Skip to content

Commit 9e96fd7

Browse files
mburke5678mburke5678
authored
Merge pull request #97262 from openshift-cherrypick-robot/cherry-pick-97061-to-enterprise-4.16
[enterprise-4.16] OSDOCS#15157: Added new overridable arguments to the cert-manager controller
2 parents 77d1eff + 8f6ab61 commit 9e96fd7

6 files changed

+309
-69
lines changed

‎modules/cert-manager-configure-cpu-memory.adoc

Lines changed: 22 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="cert-manager-configure-cpu-memory_{context}"]
77
= Overriding CPU and memory limits for the cert-manager components
88

9-
After installing the {cert-manager-operator}, you can configure the CPU and memory limits from the {cert-manager-operator} API for the cert-manager components such as cert-manager controller, CA injector, and Webhook.
9+
After installing the {cert-manager-operator}, you can configure the CPU and memory limits from the {cert-manager-operator} API for the cert-manager components, such as the cert-manager controller, CA injector, and Webhook.
1010

1111
.Prerequisites
1212

@@ -80,48 +80,37 @@ $ oc get deployment -n cert-manager -o yaml
8080

8181
. To configure the CPU and memory limits for the cert-manager controller, CA injector, and Webhook, enter the following command:
8282
+
83-
[source,yaml]
83+
[source,terminal]
8484
----
8585
$ oc patch certmanager.operator cluster --type=merge -p="
8686
spec:
8787
controllerConfig:
88-
overrideResources:
89-
limits: <1>
90-
cpu: 200m <2>
91-
memory: 64Mi <3>
92-
requests: <4>
93-
cpu: 10m <2>
94-
memory: 16Mi <3>
88+
overrideResources: <1>
89+
limits:
90+
cpu: 200m
91+
memory: 64Mi
92+
requests:
93+
cpu: 10m
94+
memory: 16Mi
9595
webhookConfig:
9696
overrideResources:
97-
limits: <5>
98-
cpu: 200m <6>
99-
memory: 64Mi <7>
100-
requests: <8>
101-
cpu: 10m <6>
102-
memory: 16Mi <7>
97+
limits:
98+
cpu: 200m
99+
memory: 64Mi
100+
requests:
101+
cpu: 10m
102+
memory: 16Mi
103103
cainjectorConfig:
104104
overrideResources:
105-
limits: <9>
106-
cpu: 200m <10>
107-
memory: 64Mi <11>
108-
requests: <12>
109-
cpu: 10m <10>
110-
memory: 16Mi <11>
105+
limits:
106+
cpu: 200m
107+
memory: 64Mi
108+
requests:
109+
cpu: 10m
110+
memory: 16Mi
111111
"
112112
----
113-
<1> Defines the maximum amount of CPU and memory that a single container in a cert-manager controller pod can request.
114-
<2> You can specify the CPU limit that a cert-manager controller pod can request. The default value is `10m`.
115-
<3> You can specify the memory limit that a cert-manager controller pod can request. The default value is `32Mi`.
116-
<4> Defines the amount of CPU and memory set by scheduler for the cert-manager controller pod.
117-
<5> Defines the maximum amount of CPU and memory that a single container in a CA injector pod can request.
118-
<6> You can specify the CPU limit that a CA injector pod can request. The default value is `10m`.
119-
<7> You can specify the memory limit that a CA injector pod can request. The default value is `32Mi`.
120-
<8> Defines the amount of CPU and memory set by scheduler for the CA injector pod.
121-
<9> Defines the maximum amount of CPU and memory Defines the maximum amount of CPU and memory that a single container in a Webhook pod can request.
122-
<10> You can specify the CPU limit that a Webhook pod can request. The default value is `10m`.
123-
<11> You can specify the memory limit that a Webhook pod can request. The default value is `32Mi`.
124-
<12> Defines the amount of CPU and memory set by scheduler for the Webhook pod.
113+
<1> For information about the overridable resource parameters, see "Overridable resource parameters for the cert-manager components" in "Explanation of fields in the CertManager custom resource".
125114
+
126115
.Example output
127116
[source,terminal]

‎modules/cert-manager-explanation-of-certmanager-cr-fields.adoc

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="cert-manager-explanation-of-certmanager-cr-fields_{context}"]
7+
= Explanation of fields in the CertManager custom resource
8+
9+
You can use the `CertManager` custom resource (CR) to configure the following core components of the {cert-manager-operator}:
10+
11+
* Cert-manager controller: You can use the `spec.controllerConfig` field to configure the cert‑manager controller pod.
12+
* Webhook: You can use the `spec.webhookConfig` field to configure the webhook pod, which handles validation and mutation requests.
13+
* CA injector: You can use the `spec.cainjectorConfig` field to configure the CA injector pod.
14+
15+
[id="cert-manager-common-configuration-fields_{context}"]
16+
== Common configurable fields in the CertManager CR for the cert-manager components
17+
18+
The following table lists the common fields that you can configure in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR.
19+
20+
.Common configurable fields in the CertManager CR for the cert-manager components
21+
[cols=".^2,.^2,.^6a",options="header"]
22+
|====
23+
24+
|Field|Type|Description
25+
26+
|`overrideArgs`
27+
|`string`
28+
|You can override the supported arguments for the cert-manager components.
29+
30+
|`overrideEnv`
31+
|`dict`
32+
|You can override the supported environment variables for the cert-manager controller. This field is only supported for the cert-manager controller component.
33+
34+
|`overrideResources`
35+
|`object`
36+
|You can configure the CPU and memory limits for the cert-manager components.
37+
38+
|`overrideScheduling`
39+
|`object`
40+
|You can configure the pod scheduling constraints for the cert-manager components.
41+
42+
|====
43+
44+
[id="cert-manager-overridable-arguments_{context}"]
45+
== Overridable arguments for the cert-manager components
46+
47+
You can configure the overridable arguments for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR.
48+
49+
The following table describes the overridable arguments for the cert-manager components:
50+
51+
.Overridable arguments the cert-manager components
52+
[cols=".^5a,.^2,.^4a",options="header"]
53+
|====
54+
55+
|Argument|Component|Description
56+
57+
|`--dns01-recursive-nameservers=<server_address>`
58+
|Controller
59+
|Provide a comma-separated list of nameservers to query for the DNS-01 self check. The nameservers can be specified either as `<host>:<port>`, for example, `1.1.1.1:53`, or use DNS over HTTPS (DoH), for example, `\https://1.1.1.1/dns-query`.
60+
61+
[NOTE]
62+
====
63+
DNS over HTTPS (DoH) is supported starting only from {cert-manager-operator} version 1.13.0 and later.
64+
====
65+
66+
|`--dns01-recursive-nameservers-only`
67+
|Controller
68+
|Specify to only use recursive nameservers instead of checking the authoritative nameservers associated with that domain.
69+
70+
|`--acme-http01-solver-nameservers=<host>:<port>`
71+
|Controller
72+
|Provide a comma-separated list of `<host>:<port>` nameservers to query for the Automated Certificate Management Environment (ACME) HTTP01 self check. For example, `--acme-http01-solver-nameservers=1.1.1.1:53`.
73+
74+
|`--metrics-listen-address=<host>:<port>`
75+
|Controller
76+
|Specify the host and port for the metrics endpoint. The default value is `--metrics-listen-address=0.0.0.0:9402`.
77+
78+
|`--issuer-ambient-credentials`
79+
|Controller
80+
|You can use this argument to configure an ACME Issuer to solve DNS-01 challenges by using ambient credentials.
81+
82+
|`--enable-certificate-owner-ref`
83+
|Controller
84+
|This argument sets the certificate resource as an owner of the secret where the TLS certificate is stored. For more information, see "Deleting a TLS secret automatically upon Certificate removal".
85+
86+
|`--acme-http01-solver-resource-limits-cpu`
87+
|Controller
88+
|Defines the maximum CPU limit for ACME HTTP‑01 solver pods. The default value is `100m`.
89+
90+
|`--acme-http01-solver-resource-limits-memory`
91+
|Controller
92+
|Defines the maximum memory limit for ACME HTTP‑01 solver pods. The default value is `64Mi`.
93+
94+
|`--acme-http01-solver-resource-request-cpu`
95+
|Controller
96+
|Defines the minimum CPU request for ACME HTTP‑01 solver pods. The default value is `10m`.
97+
98+
|`--acme-http01-solver-resource-request-memory`
99+
|Controller
100+
|Defines the minimum memory request for ACME HTTP‑01 solver pods. The default value is `64Mi`.
101+
102+
|`--v=<verbosity_level>`
103+
|Controller, Webhook, CA injector
104+
|Specify the log level verbosity to determine the verbosity of log messages.
105+
106+
|====
107+
108+
[id="cert-manager-overridable-env-variables_{context}"]
109+
== Overridable environment variables for the cert-manager controller
110+
111+
You can configure the overridable environment variables for the cert-manager controller in the `spec.controllerConfig.overrideEnv` field in the `CertManager` CR.
112+
113+
The following table describes the overridable environment variables for the cert-manager controller:
114+
115+
.Overridable environment variables for the cert-manager controller
116+
[cols=".^2,.^2",options="header"]
117+
|====
118+
119+
|Environment variable|Description
120+
121+
|`HTTP_PROXY`
122+
|Proxy server for outgoing HTTP requests.
123+
124+
|`HTTPS_PROXY`
125+
|Proxy server for outgoing HTTPS requests.
126+
127+
|`NO_PROXY`
128+
|Comma‑separated list of hosts that bypass the proxy.
129+
130+
|====
131+
132+
[id="cert-manager-overridable-resource-parameters_{context}"]
133+
== Overridable resource parameters for the cert-manager components
134+
135+
You can configure the CPU and memory limits for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR.
136+
137+
The following table describes the overridable resource parameters for the cert-manager components:
138+
139+
.Overridable resource parameters for the cert-manager components
140+
[cols=".^2,.^2",options="header"]
141+
|====
142+
143+
|Field|Description
144+
145+
|`overrideResources.limits.cpu`
146+
|Defines the maximum amount of CPU that a component pod can use.
147+
148+
|`overrideResources.limits.memory`
149+
|Defines the maximum amount of memory that a component pod can use.
150+
151+
|`overrideResources.requests.cpu`
152+
|Defines the minimum amount of CPU requested by the scheduler for a component pod.
153+
154+
|`overrideResources.requests.memory`
155+
|Defines the minimum amount of memory requested by the scheduler for a component pod.
156+
157+
|====
158+
159+
[id="cert-manager-overridable-scheduling-parameters_{context}"]
160+
== Overridable scheduling parameters for the cert-manager components
161+
162+
You can configure the pod scheduling constrainsts for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig` field, and `spec.cainjectorConfig` sections in the `CertManager` CR.
163+
164+
The following table describes the pod scheduling parameters for the cert-manager components:
165+
166+
.Overridable scheduling parameters for the cert-manager components
167+
[cols=".^2,.^2",options="header"]
168+
|====
169+
170+
|Field|Description
171+
172+
|`overrideScheduling.nodeSelector`
173+
|Key‑value pairs to constrain pods to specific nodes.
174+
175+
|`overrideScheduling.tolerations`
176+
|List of tolerations to schedule pods on tainted nodes.
177+
178+
|====

‎modules/cert-manager-override-arguments.adoc

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -35,29 +35,23 @@ spec:
3535
controllerConfig:
3636
overrideArgs:
3737
- '--dns01-recursive-nameservers=<server_address>' <1>
38-
- '--dns01-recursive-nameservers-only' <2>
39-
- '--acme-http01-solver-nameservers=<host>:<port>' <3>
40-
- '--v=<verbosity_level>' <4>
41-
- '--metrics-listen-address=<host>:<port>' <5>
42-
- '--issuer-ambient-credentials' <6>
38+
- '--dns01-recursive-nameservers-only'
39+
- '--acme-http01-solver-nameservers=<host>:<port>'
40+
- '--v=<verbosity_level>'
41+
- '--metrics-listen-address=<host>:<port>'
42+
- '--issuer-ambient-credentials'
43+
- '--acme-http01-solver-resource-limits-cpu=<quantity>'
44+
- '--acme-http01-solver-resource-limits-memory=<quantity>'
45+
- '--acme-http01-solver-resource-request-cpu=<quantity>'
46+
- '--acme-http01-solver-resource-request-memory=<quantity>'
4347
webhookConfig:
4448
overrideArgs:
45-
- '--v=4' <4>
49+
- '--v=<verbosity_level>'
4650
cainjectorConfig:
4751
overrideArgs:
48-
- '--v=2' <4>
52+
- '--v=<verbosity_level>'
4953
----
50-
<1> Provide a comma-separated list of nameservers to query for the DNS-01 self check. The nameservers can be specified either as `<host>:<port>`, for example, `1.1.1.1:53`, or use DNS over HTTPS (DoH), for example, `https://1.1.1.1/dns-query`.
51-
<2> Specify to only use recursive nameservers instead of checking the authoritative nameservers associated with that domain.
52-
<3> Provide a comma-separated list of `<host>:<port>` nameservers to query for the Automated Certificate Management Environment (ACME) HTTP01 self check. For example, `--acme-http01-solver-nameservers=1.1.1.1:53`.
53-
<4> Specify to set the log level verbosity to determine the verbosity of log messages.
54-
<5> Specify the host and port for the metrics endpoint. The default value is `--metrics-listen-address=0.0.0.0:9402`.
55-
<6> You must use the `--issuer-ambient-credentials` argument when configuring an ACME Issuer to solve DNS-01 challenges by using ambient credentials.
56-
+
57-
[NOTE]
58-
====
59-
DNS over HTTPS (DoH) is supported starting only from {cert-manager-operator} version 1.13.0 and later.
60-
====
54+
<1> For information about the overridable aruguments, see "Overridable arguments for the cert-manager components" in "Explanation of fields in the CertManager custom resource".
6155

6256
. Save your changes and quit the text editor to apply your changes.
6357

‎modules/cert-manager-override-environment-variables.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ spec:
4343
----
4444
<1> Replace `<proxy_url>` with the proxy server URL.
4545
<2> Replace `<ignore_proxy_domains>` with a comma separated list of domains. These domains are ignored by the proxy server.
46+
+
47+
[NOTE]
48+
====
49+
For more information about the overridable environment variables, see "Overridable environment variables for the cert-manager components" in "Explanation of fields in the CertManager custom resource".
50+
====
4651

4752
. Save your changes and quit the text editor to apply your changes.
4853

‎modules/cert-manager-override-scheduling.adoc

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="cert-manager-override-scheduling_{context}"]
77
= Configuring scheduling overrides for cert-manager components
88

9-
You can configure the pod scheduling from the {cert-manager-operator} API for the {cert-manager-operator} components such as cert-manager controller, CA injector, and Webhook.
9+
You can configure the pod scheduling from the {cert-manager-operator} API for the {cert-manager-operator} components, such as the cert-manager controller, CA injector, and Webhook.
1010

1111
.Prerequisites
1212

@@ -22,37 +22,32 @@ You can configure the pod scheduling from the {cert-manager-operator} API for th
2222
$ oc patch certmanager.operator cluster --type=merge -p="
2323
spec:
2424
controllerConfig:
25-
overrideScheduling:
25+
overrideScheduling: <1>
2626
nodeSelector:
27-
node-role.kubernetes.io/control-plane: '' <1>
27+
node-role.kubernetes.io/control-plane: ''
2828
tolerations:
2929
- key: node-role.kubernetes.io/master
3030
operator: Exists
31-
effect: NoSchedule <2>
31+
effect: NoSchedule
3232
webhookConfig:
3333
overrideScheduling:
3434
nodeSelector:
35-
node-role.kubernetes.io/control-plane: '' <3>
35+
node-role.kubernetes.io/control-plane: ''
3636
tolerations:
3737
- key: node-role.kubernetes.io/master
3838
operator: Exists
39-
effect: NoSchedule <4>
39+
effect: NoSchedule
4040
cainjectorConfig:
4141
overrideScheduling:
4242
nodeSelector:
43-
node-role.kubernetes.io/control-plane: '' <5>
43+
node-role.kubernetes.io/control-plane: ''
4444
tolerations:
4545
- key: node-role.kubernetes.io/master
4646
operator: Exists
47-
effect: NoSchedule" <6>
47+
effect: NoSchedule"
48+
"
4849
----
49-
<1> Defines the `nodeSelector` for the cert-manager controller deployment.
50-
<2> Defines the `tolerations` for the cert-manager controller deployment.
51-
<3> Defines the `nodeSelector` for the cert-manager webhook deployment.
52-
<4> Defines the `tolerations` for the cert-manager webhook deployment.
53-
<5> Defines the `nodeSelector` for the cert-manager cainjector deployment.
54-
<6> Defines the `tolerations` for the cert-manager cainjector deployment.
55-
50+
<1> For information about the overridable scheduling parameters, see "Overridable scheduling parameters for the cert-manager components" in "Explanation of fields in the CertManager custom resource".
5651
5752
.Verification
5853

0 commit comments

Comments
 (0)