# Helm chart values which make cert-manager comply with CIS, BSI and NSA
# security benchmarks and other best practices for deploying cert-manager in
# production.
#
# Read the rationale for these values in:
# * https://cert-manager.io/docs/installation/best-practice/
global:
  priorityClassName: system-cluster-critical

replicaCount: 2
podDisruptionBudget:
  enabled: true
  minAvailable: 1
automountServiceAccountToken: false
serviceAccount:
  automountServiceAccountToken: false
volumes:
- name: serviceaccount-token
  projected:
    defaultMode: 0444
    sources:
    - serviceAccountToken:
        expirationSeconds: 3607
        path: token
    - configMap:
        name: kube-root-ca.crt
        items:
        - key: ca.crt
          path: ca.crt
    - downwardAPI:
        items:
        - path: namespace
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
volumeMounts:
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
  name: serviceaccount-token
  readOnly: true

# Enable the default network policy for cert-manager controller
networkPolicy:
  enabled: true
  egress:

  # Required: Kubernetes API requests.
  # Use port 6443 on OpenShift clusters.
  - ports:
    - port: 443
      protocol: TCP

  # Required: DNS look ups.
  - ports:
    - port: 53
      protocol: TCP
    - port: 53
      protocol: UDP

  # Some example egress rules designed to allow cert-manager E2E tests to run
  # with Network policies enabled. In production you should edit or remove these
  # to match your requirements.

  # Example: Allow access to the HTTP01 solver pod for ACME HTTP01 self-checks
  # Only needed if your cluster users use the ACME issuer with HTTP01
  - ports:
    - port: 80
      protocol: TCP

  # Example: Egress to HTTP01 solver pods (dynamic, created by cert-manager)
  # Only needed if your cluster users use the ACME issuer with HTTP01
  # The solver pods are labelled with acme.cert-manager.io/http01-solver: "true"
  # and listen on port 8080.
  - to:
    - podSelector:
        matchLabels:
          acme.cert-manager.io/http01-solver: "true"
    ports:
    - port: 8080
      protocol: TCP

  # Example: In-cluster DNS (Bind) server used by the ACME issuer with DNS01
  - ports:
    - port: 8053
      protocol: UDP
    - port: 8053
      protocol: TCP
    to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: bind

  # Example: In-cluster ACME server used by the ACME issuer
  - ports:
    - port: 14000
      protocol: TCP
    to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: pebble

  # Example: In-cluster Vault servers used by the Vault issuer
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: e2e-vault
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: e2e-vault-mtls

webhook:
  replicaCount: 3
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  automountServiceAccountToken: false
  serviceAccount:
    automountServiceAccountToken: false
  volumes:
  - name: serviceaccount-token
    projected:
      defaultMode: 0444
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          name: kube-root-ca.crt
          items:
          - key: ca.crt
            path: ca.crt
      - downwardAPI:
          items:
          - path: namespace
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
  volumeMounts:
  - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    name: serviceaccount-token
    readOnly: true

  # Enable the default network policy for cert-manager webhook
  networkPolicy:
    enabled: true

cainjector:
  extraArgs:
  - --namespace=cert-manager
  - --enable-certificates-data-source=false
  replicaCount: 2
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  automountServiceAccountToken: false
  serviceAccount:
    automountServiceAccountToken: false
  volumes:
  - name: serviceaccount-token
    projected:
      defaultMode: 0444
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          name: kube-root-ca.crt
          items:
          - key: ca.crt
            path: ca.crt
      - downwardAPI:
          items:
          - path: namespace
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
  volumeMounts:
  - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    name: serviceaccount-token
    readOnly: true

  # Enable the default network policy for cert-manager cainjector
  networkPolicy:
    enabled: true

startupapicheck:
  automountServiceAccountToken: false
  serviceAccount:
    automountServiceAccountToken: false
  volumes:
  - name: serviceaccount-token
    projected:
      defaultMode: 0444
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          name: kube-root-ca.crt
          items:
          - key: ca.crt
            path: ca.crt
      - downwardAPI:
          items:
          - path: namespace
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
  volumeMounts:
  - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    name: serviceaccount-token
    readOnly: true
