Using certmanager-issuer for CertManager Issuer creation

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab Self-Managed

This chart is a helper for Jetstack’s CertManager Helm chart. It automatically provisions an Issuer object, used by CertManager when requesting TLS certificates for GitLab Ingresses.

Configuration

We describe all the major sections of the configuration below. When configuring from the parent chart, these values are:

certmanager-issuer:
  # Configure an ACME Issuer in cert-manager. Only used if global.ingress.configureCertmanager is true.
  server: https://acme-v02.api.letsencrypt.org/directory

  # Provide an email to associate with your TLS certificates
  # email:

  rbac:
    create: true

  resources:
    requests:
      cpu: 50m

  # Priority class assigned to pods
  priorityClassName: ""

  common:
    labels: {}

Installation parameters

This table contains all the possible charts configurations that can be supplied to the helm install command using the --set flags:

ParameterDefaultDescription
serverhttps://acme-v02.api.letsencrypt.org/directoryLet’s Encrypt server for use with the ACME CertManager Issuer.
emailYou must provide an email to associate with your TLS certificates. Let’s Encrypt uses this address to contact you about expiring certificates, and issues related to your account.
rbac.createtrueWhen true, creates RBAC-related resources to allow for manipulation of CertManager Issuer objects.
resources.requests.cpu50mRequested CPU resources for the Issuer creation Job.
common.labelsCommon labels to apply to the ServiceAccount, Job, ConfigMap, and Issuer.
priorityClassNamePriority class assigned to pods.
containerSecurityContextOverride container securityContext under which Certmanager is started
containerSecurityContext.runAsUser65534User ID under which the container should be started
containerSecurityContext.runAsGroup65534Group ID under which the container should be started
containerSecurityContext.allowPrivilegeEscalationfalseControls whether a process can gain more privileges than its parent process
containerSecurityContext.runAsNonRoottrueControls whether the container runs with a non-root user
containerSecurityContext.capabilities.drop[ "ALL" ]Removes Linux capabilities for the container
ttlSecondsAfterFinished1800Controls when a finished job becomes eligible for cascading removal.