it is used on the Node where the only remaining trust-manager

# Pod is currently running.

enabled: false

# This configures the minimum available pods for disruptions. It can either be set to

# an integer (e.g. 1) or a percentage value (e.g. 25%).

# It cannot be used if `maxUnavailable` is set.

# +docs:type=unknown

# +docs:property

# minAvailable: 1

# This configures the maximum unavailable pods for disruptions. It can either be set to

# an integer (e.g. 1) or a percentage value (e.g. 25%).

# it cannot be used if `minAvailable` is set.

# +docs:type=unknown

# +docs:property

# maxUnavailable: 1

# Labels to apply to all resources.

# On a key collision these win over the chart's own labels, except where

# something selects on the label and overriding it would break that selection:

# "app" on the trust-manager Pods, "app" and "app.kubernetes.io/component" on

# the metrics Service, "prometheus" on the ServiceMonitor, and

# "rbac.authorization.k8s.io/aggregate-to-cluster-reader" on the aggregated

# ClusterRole. Those keep the chart's value on the resource in question, and

# are still applied from commonLabels to every other resource.

commonLabels: {}

# Annotations to apply to all resources

# NOTE: These annotations won't be added to the CRDs.

commonAnnotations: {}

# Extra manifests to be deployed. This is useful for deploying additional resources that are not part of the chart.

# For example:

# extraObjects:

# - apiVersion: cilium.io/v2

# kind: CiliumNetworkPolicy

# metadata:

# name: trust-manager

# namespace: trust-manager

# spec:

# endpointSelector:

# matchLabels:

# io.cilium.k8s.policy.serviceaccount: trust-manager

# egress:

# - toEntities:

# - kube-apiserver

extraObjects: []

# Field to optionally disable installation of the chart when wrapping it as a

# dependency in another chart.

# This matched the helm best practices:

# https://helm.sh/docs/chart_best_practices/dependencies/#conditions-and-tags

# +docs:hidden

enabled: true