-
Notifications
You must be signed in to change notification settings - Fork 392
Create redirects for cert-manager annotations #1696
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
8 commits
Select commit
Hold shift + click to select a range
2095df4
chore(docs): Remove leading space in backticks
jsoref d32b1db
docs: Fix typo in gateway docs
jsoref 3b6b531
docs: Harmonize Ingress+Gateway docs
jsoref 2e170bb
chore(docs): Add backticks
jsoref d0cac09
chore(docs): Fix punctuation
jsoref 036c7df
spelling: certificate
jsoref b3ff70d
Document resource annotations
jsoref 994b6d0
Let netlify try to answer questions about kubernetes.io annotations
jsoref File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,334 @@ | ||
| --- | ||
| title: Annotations | ||
| description: 'cert-manager configuration: Annotations' | ||
| # This list corresponds to items in public/_redirects `# Document cert-manager.io annotations` | ||
| # Items come from https://github.com/search?q=repo%3Acert-manager%2Fcert-manager%20%22AnnotationKey%20%3D%20%22&type=code | ||
| # Please keep these sections synced date | ||
| --- | ||
|
|
||
| You can generally tune [Certificate](../usage/certificate.md) requests by adding annotations to | ||
| [Ingress](../usage/ingress.md) and [Gateway](../usage/gateway.md) resources. | ||
|
|
||
| ## acme.cert-manager.io/http01-edit-in-place | ||
| - [Ingress](../usage/ingress.md) | ||
|
|
||
| this controls whether the ingress is modified 'in-place', or a new one is created | ||
| specifically for the HTTP01 challenge. If present, and set to `"true"`, the existing | ||
| ingress will be modified. Any other value, or the absence of the annotation assumes | ||
| `"false"`. | ||
| This annotation will also add the annotation | ||
| `"cert-manager.io/issue-temporary-certificate": "true"` onto created certificates | ||
| which will cause a | ||
| [temporary certificate](../usage/certificate.md#temporary-certificates-whilst-issuing) | ||
| to be set on the resulting `Secret` until the final signed certificate has been | ||
| returned. | ||
| This is useful for keeping compatibility with the `ingress-gce` component. | ||
|
|
||
| ## acme.cert-manager.io/http01-ingress-class | ||
| - [Ingress](../usage/ingress.md) | ||
|
|
||
| this annotation allows you to configure the ingress class that will be used to | ||
| solve challenges for this ingress. Customizing this is useful when you are | ||
| trying to secure internal services, and need to solve challenges using a | ||
| different ingress class to that of the ingress. If not specified and the | ||
| `acme-http01-edit-in-place` annotation is not set, this defaults to the ingress | ||
| class defined in the Issuer resource. | ||
|
|
||
| ## cert-manager.io/allow-direct-injection | ||
| - `Secret` | ||
|
|
||
| allows the `cainjector` to inject secret `CA certificate` contents into other objects that have `cert-manager.io/inject-ca-from-secret`. | ||
|
|
||
| ## cert-manager.io/alt-names | ||
| - [Certificate](../usage/certificate.md) | ||
|
|
||
| this annotation allows you to configure `spec.dnsNames` field for | ||
| the Certificate to be generated. | ||
| Supports comma-separated values e.g. "example.com,example.org" | ||
|
|
||
| ## cert-manager.io/certificate-name | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| name of the related certificate. | ||
|
|
||
| ## cert-manager.io/certificate-revision | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| the iteration the certificate request. | ||
|
|
||
| ## cert-manager.io/cluster-issuer | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| the name of a cert-manager.io ClusterIssuer that should issue the required certificate. | ||
|
|
||
| ## cert-manager.io/common-name | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.commonName` for the Certificate | ||
| to be generated. | ||
|
|
||
| ## cert-manager.io/duration | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.duration` field for the | ||
| Certificate to be generated. | ||
|
|
||
| ## cert-manager.io/email-sans | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.emailAddresses` field for | ||
| the Certificate to be generated. | ||
| Supports comma-separated values e.g. "me@example.com,you@example.com" | ||
|
|
||
| ## cert-manager.io/ip-sans | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.ipAddresses` field for | ||
| the Certificate to be generated. | ||
| Supports comma-separated values e.g. "198.51.100.1,198.51.100.2" | ||
|
|
||
| ## cert-manager.io/issuer-group | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| the API group of the external issuer controller, for example | ||
| `awspca.cert-manager.io`. This is only necessary for out-of-tree issuers. | ||
|
|
||
| ## cert-manager.io/issuer-kind | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| the kind of the external issuer resource, for example `AWSPCAIssuer`. This | ||
| is only necessary for out-of-tree issuers. | ||
|
|
||
| ## cert-manager.io/issuer-name | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| the name of a cert-manager.io Issuer that should issue the required certificate. | ||
|
|
||
| ## cert-manager.io/issuer | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| the name of the issuer that should issue the required certificate. | ||
|
|
||
| ## cert-manager.io/issue-temporary-certificate | ||
| - [Certificate](../usage/certificate.md) | ||
|
|
||
| cause a [temporary | ||
| certificate](../usage/certificate.md#temporary-certificates-whilst-issuing) to | ||
| be set on the resulting `Secret` until the final signed certificate has been | ||
| returned. | ||
| This is useful for keeping compatibility with the `ingress-gce` component. | ||
|
|
||
| ## cert-manager.io/inject-apiserver-ca | ||
|
|
||
| cause the `cainjector` to inject the **CA certificate** for the Kubernetes apiserver into the resource. | ||
|
|
||
| ## cert-manager.io/inject-ca-from | ||
|
|
||
| cause the `cainjector` to inject a certificate with **CA certificate**. ?? | ||
|
|
||
| ## cert-manager.io/inject-ca-from-secret | ||
|
|
||
| cause the `cainjector` to inject a **CA Certificate** from a secret. | ||
|
|
||
| ## cert-manager.io/private-key-algorithm | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.privateKey.algorithm` field to set | ||
| the algorithm for private key generation for a Certificate. | ||
| Valid values are `RSA`, `ECDSA` and `Ed25519`. | ||
| If unset an algorithm `RSA` will be used. | ||
|
|
||
| ## cert-manager.io/private-key-encoding | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.privateKey.encoding` field to set | ||
| the encoding for private key generation for a Certificate. | ||
| Valid values are `PKCS1` and `PKCS8`. If unset an algorithm `PKCS1` will be used. | ||
|
|
||
| ## cert-manager.io/private-key-rotation-policy | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.privateKey.rotationPolicy` field | ||
| to set the rotation policy of the private key for a Certificate. | ||
| Valid values are `Never` and `Always`. If unset a rotation policy `Never` will | ||
| be used. | ||
|
|
||
| ## cert-manager.io/private-key-secret-name | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| references the secret that stores the private key used to sign a x509 | ||
| certificate signing request. | ||
|
|
||
| ## cert-manager.io/private-key-size | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.privateKey.size` field to set the | ||
| size of the private key for a Certificate. | ||
| If algorithm is set to `RSA`, valid values are `2048`, `4096` or `8192`, and | ||
| will default to `2048` if not specified. | ||
| If algorithm is set to `ECDSA`, valid values are `256`, `384` or `521`, and | ||
| will default to `256` if not specified. | ||
| If algorithm is set to `Ed25519`, size is ignored. | ||
|
|
||
| ## cert-manager.io/renew-before | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.renewBefore` field for the | ||
| Certificate to be generated. | ||
|
|
||
| ## cert-manager.io/renew-before-percentage | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.renewBeforePercentage` field for the | ||
| Certificate to be generated. | ||
|
|
||
| ## cert-manager.io/revision-history-limit | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.revisionHistoryLimit` field to | ||
| limit the number of CertificateRequests to be kept for a Certificate. | ||
| Minimum value is 1. If unset all CertificateRequests will be kept. | ||
|
|
||
| ## cert-manager.io/secret-template | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to set the secretTemplate field in the generated Certificate. | ||
|
|
||
| ## cert-manager.io/subject-countries | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.subject.countries` field for the | ||
| Certificate to be generated. | ||
| Supports comma-separated values e.g. "Country 1,Country 2" | ||
|
|
||
| ## cert-manager.io/subject-localities | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.subject.localities` field for the | ||
| Certificate to be generated. | ||
| Supports comma-separated values e.g. "City 1,City 2" | ||
|
|
||
| ## cert-manager.io/subject-organizationalunits | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.subject.organizationalUnits` field | ||
| for the Certificate to be generated. | ||
| Supports comma-separated values e.g. "IT Services,Cloud Services" | ||
|
|
||
| ## cert-manager.io/subject-organizations | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.subject.organizations` field for | ||
| the Certificate to be generated. | ||
| Supports comma-separated values e.g. "Company 1,Company 2" | ||
|
|
||
| ## cert-manager.io/subject-postalcodes | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.subject.postalCodes` field for | ||
| the Certificate to be generated. | ||
| Supports comma-separated values e.g. "123ABC,456DEF" | ||
|
|
||
| ## cert-manager.io/subject-provinces | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to | ||
| configure `spec.subject.provinces` field for the Certificate to be generated. | ||
| Supports comma-separated values e.g. "Province 1,Province 2" | ||
|
|
||
| ## cert-manager.io/subject-serialnumber | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to | ||
| configure `spec.subject.serialNumber` field for the Certificate to be | ||
| generated. | ||
| Supports comma-separated values e.g. "10978342379280287615,1111144445555522228888" | ||
|
|
||
| ## cert-manager.io/subject-streetaddresses | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to | ||
| configure `spec.subject.streetAddresses` field for the Certificate to be | ||
| generated. | ||
| Supports comma-separated values e.g. "123 Example St,456 Other Blvd" | ||
|
|
||
| ## cert-manager.io/uri-sans | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.uris` field for | ||
| the Certificate to be generated. | ||
| Supports comma-separated values e.g. "spiffe://cluster.local/ns/sandbox/sa/example" | ||
|
|
||
| ## cert-manager.io/usages | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| this annotation allows you to configure `spec.usages` field for the Certificate | ||
| to be generated. Pass a string with comma-separated values i.e. | ||
| "key agreement,digital signature, server auth". | ||
|
|
||
| ## experimental.cert-manager.io/request-duration | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| annotation used to request a particular duration. | ||
|
|
||
| ## experimental.cert-manager.io/request-is-ca | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| annotation used to request a certificate be marked as CA. | ||
|
|
||
| ## experimental.cert-manager.io/private-key-secret-name | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| annotation key used by the 'self signing' issuer type to self-sign certificates to reference a Secret resource containing the private key used to sign the request. | ||
|
|
||
| ## kubernetes.io/ingress.class | ||
| - [Ingress](../usage/ingress.md) | ||
|
|
||
| [deprecated](https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation). You should use `spec`.`ingressClassName` instead. | ||
|
|
||
| ## kubernetes.io/tls-acme | ||
| - [Ingress](../usage/ingress.md) | ||
|
|
||
| this annotation requires additional configuration of the | ||
| [ingress-shim](../usage/ingress.md#optional-configuration). | ||
| Namely, a default `Issuer` must be specified as arguments to the ingress-shim | ||
| container. | ||
|
|
||
| ## venafi.cert-manager.io/custom-fields | ||
| - [Certificate](../usage/certificate.md) | ||
| - [Ingress](../usage/ingress.md) | ||
| - [Gateway](../usage/gateway.md) | ||
|
|
||
| pass JSON encoded custom fields to the Venafi issuer. | ||
|
|
||
| ## venafi.cert-manager.io/pickup-id | ||
| - [CertificateRequest](../usage/certificaterequest.md) | ||
|
|
||
| records the Venafi Pickup ID of a certificate signing request. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I came across this today, I'm not sure I understand this annotation.
Doesn't
cert-manager.io/alt-namesbelong to the Secret resource?Looking at internal/controller/certificates/secrets.go, the only place this annotation is ever used is when the "secret" controller creates a Secret out of a given Certificate.
This annotation can't be used in the Issuer's
secretTemplate, either.I think the description should be:
I've seen people looking for ways to add extra SANs in cert-manager/cert-manager#5897 and cert-manager/cert-manager#6190, but this feature hasn't landed yet.
WDYT? @jsoref
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@maelvls: Yes, I think that's right. Although I wish
spec.dnsNameswas a link to something.