Istio CSR Helm values¶

nameOverride¶

Property	nameOverride
Type	string
Default

nameOverride replaces the name of the chart in the Chart.yaml file when this is used to construct Kubernetes object names.

replicaCount¶

Property	replicaCount
Type	number
Default	`1`

The number of replicas of Istio CSR to run.

image.registry¶

Property	image.registry
Type	string
Default

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: quay.io
repository: jetstack/cert-manager-istio-csr

image.repository¶

Property	image.repository
Type	string
Default	`quay.io/jetstack/cert-manager-istio-csr`

Target image repository.

image.tag¶

Property	image.tag
Type	string
Default

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

image.digest¶

Property	image.digest
Type	string
Default

Target image digest. Override any tag, if set.
For example:

digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

image.pullPolicy¶

Property	image.pullPolicy
Type	string
Default	`IfNotPresent`

Kubernetes imagePullPolicy on Deployment.

imagePullSecrets¶

Property	imagePullSecrets
Type	array
Default	`[]`

Optional secrets used for pulling the Istio CSR container image.

service.type¶

Property	service.type
Type	string
Default	`ClusterIP`

Service type to expose the Istio CSR gRPC service.

service.port¶

Property	service.port
Type	number
Default	`443`

Service port to expose the Istio CSR gRPC service.

service.nodePort¶

Property	service.nodePort
Type	number
Default

Service nodePort to expose the Istio CSR gRPC service.

app.logLevel¶

Property	app.logLevel
Type	number
Default	`1`

Verbosity of Istio CSR logging.

app.logFormat¶

Property	app.logFormat
Type	string
Default	`text`

Output format of Istio CSR logging.

app.metrics.port¶

Property	app.metrics.port
Type	number
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```0

Port for exposing Prometheus metrics on 0.0.0.0 on path '/metrics'.

app.metrics.service.enabled¶

Property	app.metrics.service.enabled
Type	bool
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```1

Create a Service resource to expose the metrics endpoint.

app.metrics.service.type¶

Property	app.metrics.service.type
Type	string
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```2

Service type to expose metrics.

app.metrics.service.servicemonitor.enabled¶

Property	app.metrics.service.servicemonitor.enabled
Type	bool
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```3

Create a Prometheus ServiceMonitor resource.

app.metrics.service.servicemonitor.prometheusInstance¶

Property	app.metrics.service.servicemonitor.prometheusInstance
Type	string
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```4

The value for the "prometheus" label on the ServiceMonitor. This allows for multiple Prometheus instances selecting different ServiceMonitors using label selectors.

app.metrics.service.servicemonitor.interval¶

Property	app.metrics.service.servicemonitor.interval
Type	string
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```5

The interval at which Prometheus will scrape for metrics.

app.metrics.service.servicemonitor.scrapeTimeout¶

Property	app.metrics.service.servicemonitor.scrapeTimeout
Type	string
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```6

The timeout on each metric probe request.

app.metrics.service.servicemonitor.labels¶

Property	app.metrics.service.servicemonitor.labels
Type	object
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```7

Additional labels to give the ServiceMonitor resource.

app.runtimeConfiguration.create¶

Property	app.runtimeConfiguration.create
Type	bool
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```8

Create the runtime-configuration ConfigMap.

app.runtimeConfiguration.name¶

Property	app.runtimeConfiguration.name
Type	string
Default	```yaml registry: quay.io repository: jetstack/cert-manager-istio-csr ```9

Name of a ConfigMap in the installation namespace to watch, providing runtime configuration of an issuer to use.

If create is set to true, then this name is used to create the ConfigMap, otherwise the ConfigMap must exist, and the "issuer-name", "issuer-kind" and "issuer-group" keys must be present in it.

app.runtimeConfiguration.issuer.name¶

Property	app.runtimeConfiguration.issuer.name
Type	string
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```0

Issuer name set on created CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.runtimeConfiguration.issuer.kind¶

Property	app.runtimeConfiguration.issuer.kind
Type	string
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```1

Issuer kind set on created CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.runtimeConfiguration.issuer.group¶

Property	app.runtimeConfiguration.issuer.group
Type	string
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```2

Issuer group name set on created CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.readinessProbe.port¶

Property	app.readinessProbe.port
Type	number
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```3

Container port to expose the Istio CSR HTTP readiness probe on the default network interface.

app.readinessProbe.path¶

Property	app.readinessProbe.path
Type	string
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```4

Path to expose the Istio CSR HTTP readiness probe on the default network interface.

app.certmanager.namespace¶

Property	app.certmanager.namespace
Type	string
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```5

Namespace to create CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.certmanager.preserveCertificateRequests¶

Property	app.certmanager.preserveCertificateRequests
Type	bool
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```6

Don't delete created CertificateRequests once they have been signed. WARNING: Do not enable this option in production, or environments with any non-trivial number of workloads for an extended period of time. Doing so will balloon the resource consumption of both ETCD and the API server, leading to errors and slow down. This option is intended for debugging purposes only, for limited periods of time.

app.certmanager.additionalAnnotations¶

Property	app.certmanager.additionalAnnotations
Type	array
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```7

Additional annotations to include on certificate requests.
Takes key/value pairs in the format:

yaml quay.io/jetstack/cert-manager-istio-csr8

app.certmanager.issuer.enabled¶

Property	app.certmanager.issuer.enabled
Type	bool
Default	```yaml quay.io/jetstack/cert-manager-istio-csr ```9

Enable the default issuer, this is the issuer used when no runtime configuration is provided.

When enabled, the Istio CSR Pod will not be "Ready" until the issuer has been used to issue the Istio CSR GRPC certificate.

For Istio CSR to function, either this or runtime configuration must be enabled.

app.certmanager.issuer.name¶

Property	app.certmanager.issuer.name
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```0

Issuer name set on created CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.certmanager.issuer.kind¶

Property	app.certmanager.issuer.kind
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```1

Issuer kind set on created CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.certmanager.issuer.group¶

Property	app.certmanager.issuer.group
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```2

Issuer group name set on created CertificateRequests for both Istio CSR's serving certificate and incoming gRPC CSRs.

app.tls.trustDomain¶

Property	app.tls.trustDomain
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```3

The Istio cluster's trust domain.

app.tls.rootCAFile¶

Property	app.tls.rootCAFile
Type	unknown
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```4

An optional file location to a PEM encoded root CA that the root CA. ConfigMap in all namespaces will be populated with. If empty, the CA returned from cert-manager for the serving certificate will be used.

app.tls.certificateDNSNames[0]¶

Property	app.tls.certificateDNSNames[0]
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```5

app.tls.certificateDuration¶

Property	app.tls.certificateDuration
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```6

Requested duration of the gRPC serving certificate. Will be automatically renewed. Based on NIST 800-204A recommendations (SM-DR13).

app.tls.istiodCertificateEnable¶

Property	app.tls.istiodCertificateEnable
Type	boolean,string,null
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```7

If true, create the istiod certificate using a cert-manager certificate as part of the install. If set to "dynamic", will create the cert dynamically when Istio CSR pods start up. If false, no cert is created.

app.tls.istiodCertificateDuration¶

Property	app.tls.istiodCertificateDuration
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```8

Requested duration of istio's Certificate. Will be automatically renewed. Default is based on NIST 800-204A recommendations (SM-DR13). Warning: cert-manager does not allow a duration on Certificates less than 1 hour.

app.tls.istiodCertificateRenewBefore¶

Property	app.tls.istiodCertificateRenewBefore
Type	string
Default	```yaml digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 ```9

Amount of time to wait before trying to renew the istiod certificate.
Must be smaller than the certificate's duration.

app.tls.istiodPrivateKeyAlgorithm¶

Property	app.tls.istiodPrivateKeyAlgorithm
Type	string
Default	```yaml IfNotPresent ```0

Private key algorithm to use. For backwards compatibility, defaults to the same value as app.server.serving.signatureAlgorithm

app.tls.istiodPrivateKeySize¶

Property	app.tls.istiodPrivateKeySize
Type	number
Default	```yaml IfNotPresent ```1

Parameter for the istiod certificate key. For RSA, must be a number of bits >= 2048. For ECDSA, can only be 256 or 384, corresponding to P-256 and P-384 respectively.

app.tls.istiodAdditionalDNSNames¶

Property	app.tls.istiodAdditionalDNSNames
Type	array
Default	```yaml IfNotPresent ```2

Provide additional DNS names to request on the istiod certificate. Useful if istiod should be accessible via multiple DNS names and/or outside of the cluster.

app.server.authenticators.enableClientCert¶

Property	app.server.authenticators.enableClientCert
Type	bool
Default	```yaml IfNotPresent ```3

Enable the client certificate authenticator. This will allow workloads to use preexisting certificates to authenticate with Istio CSR when rotating their certificate.

app.server.clusterID¶

Property	app.server.clusterID
Type	string
Default	```yaml IfNotPresent ```4

The istio cluster ID to verify incoming CSRs.

app.server.maxCertificateDuration¶

Property	app.server.maxCertificateDuration
Type	string
Default	```yaml IfNotPresent ```5

Maximum validity duration that can be requested for a certificate. Istio CSR will request a duration of the smaller of this value, and that of the incoming gRPC CSR. Based on NIST 800-204A recommendations (SM-DR13).

app.server.serving.address¶

Property	app.server.serving.address
Type	string
Default	```yaml IfNotPresent ```6

Container address to serve the Istio CSR gRPC service.

app.server.serving.port¶

Property	app.server.serving.port
Type	number
Default	```yaml IfNotPresent ```7

Container port to serve the Istio CSR gRPC service.

app.server.serving.certificateKeySize¶

Property	app.server.serving.certificateKeySize
Type	number
Default	```yaml IfNotPresent ```8

Parameter for the serving certificate key. For RSA, must be a number of bits >= 2048. For ECDSA, can only be 256 or 384, corresponding to P-256 and P-384 respectively.

app.server.serving.signatureAlgorithm¶

Property	app.server.serving.signatureAlgorithm
Type	string
Default	```yaml IfNotPresent ```9

The type of private key to generate for the serving certificate. Only RSA (default) and ECDSA are supported. NB: This variable is named incorrectly; it controls private key algorithm, not signature algorithm.

app.server.caTrustedNodeAccounts¶

Property	app.server.caTrustedNodeAccounts
Type	string
Default	```yaml [] ```0

A comma-separated list of service accounts that are allowed to use node authentication for CSRs, e.g. "istio-system/ztunnel".

app.istio.revisions[0]¶

Property	app.istio.revisions[0]
Type	string
Default	```yaml [] ```1

app.istio.namespace¶

Property	app.istio.namespace
Type	string
Default	```yaml [] ```2

The namespace where the istio control-plane is running.

app.controller.leaderElectionNamespace¶

Property	app.controller.leaderElectionNamespace
Type	string
Default	```yaml [] ```3

app.controller.configmapNamespaceSelector¶

Property	app.controller.configmapNamespaceSelector
Type	string
Default

If set, limit where Istio CSR creates configmaps with root CA certificates. If unset, configmap created in ALL namespaces.
Example: maistra.io/member-of=istio-system.

app.controller.disableKubernetesClientRateLimiter¶

Property	app.controller.disableKubernetesClientRateLimiter
Type	bool
Default	```yaml [] ```4

Allows you to disable the default Kubernetes client rate limiter if Istio CSR is exceeding the default QPS (5) and Burst (10) limits. For example, in large clusters with many Istio workloads, restarting the Pods may cause Istio CSR to send bursts of Kubernetes API requests that exceed the limits of the default Kubernetes client rate limiter, and Istio CSR will become slow to issue certificates for your workloads. Only disable client rate limiting if the Kubernetes API server supports
API Priority and Fairness,
to avoid overloading the server.

deploymentLabels¶

Property	deploymentLabels
Type	object
Default	```yaml [] ```5

Optional extra labels for deployment.

deploymentAnnotations¶

Property	deploymentAnnotations
Type	object
Default	```yaml [] ```6

Optional extra annotations for deployment.

podLabels¶

Property	podLabels
Type	object
Default	```yaml [] ```7

Optional extra labels for pod.

podAnnotations¶

Property	podAnnotations
Type	object
Default	```yaml [] ```8

Optional extra annotations for pod.

volumes¶

Property	volumes
Type	array
Default	```yaml [] ```9

Optional extra volumes. Useful for mounting custom root CAs.

For example:

yaml ClusterIP0

volumeMounts¶

Property	volumeMounts
Type	array
Default	```yaml ClusterIP ```1

Optional extra volume mounts. Useful for mounting custom root CAs.

For example:

yaml ClusterIP2

resources¶

Property	resources
Type	object
Default	```yaml ClusterIP ```3

Kubernetes pod resources.

For example:

yaml ClusterIP4

securityContext.allowPrivilegeEscalation¶

Property	securityContext.allowPrivilegeEscalation
Type	bool
Default	```yaml ClusterIP ```5

securityContext.readOnlyRootFilesystem¶

Property	securityContext.readOnlyRootFilesystem
Type	bool
Default	```yaml ClusterIP ```6

securityContext.runAsNonRoot¶

Property	securityContext.runAsNonRoot
Type	bool
Default	```yaml ClusterIP ```7

securityContext.capabilities.drop[0]¶

Property	securityContext.capabilities.drop[0]
Type	string
Default	```yaml ClusterIP ```8

affinity¶

Property	affinity
Type	object
Default	```yaml ClusterIP ```9

Expects input structure as per specification.

For example:

yaml 4430

tolerations¶

Property	tolerations
Type	array
Default	```yaml 443 ```1

Expects input structure as per specification.

For example:

yaml 4432

topologySpreadConstraints¶

Property	topologySpreadConstraints
Type	array
Default	```yaml 443 ```3

List of Kubernetes TopologySpreadConstraints. For more information, see TopologySpreadConstraint v1 core.
For example:

yaml 4434

nodeSelector¶

Property	nodeSelector
Type	object
Default	```yaml 443 ```5

Kubernetes node selector: node labels for pod assignment.

commonLabels¶

Property	commonLabels
Type	object
Default	```yaml 443 ```6

Labels to apply to all resources.

extraObjects¶

Property	extraObjects
Type	array
Default	```yaml 443 ```7

Create resources alongside installing Istio CSR, via Helm values. Can accept an array of YAML-formatted resources. Each array entry can include multiple YAML documents, separated by '---'.

For example:

yaml 4438