CSI driver Helm values¶

cert-manager CSI driver is a storage plugin that is deployed into your Kubernetes cluster that can honor volume requests specified on Pods.

The following cert-manager CSI driver Helm values are supported by the Venafi Kubernetes Manifest tool.

metrics.enabled¶

true

Enable the metrics server on CSI Driver pods.
If false, the metrics server will be disabled, and the other metrics fields below will be ignored.

metrics.port¶

9402

The TCP port on which the metrics server will listen.

metrics.podmonitor.enabled¶

false

Create a PodMonitor to add CSI Driver to Prometheus if you use Prometheus Operator. See the Prometheus Operator documentation.

metrics.podmonitor.namespace¶

The namespace that the pod monitor should live in, defaults to the cert-manager CSI Driver namespace.

metrics.podmonitor.prometheusInstance¶

default

Specifies the prometheus label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.

metrics.podmonitor.interval¶

60s

The interval to scrape metrics.

metrics.podmonitor.scrapeTimeout¶

30s

The timeout before a metrics scrape fails.

metrics.podmonitor.labels¶

{}

Additional labels to add to the PodMonitor.

metrics.podmonitor.annotations¶

{}

Additional annotations to add to the PodMonitor.

metrics.podmonitor.honorLabels¶

false

Keep labels from scraped data, overriding server-side labels.

metrics.podmonitor.endpointAdditionalProperties¶

{}

EndpointAdditionalProperties allows setting additional properties on the endpoint, such as relabelings, metricRelabelings, etc.

For example:

endpointAdditionalProperties:
 relabelings:
 - action: replace
   sourceLabels:
   - __meta_kubernetes_pod_node_name
   targetLabel: instance

image.registry¶

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: quay.io
repository: jetstack/cert-manager-csi-driver

image.repository¶

quay.io/jetstack/cert-manager-csi-driver

Target image repository.

image.tag¶

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

image.digest¶

Target image digest. Override any tag, if set.
For example:

digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

image.pullPolicy¶

IfNotPresent

Kubernetes imagePullPolicy on Deployment.

imagePullSecrets¶

[]

Optional secrets used for pulling the CSI Driver container image.

For example:

imagePullSecrets:
- name: secret-name

commonLabels¶

{}

Labels to apply to all resources.

nodeDriverRegistrarImage.registry¶

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: registry.k8s.io
repository: sig-storage/csi-node-driver-registrar

nodeDriverRegistrarImage.repository¶

registry.k8s.io/sig-storage/csi-node-driver-registrar

Target image repository.

nodeDriverRegistrarImage.tag¶

v2.11.1

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

nodeDriverRegistrarImage.digest¶

Target image digest. Override any tag, if set.
For example:

digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

nodeDriverRegistrarImage.pullPolicy¶

IfNotPresent

Kubernetes imagePullPolicy on Deployment.

livenessProbeImage.registry¶

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: registry.k8s.io
repository: sig-storage/livenessprobe

livenessProbeImage.repository¶

registry.k8s.io/sig-storage/livenessprobe

Target image repository.

livenessProbeImage.tag¶

v2.12.0

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

livenessProbeImage.digest¶

Target image digest. Override any tag, if set.
For example:

digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

livenessProbeImage.pullPolicy¶

IfNotPresent

Kubernetes imagePullPolicy on Deployment.

app.logLevel¶

1

Verbosity of cert-manager CSI Driver logging.

app.driver.name¶

csi.cert-manager.io

Name of the driver to be registered with Kubernetes.

app.driver.useTokenRequest¶

false

If enabled, this uses a CSI token request for creating. CertificateRequests. CertificateRequests are created by mounting the pod's service accounts.

app.driver.csiDataDir¶

/tmp/cert-manager-csi-driver

Configures the hostPath directory that the driver writes and mounts volumes from.

app.livenessProbe.port¶

9809

The port that will expose the liveness of the CSI Driver.

app.kubeletRootDir¶

/var/lib/kubelet

Overrides the path to root kubelet directory in case of a non-standard Kubernetes install.

daemonSetAnnotations¶

{}

Optional additional annotations to add to the CSI Driver DaemonSet.

podAnnotations¶

{}

Optional additional annotations to add to the CSI Driver pods.

podLabels¶

{}

Optional additional labels to add to the CSI Driver pods.

resources¶

{}

Kubernetes pod resources requests/limits for cert-manager CSI Driver.

For example:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

nodeSelector¶

kubernetes.io/os: linux

Kubernetes node selector: node labels for pod assignment.

affinity¶

{}

Kubernetes affinity: constraints for pod assignment.

For example:

affinity:
  nodeAffinity:
   requiredDuringSchedulingIgnoredDuringExecution:
     nodeSelectorTerms:
     - matchExpressions:
       - key: foo.bar.com/role
         operator: In
         values:
         - master

tolerations¶

[]

Kubernetes pod tolerations for cert-manager CSI Driver.

For example:

tolerations:
- operator: "Exists"

priorityClassName¶

""

Optional priority class to be used for the CSI Driver pods.

openshift.securityContextConstraint.enabled¶

detect

Include RBAC to allow the DaemonSet to "use" the specified
SecurityContextConstraints.

This value can either be a boolean true or false, or the string "detect". If set to "detect" then the securityContextConstraint is automatically enabled for openshift installs.

openshift.securityContextConstraint.name¶

privileged

Name of the SecurityContextConstraints to create RBAC for.