added v5.0.2 cert-manager

charts/cert-manager/latest/Chart.yaml

 name: cert-manager
-version: v0.4.1
-appVersion: v0.4.1
+version: v0.5.2
+appVersion: v0.5.2
 description: A Helm chart for cert-manager
 home: https://github.com/jetstack/cert-manager
 keywords:
@@ -10,7 +10,7 @@ keywords:
   - tls
 sources:
   - https://github.com/jetstack/cert-manager
-icon: https://letsencrypt.org/images/letsencrypt-logo-horizontal.svg
+icon: file://../letsencrypt-logo-horizontal.svg
 maintainers:
   - name: munnerz
     email: james@jetstack.io

charts/cert-manager/latest/README.md

@@ -42,7 +42,7 @@ The following table lists the configurable parameters of the cert-manager chart
 | Parameter | Description | Default |
 | --------- | ----------- | ------- |
 | `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
-| `image.tag` | Image tag | `v0.4.1` |
+| `image.tag` | Image tag | `v0.5.2` |
 | `image.pullPolicy` | Image pull policy | `IfNotPresent` |
 | `replicaCount`  | Number of cert-manager replicas  | `1` |
 | `createCustomResource` | Create CRD/TPR with this release | `true` |
@@ -54,7 +54,7 @@ The following table lists the configurable parameters of the cert-manager chart
 | `rbac.create` | If `true`, create and use RBAC resources | `true` |
 | `serviceAccount.create` | If `true`, create a new service account | `true` |
 | `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template |  |
-| `resources` | CPU/memory resource requests/limits | `requests: {cpu: 10m, memory: 32Mi}` |
+| `resources` | CPU/memory resource requests/limits | |
 | `nodeSelector` | Node labels for pod assignment | `{}` |
 | `affinity` | Node affinity for pod assignment | `{}` |
 | `tolerations` | Node tolerations for pod assignment | `[]` |
@@ -69,6 +69,14 @@ The following table lists the configurable parameters of the cert-manager chart
 | `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
 | `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
 | `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
+| `webhook.enabled` | Toggles whether the validating webhook component should be installed | `false` |
+| `webhook.replicaCount` | Number of cert-manager webhook replicas | `1` |
+| `webhook.podAnnotations` | Annotations to add to the webhook pods | `{}` |
+| `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` |
+| `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | |
+| `webhook.image.repository` | Webhook image repository | `quay.io/jetstack/cert-manager-webhook` |
+| `webhook.image.tag` | Webhook image tag | `v0.5.2` |
+| `webhook.image.pullPolicy` | Webhook image pull policy | `IfNotPresent` |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
 

charts/cert-manager/latest/questions.yml

@@ -14,30 +14,78 @@ questions:
     type: string
     label: Cert-Manager Docker Image Name
   - variable: image.tag
-    default: "v0.4.1"
+    default: "v0.5.2"
     description: "Cert-Manager Docker image tag"
     type: string
     label: Cert-Manager Image Tag
+  - variable: webhook.image.repository
+    default: "quay.io/jetstack/cert-manager-webhook"
+    description: "cert-manager webhook image name"
+    type: string
+    label: Cert-Manager Webhook Image Name
+    show_if: webhook.enabled=true&&defaultImage=false
+  - variable: webhook.image.tag
+    default: "v0.5.2"
+    description: "cert-manager webhook image tag"
+    type: string
+    label: Cert-Manager Webhook Image Tag
+    show_if: webhook.enabled=true&&defaultImage=false
+- variable: replicaCount
+  default: 1
+  description: "Replica count of cert-manager"
+  min: 1
+  max: 5
+  label: Replica count of cert-manager
+  type: int
+  group: "Settings"
+- variable: clusterissuerEnabled
+  default: true
+  description: "Create Default Cluster Issuer"
+  label: Create Default Cluster Issuer
+  type: boolean
+  group: "Settings"
+  show_subquestion_if: true
+  subquestions:
+  - variable: ingressShim.defaultIssuerName
+    default: "letsencrypt-staging"
+    required: true
+    type: enum
+    description: "Let's Encrypt ACME clients, use staging environment to avoid hitting rate limits"
+    label: Let's Encrypt Cluster Issuer clients
+    group: "Settings"
+    options:
+    - "letsencrypt-staging"
+    - "letsencrypt-prod"
+  - variable: letsencrypt.email
+    default: ""
+    required: true
+    type: string
+    description: "Let's Encrypt register email, for https://letsencrypt.org/docs/staging-environment"
+    label: Let's Encrypt Client Register Email
+    group: "Settings"
 - variable: createCustomResource
   default: true
   description: "Create Custom Resource Definition(CRD) of certmanager"
   label: Create Custom Resource Definition(CRD)
   type: boolean
-  group: "Settings"
-- variable: ingressShim.defaultIssuerName
-  default: "letsencrypt-staging"
-  required: true
-  type: enum
-  description: "Let's Encrypt ACME clients, use staging environment to avoid hitting rate limits"
-  label: Let's Encrypt Cluster Issuer clients
-  group: "Settings"
-  options:
-  - "letsencrypt-staging"
-  - "letsencrypt-prod"
-- variable: letsencrypt.email
-  default: ""
-  required: true
-  type: string
-  description: "Let's Encrypt register email, for https://letsencrypt.org/docs/staging-environment"
-  label: Let's Encrypt Client Register Email
-  group: "Settings"
+  group: "CRD Settings"
+- variable: webhook.enabled
+  default: false
+  description: "Enabled Webhook"
+  label: Enabled Webhook
+  type: boolean
+  show_subquestion_if: true
+  group: "Webhook Settings"
+  subquestions:
+  - variable: webhook.replicaCount
+    default: 1
+    description: "Replica count of webhook pod"
+    min: 1
+    max: 5
+    label: Webhook Replica count
+    type: int
+  - variable: webhook.extraArgs
+    default: "[]"
+    description: "Optional additional arguments for webhook"
+    label: Optional Additional Arguments for Webhook
+    type: string

charts/cert-manager/latest/requirements.lock

+dependencies:
+- name: webhook
+  repository: file://./webhook
+  version: v0.5.2
+digest: sha256:efe1f1adfd027b361934a3d745760b10d947a050048e5046b257e79cd5c40ea2
+generated: 2018-11-23T14:56:41.555379+08:00

charts/cert-manager/latest/requirements.yaml

+# requirements.yaml
+dependencies:
+- name: webhook
+  version: "v0.5.2"
+  repository: "file://./webhook"
+  condition: webhook.enabled

charts/cert-manager/latest/templates/00-namespace.yaml

@@ -3,4 +3,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: {{ .Release.Namespace | quote }}
+  labels:
+    name: {{ .Release.Namespace | quote }}
+    certmanager.k8s.io/disable-validation: "true"
 {{- end }}

charts/cert-manager/latest/templates/certificate-crd.yaml

@@ -3,14 +3,14 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: certificates.certmanager.k8s.io
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
   labels:
     app: {{ template "cert-manager.name" . }}
     chart: {{ template "cert-manager.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-  annotations:
-    "helm.sh/hook": "crd-install"
-    "helm.sh/hook-delete-policy": "before-hook-creation"
 spec:
   group: certmanager.k8s.io
   version: v1alpha1

charts/cert-manager/latest/templates/clusterissuer-crd.yaml

@@ -3,14 +3,14 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: clusterissuers.certmanager.k8s.io
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
   labels:
     app: {{ template "cert-manager.name" . }}
     chart: {{ template "cert-manager.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-  annotations:
-    "helm.sh/hook": "crd-install"
-    "helm.sh/hook-delete-policy": "before-hook-creation"
 spec:
   group: certmanager.k8s.io
   version: v1alpha1

charts/cert-manager/latest/templates/deployment.yaml

@@ -60,6 +60,14 @@ spec:
           - --default-acme-issuer-dns01-provider-name={{ .defaultACMEDNS01ChallengeProvider }}
           {{- end }}
           {{- end }}
+          {{- if .Values.affinity }}
+          affinity:
+{{ toYaml .Values.affinity | indent 10 }}
+          {{- end }}
+          {{- if .Values.tolerations }}
+          tolerations:
+{{ toYaml .Values.tolerations | indent 10 }}
+          {{- end }}
           env:
           - name: POD_NAMESPACE
             valueFrom:

charts/cert-manager/latest/templates/issuer-crd.yaml

@@ -3,13 +3,14 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: issuers.certmanager.k8s.io
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
   labels:
     app: {{ template "cert-manager.name" . }}
     chart: {{ template "cert-manager.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-  annotations:
-    "helm.sh/hook": crd-install
 spec:
   group: certmanager.k8s.io
   version: v1alpha1

charts/cert-manager/latest/templates/rbac.yaml

@@ -13,12 +13,7 @@ rules:
     resources: ["certificates", "issuers", "clusterissuers"]
     verbs: ["*"]
   - apiGroups: [""]
-    # TODO: remove endpoints once 0.4 is released. We include it here in case
-    # users use the 'master' version of the Helm chart with a 0.2.x release of
-    # cert-manager that still performs leader election with Endpoint resources.
-    # We advise users don't do this, but some will anyway and this will reduce
-    # friction.
-    resources: ["endpoints", "configmaps", "secrets", "events", "services", "pods"]
+    resources: ["configmaps", "secrets", "events", "services", "pods"]
     verbs: ["*"]
   - apiGroups: ["extensions"]
     resources: ["ingresses"]

charts/cert-manager/latest/values.yaml

@@ -5,7 +5,7 @@ replicaCount: 1
 
 image:
   repository: quay.io/jetstack/cert-manager-controller
-  tag: v0.4.1
+  tag: v0.5.2
   pullPolicy: IfNotPresent
 
 createCustomResource: true
@@ -69,11 +69,32 @@ ingressShim:
   defaultACMEChallengeType: "http01"
   # defaultACMEDNS01ChallengeProvider: ""
 
+webhook:
+  enabled: false
+  replicaCount: 1
+  podAnnotations: {}
+
+  # Optional additional arguments for webhook
+  extraArgs: []
+
+  resources: {}
+    # requests:
+    #   cpu: 10m
+  #   memory: 32Mi
+
+  image:
+    repository: quay.io/jetstack/cert-manager-webhook
+    tag: v0.5.2
+    pullPolicy: IfNotPresent
+
 letsencrypt:
+  enabled: true
   email: user@example.com
   # specifies custom letsencrypt server, both staing and prod letsencrypt has default value in clusterissuer.yaml
   server: "https://https://acme-staging-v02.api.letsencrypt.org/directory"
 
+clusterissuerEnabled: true
+
 # This is used by the static manifest generator in order to create a static
 # namespace manifest for the namespace that cert-manager is being installed
 # within. It should **not** be used if you are using Helm for deployment.
@@ -84,4 +105,24 @@ createNamespaceResource: false
 # http_proxy: "http://proxy:8080"
 # no_proxy: 127.0.0.1,localhost
 
-clusterissuerEnabled: true
+# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core
+# for example:
+#   affinity:
+#     nodeAffinity:
+#      requiredDuringSchedulingIgnoredDuringExecution:
+#        nodeSelectorTerms:
+#        - matchExpressions:
+#          - key: foo.bar.com/role
+#            operator: In
+#            values:
+#            - master
+affinity: {}
+
+# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core
+# for example:
+#   tolerations:
+#   - key: foo.bar.com/role
+#     operator: Equal
+#     value: master
+#     effect: NoSchedule
+tolerations: []

charts/cert-manager/latest/webhook/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/cert-manager/latest/webhook/Chart.yaml

+apiVersion: v1
+appVersion: "v0.5.2"
+description: A Helm chart for deploying the cert-manager webhook component
+name: webhook
+version: "v0.5.2"

charts/cert-manager/latest/webhook/templates/_helpers.tpl

+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "webhook.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "webhook.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "webhook.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "webhook.selfSignedIssuer" -}}
+{{ printf "%s-selfsign" (include "webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "webhook.rootCAIssuer" -}}
+{{ printf "%s-ca" (include "webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "webhook.rootCACertificate" -}}
+{{ printf "%s-ca" (include "webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "webhook.servingCertificate" -}}
+{{ printf "%s-webhook-tls" (include "webhook.fullname" .) }}
+{{- end -}}

charts/cert-manager/latest/webhook/templates/apiservice.yaml

+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1beta1.admission.certmanager.k8s.io
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  group: admission.certmanager.k8s.io
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: {{ include "webhook.fullname" . }}
+    namespace: "{{ .Release.Namespace }}"
+  version: v1beta1

charts/cert-manager/latest/webhook/templates/ca-sync.yaml

+## This file contains a CronJob that runs every 24h to automatically update the
+## caBundle set on the APIService and ValidatingWebhookConfiguration resource.
+## This allows us to store the CA bundle in a Secret resource which is
+## generated by cert-manager's 'selfsigned' Issuer.
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  schedule: "* * */24 * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: ca-helper
+        spec:
+          serviceAccountName: {{ include "webhook.fullname" . }}-ca-sync
+          restartPolicy: OnFailure
+          containers:
+          - name: ca-helper
+            image: quay.io/munnerz/apiextensions-ca-helper:v0.1.0
+            imagePullPolicy: IfNotPresent
+            args:
+            - -config=/config/config
+            volumeMounts:
+            - name: config
+              mountPath: /config
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                cpu: 100m
+                memory: 128Mi
+          volumes:
+          - name: config
+            configMap:
+              name: {{ include "webhook.fullname" . }}-ca-sync
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  template:
+    metadata:
+      labels:
+        app: ca-helper
+    spec:
+      serviceAccountName: {{ include "webhook.fullname" . }}-ca-sync
+      restartPolicy: OnFailure
+      containers:
+      - name: ca-helper
+        image: quay.io/munnerz/apiextensions-ca-helper:canary
+        imagePullPolicy: IfNotPresent
+        args:
+        - -config=/config/config
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+          limits:
+            cpu: 100m
+            memory: 128Mi
+      volumes:
+      - name: config
+        configMap:
+          name: {{ include "webhook.fullname" . }}-ca-sync
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  config: |-
+    {
+        "apiServices": [
+            {
+                "name": "v1beta1.admission.certmanager.k8s.io",
+                "secret": {
+                    "name": "{{ include "webhook.rootCACertificate" . }}",
+                    "namespace": "{{ .Release.Namespace }}",
+                    "key": "tls.crt"
+                }
+            }
+        ],
+        "validatingWebhookConfigurations": [
+            {
+                "name": "{{ include "webhook.fullname" . }}",
+                "file": {
+                    "path": "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+                }
+            }
+        ]
+    }
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+    resourceNames:
+    - {{ include "webhook.rootCACertificate" . }}
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
+    verbs: ["get", "update"]
+    resourceNames:
+    - {{ include "webhook.fullname" . }}
+  - apiGroups: ["apiregistration.k8s.io"]
+    resources: ["apiservices"]
+    verbs: ["get", "update"]
+    resourceNames:
+    - v1beta1.admission.certmanager.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "webhook.fullname" . }}-ca-sync
+subjects:
+  - name: {{ include "webhook.fullname" . }}-ca-sync
+    namespace: {{ .Release.Namespace }}
+    kind: ServiceAccount

charts/cert-manager/latest/webhook/templates/deployment.yaml

+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ include "webhook.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "webhook.name" . }}
+        release: {{ .Release.Name }}
+      annotations:
+      {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "webhook.fullname" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+          - --v=12
+          - --tls-cert-file=/certs/tls.crt
+          - --tls-private-key-file=/certs/tls.key
+          - --disable-admission-plugins=NamespaceLifecycle,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,Initializers
+        {{- if .Values.extraArgs }}
+{{ toYaml .Values.extraArgs | indent 10 }}
+        {{- end }}
+          env:
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+          volumeMounts:
+          - name: certs
+            mountPath: /certs
+      volumes:
+      - name: certs
+        secret:
+          secretName: {{ include "webhook.servingCertificate" . }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}

charts/cert-manager/latest/webhook/templates/pki.yaml

+---
+# Create a selfsigned Issuer, in order to create a root CA certificate for
+# signing webhook serving certificates
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Issuer
+metadata:
+  name: {{ include "webhook.selfSignedIssuer" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  selfsigned: {}
+
+---
+
+# Generate a CA Certificate used to sign certificates for the webhook
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Certificate
+metadata:
+  name: {{ include "webhook.rootCACertificate" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  secretName: {{ include "webhook.rootCACertificate" . }}
+  issuerRef:
+    name: {{ include "webhook.selfSignedIssuer" . }}
+  commonName: "ca.webhook.cert-manager"
+  isCA: true
+
+---
+
+# Create an Issuer that uses the above generated CA certificate to issue certs
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Issuer
+metadata:
+  name: {{ include "webhook.rootCAIssuer" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  ca:
+    secretName: {{ include "webhook.rootCACertificate" . }}
+
+---
+
+# Finally, generate a serving certificate for the webhook to use
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Certificate
+metadata:
+  name: {{ include "webhook.servingCertificate" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  secretName: {{ include "webhook.servingCertificate" . }}
+  issuerRef:
+    name: {{ include "webhook.rootCAIssuer" . }}
+  dnsNames:
+  - {{ include "webhook.fullname" . }}
+  - {{ include "webhook.fullname" . }}.{{ .Release.Namespace }}
+  - {{ include "webhook.fullname" . }}.{{ .Release.Namespace }}.svc

charts/cert-manager/latest/webhook/templates/rbac.yaml

+### Webhook ###
+---
+# apiserver gets the auth-delegator role to delegate auth decisions to
+# the core apiserver
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "webhook.fullname" . }}:auth-delegator
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+
+---
+
+# apiserver gets the ability to read authentication. This allows it to
+# read the specific configmap that has the requestheader-* entries to
+# api agg
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ include "webhook.fullname" . }}:webhook-authentication-reader
+  namespace: kube-system
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "webhook.fullname" . }}:webhook-requester
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - admission.certmanager.k8s.io
+  resources:
+  - certificates
+  - issuers
+  - clusterissuers
+  verbs:
+  - create

charts/cert-manager/latest/webhook/templates/service.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    port: 443
+    targetPort: 443
+  selector:
+    app: {{ include "webhook.name" . }}
+    release: {{ .Release.Name }}

charts/cert-manager/latest/webhook/templates/serviceaccount.yaml

+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}

charts/cert-manager/latest/webhook/templates/validating-webhook.yaml

+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+webhooks:
+  - name: certificates.admission.certmanager.k8s.io
+    namespaceSelector:
+      matchExpressions:
+      - key: "certmanager.k8s.io/disable-validation"
+        operator: "NotIn"
+        values:
+        - "true"
+      - key: "name"
+        operator: "NotIn"
+        values:
+        - {{ .Release.Namespace }}
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - certificates
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/certificates
+  - name: issuers.admission.certmanager.k8s.io
+    namespaceSelector:
+      matchExpressions:
+      - key: "certmanager.k8s.io/disable-validation"
+        operator: "NotIn"
+        values:
+        - "true"
+      - key: "name"
+        operator: "NotIn"
+        values:
+        - {{ .Release.Namespace }}
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - issuers
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/issuers
+  - name: clusterissuers.admission.certmanager.k8s.io
+    namespaceSelector:
+      matchExpressions:
+      - key: "certmanager.k8s.io/disable-validation"
+        operator: "NotIn"
+        values:
+        - "true"
+      - key: "name"
+        operator: "NotIn"
+        values:
+        - {{ .Release.Namespace }}
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - clusterissuers
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/clusterissuers

charts/cert-manager/latest/webhook/values.yaml

+replicaCount: 1
+
+podAnnotations: {}
+
+# Optional additional arguments for webhook
+extraArgs: []
+
+resources: {}
+  # requests:
+  #   cpu: 10m
+  #   memory: 32Mi
+
+image:
+  repository: quay.io/jetstack/cert-manager-webhook
+  tag: v0.5.2
+  pullPolicy: IfNotPresent

charts/cert-manager/letsencrypt-logo-horizontal.svg

+<?xml version="1.0"?>
+<svg width="339" height="81" xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg">
+
+ <g>
+  <title>Layer 1</title>
+  <g id="svg_1">
+   <g id="svg_2">
+    <g id="svg_3">
+     <path id="svg_4" d="m76.621002,68.878998l0,-31.406998l7.629997,0l0,24.796997l12.153999,0l0,6.609001l-19.783997,0l0,0.000999z" fill="#2C3C69"/>
+     <path id="svg_5" d="m121.546997,58.098999c0,0.295998 0,0.592003 0,0.888s-0.014999,0.576004 -0.043991,0.843002l-16.013008,0c0.059006,0.620995 0.244003,1.182999 0.555,1.685997s0.709999,0.938004 1.196999,1.308998c0.488007,0.370003 1.035004,0.658005 1.642006,0.864006c0.604996,0.208 1.233994,0.310997 1.884995,0.310997c1.153,0 2.130005,-0.213997 2.928001,-0.642998c0.799004,-0.429001 1.449005,-0.983002 1.952003,-1.664001l5.056992,3.194c-1.034988,1.507996 -2.401993,2.668999 -4.102997,3.482002c-1.700996,0.811996 -3.675995,1.219994 -5.921997,1.219994c-1.656998,0 -3.223999,-0.259995 -4.702003,-0.775993c-1.478996,-0.518005 -2.771996,-1.271004 -3.881996,-2.263c-1.108002,-0.990005 -1.981003,-2.210007 -2.616997,-3.659004s-0.953003,-3.104996 -0.953003,-4.969002c0,-1.802994 0.309998,-3.437996 0.931,-4.900997s1.463997,-2.706001 2.528999,-3.726002c1.064003,-1.021 2.32,-1.811996 3.771004,-2.373997c1.447998,-0.561001 3.015999,-0.843002 4.700996,-0.843002c1.625999,0 3.120003,0.274002 4.480003,0.820999s2.528,1.338001 3.504997,2.373001c0.975998,1.035 1.735992,2.292 2.283997,3.771c0.546005,1.478001 0.819,3.165001 0.819,5.056zm-6.697998,-2.794998c0,-1.153 -0.362,-2.144001 -1.086998,-2.972c-0.724998,-0.827 -1.812004,-1.242001 -3.260002,-1.242001c-0.709999,0 -1.360001,0.111 -1.951996,0.333s-1.108002,0.525002 -1.553001,0.909c-0.443001,0.384998 -0.798004,0.835999 -1.064003,1.354c-0.265999,0.517998 -0.414001,1.057999 -0.443001,1.618l9.359001,0z" fill="#2C3C69"/>
+     <path id="svg_6" d="m133.167999,52.200001l0,8.461002c0,1.038994 0.199997,1.816994 0.600006,2.337997c0.397995,0.519997 1.11499,0.778 2.151001,0.778c0.353989,0 0.730988,-0.028 1.130997,-0.088997c0.399002,-0.059006 0.731003,-0.147003 0.998001,-0.266006l0.088989,5.323006c-0.502991,0.176994 -1.138992,0.332001 -1.906998,0.465996c-0.769989,0.133003 -1.537994,0.199005 -2.306992,0.199005c-1.479004,0 -2.722,-0.186005 -3.727005,-0.556007c-1.005997,-0.369995 -1.811996,-0.903999 -2.416992,-1.601997c-0.60701,-0.695999 -1.043015,-1.526001 -1.309006,-2.489998c-0.266998,-0.962997 -0.399002,-2.038002 -0.399002,-3.223999l0,-9.338001l-3.548996,0l0,-5.412003l3.503998,0l0,-5.810997l7.141998,0l0,5.810997l5.190002,0l0,5.412003l-5.190002,0z" fill="#2C3C69"/>
+     <path id="svg_7" d="m161.912994,53.307999c-0.59201,-0.560997 -1.286011,-1.034 -2.085007,-1.418999c-0.798004,-0.383999 -1.640991,-0.577 -2.528,-0.577c-0.681,0 -1.30899,0.133999 -1.884995,0.398998c-0.576996,0.267002 -0.865005,0.726002 -0.865005,1.375c0,0.621002 0.317001,1.064003 0.953003,1.331001s1.664001,0.562 3.082993,0.887001c0.828003,0.177998 1.664001,0.43 2.507004,0.754997s1.604004,0.754005 2.283997,1.286003c0.680008,0.531998 1.227005,1.182999 1.642014,1.951996c0.412994,0.769005 0.620987,1.686005 0.620987,2.75c0,1.391006 -0.280991,2.565002 -0.842987,3.526001c-0.562012,0.960999 -1.294006,1.737 -2.196014,2.329002s-1.914993,1.019997 -3.037994,1.286003c-1.123993,0.266998 -2.248001,0.398994 -3.371002,0.398994c-1.804993,0 -3.570999,-0.287994 -5.302002,-0.864998c-1.728989,-0.575996 -3.17099,-1.427002 -4.32399,-2.551003l4.080994,-4.303001c0.649002,0.710007 1.447998,1.302002 2.395004,1.774002c0.945999,0.473999 1.951996,0.709999 3.016998,0.709999c0.591995,0 1.175995,-0.140999 1.751999,-0.421997c0.576996,-0.279999 0.865005,-0.776001 0.865005,-1.485001c0,-0.681 -0.354004,-1.182999 -1.064011,-1.509003c-0.709991,-0.324997 -1.817993,-0.664993 -3.326996,-1.020996c-0.768997,-0.177002 -1.537994,-0.413002 -2.306992,-0.709c-0.770004,-0.295998 -1.457001,-0.694 -2.062012,-1.197998c-0.605988,-0.502007 -1.10199,-1.123001 -1.485992,-1.863007c-0.384003,-0.737995 -0.576004,-1.625996 -0.576004,-2.660995c0,-1.331001 0.279999,-2.462002 0.843002,-3.394001c0.561996,-0.931999 1.285995,-1.692001 2.173996,-2.284c0.887009,-0.591999 1.87001,-1.027 2.949005,-1.308998s2.151001,-0.422001 3.216995,-0.422001c1.654999,0 3.274002,0.259998 4.856003,0.776001c1.582001,0.517998 2.921005,1.293999 4.014999,2.328999l-3.994995,4.127998z" fill="#2C3C69"/>
+     <path id="svg_8" d="m179.567993,68.878998l0,-31.406998l21.113998,0l0,6.388l-13.794998,0l0,5.944l13.041,0l0,6.077l-13.041,0l0,6.521l14.593994,0l0,6.476997l-21.912994,0z" fill="#2C3C69"/>
+     <path id="svg_9" d="m220.675003,68.878998l0,-12.065994c0,-0.621002 -0.053009,-1.212002 -0.154999,-1.774002c-0.104004,-0.562 -0.274002,-1.057003 -0.511002,-1.486c-0.237,-0.428001 -0.569,-0.769001 -0.998001,-1.021c-0.429001,-0.25 -0.968994,-0.377003 -1.619003,-0.377003s-1.220001,0.127003 -1.707993,0.377003c-0.487,0.251999 -0.895004,0.599998 -1.220001,1.042999s-0.569,0.953999 -0.731003,1.529999c-0.162994,0.577 -0.244003,1.175999 -0.244003,1.797001l0,11.976997l-7.319,0l0,-22.091l7.053009,0l0,3.061001l0.088989,0c0.266998,-0.473 0.613007,-0.938 1.042999,-1.396c0.428009,-0.459 0.932007,-0.850998 1.508011,-1.175999c0.576996,-0.325001 1.204987,-0.591999 1.885986,-0.799c0.680008,-0.206001 1.404007,-0.311001 2.173004,-0.311001c1.479004,0 2.735001,0.266998 3.770996,0.799s1.87001,1.220001 2.507004,2.062c0.636002,0.842999 1.094009,1.812 1.375,2.904999c0.279999,1.095001 0.421005,2.189003 0.421005,3.283001l0,13.661999l-7.320999,0l0,0.000999z" fill="#2C3C69"/>
+     <path id="svg_10" d="m246.713013,53.929001c-0.415009,-0.532001 -0.977005,-0.959999 -1.686005,-1.285999c-0.709991,-0.325001 -1.436005,-0.488003 -2.173996,-0.488003c-0.770004,0 -1.464005,0.155003 -2.085007,0.466s-1.153,0.726002 -1.597,1.242001c-0.442993,0.518002 -0.791992,1.117001 -1.042999,1.797001c-0.250992,0.681004 -0.376999,1.404003 -0.376999,2.174c0,0.768997 0.117996,1.493004 0.354996,2.173004c0.236008,0.681 0.583008,1.279999 1.042007,1.796997c0.457993,0.517998 1.005005,0.924995 1.641998,1.220001c0.636002,0.295998 1.352997,0.443001 2.151001,0.443001c0.738007,0 1.470993,-0.139999 2.195007,-0.421005s1.30899,-0.687996 1.751984,-1.220001l4.037018,4.924004c-0.917023,0.887001 -2.101013,1.582001 -3.549011,2.084999c-1.44899,0.501999 -2.987,0.753998 -4.612991,0.753998c-1.74501,0 -3.374008,-0.266998 -4.887009,-0.798996c-1.511993,-0.531998 -2.826004,-1.308998 -3.940994,-2.329002c-1.115997,-1.019997 -1.992996,-2.253998 -2.632996,-3.702995s-0.959,-3.090004 -0.959,-4.924004c0,-1.804001 0.318985,-3.431 0.959,-4.880001c0.639999,-1.447998 1.516998,-2.683998 2.632996,-3.703999c1.11499,-1.021 2.429993,-1.804001 3.940994,-2.351002c1.513,-0.546997 3.126999,-0.820999 4.843002,-0.820999c0.798004,0 1.589005,0.074001 2.373001,0.223c0.783005,0.147003 1.536987,0.348 2.261993,0.599003s1.390015,0.562 1.996002,0.931999s1.132019,0.776001 1.575012,1.219997l-4.212006,4.877003z" fill="#2C3C69"/>
+     <path id="svg_11" d="m268.032013,52.776001c-0.325989,-0.089001 -0.644012,-0.146999 -0.95401,-0.177002s-0.613983,-0.044998 -0.908997,-0.044998c-0.975983,0 -1.796997,0.177998 -2.462006,0.530998c-0.664978,0.354 -1.196991,0.781002 -1.596985,1.283001c-0.399017,0.500999 -0.688019,1.047001 -0.865021,1.636997s-0.265991,1.105003 -0.265991,1.548004l0,11.324997l-7.274994,0l0,-22.063999l7.009003,0l0,3.194l0.088989,0c0.562012,-1.132 1.359009,-2.055 2.395996,-2.77c1.034027,-0.715 2.232025,-1.071999 3.593018,-1.071999c0.294983,0 0.583984,0.015999 0.86499,0.044998c0.279999,0.029003 0.51001,0.074001 0.688019,0.133003l-0.312012,6.431999z" fill="#2C3C69"/>
+     <path id="svg_12" d="m285.122009,72.206001c-0.442993,1.153 -0.938995,2.181 -1.485992,3.083c-0.546997,0.901001 -1.197021,1.669998 -1.951019,2.306999c-0.753998,0.636002 -1.641998,1.114998 -2.661987,1.441002c-1.019989,0.324997 -2.226013,0.487999 -3.61499,0.487999c-0.681,0 -1.382996,-0.044998 -2.106018,-0.134003c-0.725983,-0.088997 -1.354004,-0.207001 -1.885986,-0.353996l0.798981,-6.121002c0.354004,0.116997 0.746002,0.213997 1.176025,0.288002c0.427979,0.072998 0.819977,0.110001 1.174988,0.110001c1.123993,0 1.937012,-0.259003 2.440002,-0.776001c0.501984,-0.518005 0.931,-1.249001 1.286011,-2.195l0.709991,-1.818001l-9.22699,-21.736l8.072998,0l4.923981,14.195l0.132996,0l4.391998,-14.195l7.718018,0l-9.893005,25.417z" fill="#2C3C69"/>
+     <path id="svg_13" d="m321.496002,57.745003c0,1.537994 -0.237,3.016998 -0.709991,4.435997c-0.473999,1.419998 -1.161011,2.668999 -2.062012,3.748001c-0.902008,1.080002 -2.003998,1.945 -3.304993,2.596001c-1.302002,0.649002 -2.779999,0.975998 -4.437012,0.975998c-1.359985,0 -2.645996,-0.273003 -3.859009,-0.82s-2.15799,-1.293999 -2.838989,-2.239998l-0.087982,0l0,13.085999l-7.275024,0l0,-32.739002l6.920013,0l0,2.706001l0.132996,0c0.681,-0.887001 1.618988,-1.662998 2.816986,-2.328999c1.197021,-0.665001 2.609009,-0.998001 4.236023,-0.998001c1.596985,0 3.044983,0.311001 4.346985,0.931999c1.300995,0.621002 2.402008,1.464001 3.304993,2.528s1.597015,2.299999 2.085022,3.704002c0.488007,1.404999 0.731995,2.876999 0.731995,4.414001zm-7.053009,0c0,-0.709999 -0.110016,-1.403999 -0.332001,-2.085003c-0.222015,-0.68 -0.548004,-1.278999 -0.97699,-1.797001c-0.429016,-0.516998 -0.969025,-0.938 -1.619019,-1.264s-1.403992,-0.487999 -2.261993,-0.487999c-0.828003,0 -1.567993,0.162998 -2.217987,0.487999c-0.651001,0.325001 -1.206024,0.754002 -1.664001,1.285999c-0.459015,0.532001 -0.813019,1.139 -1.064026,1.818001c-0.251984,0.681004 -0.376984,1.375004 -0.376984,2.085003s0.125,1.404999 0.376984,2.084999c0.251007,0.681 0.605011,1.285995 1.064026,1.818001c0.457977,0.531998 1.013,0.961998 1.664001,1.286995c0.648987,0.325005 1.389984,0.487 2.217987,0.487c0.856995,0 1.610992,-0.161995 2.261993,-0.487s1.190002,-0.754997 1.619019,-1.286995s0.754974,-1.146004 0.97699,-1.841003c0.221008,-0.693001 0.332001,-1.394997 0.332001,-2.104996z" fill="#2C3C69"/>
+     <path id="svg_14" d="m333.118011,52.200001l0,8.461002c0,1.038994 0.200012,1.816994 0.600006,2.337997c0.39798,0.519997 1.11499,0.778 2.151001,0.778c0.354004,0 0.730988,-0.028 1.130981,-0.088997c0.399017,-0.059006 0.731018,-0.147003 0.998016,-0.266006l0.088989,5.323006c-0.502991,0.176994 -1.139008,0.332001 -1.906982,0.465996c-0.77002,0.133003 -1.538025,0.199005 -2.307007,0.199005c-1.479004,0 -2.722015,-0.186005 -3.72702,-0.556007c-1.005981,-0.369995 -1.811981,-0.903999 -2.416992,-1.601997c-0.606995,-0.695999 -1.042999,-1.526001 -1.30899,-2.489998c-0.266998,-0.962997 -0.399017,-2.038002 -0.399017,-3.223999l0,-9.338001l-3.548981,0l0,-5.412003l3.503998,0l0,-5.810997l7.141998,0l0,5.810997l5.190002,0l0,5.412003l-5.190002,0z" fill="#2C3C69"/>
+    </g>
+   </g>
+   <path id="svg_15" d="m145.009995,36.869999c-2.182999,0 -3.891998,1.573002 -3.891998,3.582001c0,2.116001 1.438995,3.536999 3.582001,3.536999c0.182999,0 0.355988,-0.016998 0.518997,-0.049999c-0.343002,1.566002 -1.852005,2.690002 -3.278,2.915001l-0.290009,0.046001l0,3.376999l0.376007,-0.035999c1.729996,-0.165001 3.438995,-0.951 4.690994,-2.157001c1.632004,-1.572998 2.49501,-3.843998 2.49501,-6.568001c0,-2.691998 -1.76799,-4.646 -4.203003,-4.646z" fill="#2C3C69"/>
+  </g>
+  <g id="svg_16">
+   <path id="svg_17" d="m46.488998,37.568001l-8.039997,0l0,-4.128002c0,-3.296997 -2.683002,-5.979 -5.98,-5.979c-3.297001,0 -5.979,2.683002 -5.979,5.979l0,4.128002l-8.040001,0l0,-4.128002c0,-7.73 6.288998,-14.019999 14.02,-14.019999s14.02,6.289 14.02,14.019999l0,4.128002l-0.001003,0z" fill="#F9A11D"/>
+  </g>
+  <path id="svg_18" d="m49.731998,37.568001l-34.524998,0c-1.474001,0 -2.68,1.205997 -2.68,2.68l0,25.540001c0,1.473999 1.205999,2.68 2.68,2.68l34.524998,0c1.474003,0 2.68,-1.206001 2.68,-2.68l0,-25.540001c0,-1.474003 -1.205997,-2.68 -2.68,-2.68zm-15.512997,16.769001l0,3.460995c0,0.966003 -0.784,1.749001 -1.749001,1.749001s-1.749001,-0.783997 -1.749001,-1.749001l0,-3.459995c-1.076,-0.611 -1.803001,-1.764 -1.803001,-3.09c0,-1.962002 1.591,-3.552002 3.552002,-3.552002c1.961998,0 3.551998,1.591 3.551998,3.552002c0,1.325001 -0.727001,2.478001 -1.802998,3.089001z" fill="#2C3C69"/>
+  <path id="svg_19" d="m11.707001,33.759998l-8.331,0c-1.351001,0 -2.446,-1.094997 -2.446,-2.445999s1.094999,-2.445999 2.446,-2.445999l8.331,0c1.351,0 2.445999,1.095001 2.445999,2.445999s-1.096001,2.445999 -2.445999,2.445999z" fill="#F9A11D"/>
+  <path id="svg_20" d="m17.575001,20.655001c-0.546001,0 -1.097,-0.182001 -1.552,-0.557001l-6.59,-5.418999c-1.043001,-0.858002 -1.194,-2.399 -0.335001,-3.443001c0.858,-1.042999 2.399,-1.194 3.443001,-0.336l6.59,5.419001c1.042999,0.858 1.194,2.399 0.334999,3.442999c-0.483,0.589001 -1.184,0.893002 -1.890999,0.893002z" fill="#F9A11D"/>
+  <path id="svg_21" d="m32.469002,14.895c-1.351002,0 -2.446003,-1.095001 -2.446003,-2.446001l0,-8.396999c0,-1.351 1.095001,-2.446 2.446003,-2.446s2.445999,1.095 2.445999,2.446l0,8.396999c0,1.351 -1.095001,2.446001 -2.445999,2.446001z" fill="#F9A11D"/>
+  <g id="svg_22">
+   <g id="svg_23">
+    <path id="svg_24" d="m47.362999,20.655001c-0.707001,0 -1.406998,-0.304001 -1.890999,-0.893002c-0.858002,-1.042999 -0.708,-2.584999 0.334999,-3.442999l6.59,-5.419001c1.044003,-0.858 2.585003,-0.706999 3.442997,0.336c0.858002,1.042999 0.708,2.584999 -0.334999,3.443001l-6.589996,5.418999c-0.455002,0.375 -1.005001,0.557001 -1.552002,0.557001z" fill="#F9A11D"/>
+   </g>
+  </g>
+  <path id="svg_25" d="m61.563004,33.759998l-8.410004,0c-1.351002,0 -2.445999,-1.094997 -2.445999,-2.445999s1.094997,-2.445999 2.445999,-2.445999l8.410004,0c1.350998,0 2.445999,1.095001 2.445999,2.445999s-1.095001,2.445999 -2.445999,2.445999z" fill="#F9A11D"/>
+ </g>
+</svg>
\ No newline at end of file

charts/cert-manager/v0.4.1/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/cert-manager/v0.4.1/Chart.yaml

+name: cert-manager
+version: v0.4.1
+appVersion: v0.4.1
+description: A Helm chart for cert-manager
+home: https://github.com/jetstack/cert-manager
+keywords:
+  - cert-manager
+  - kube-lego
+  - letsencrypt
+  - tls
+sources:
+  - https://github.com/jetstack/cert-manager
+icon: https://letsencrypt.org/images/letsencrypt-logo-horizontal.svg
+maintainers:
+  - name: munnerz
+    email: james@jetstack.io

charts/cert-manager/v0.4.1/OWNERS

+approvers:
+- munnerz
+- simonswine
+- kragniz
+reviewers:
+- munnerz
+- unguiculus
+- simonswine
+- kragniz

charts/cert-manager/v0.4.1/README.md

+## Installing the Chart
+
+Full installation instructions, including details on how to configure extra
+functionality in cert-manager can be found in the [getting started docs](https://cert-manager.readthedocs.io/en/latest/getting-started/).
+
+To install the chart with the release name `my-release`:
+
+```console
+$ helm install --name my-release stable/cert-manager
+```
+
+In order to begin issuing certificates, you will need to set up a ClusterIssuer
+or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
+
+More information on the different types of issuers and how to configure them
+can be found in our documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/issuers.html
+
+For information on how to configure cert-manager to automatically provision
+Certificates for Ingress resources, take a look at the `ingress-shim`
+documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html
+
+> **Tip**: List all releases using `helm list`
+
+## Uninstalling the Chart
+
+To uninstall/delete the `my-release` deployment:
+
+```console
+$ helm delete my-release
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+The following table lists the configurable parameters of the cert-manager chart and their default values.
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
+| `image.tag` | Image tag | `v0.4.1` |
+| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
+| `replicaCount`  | Number of cert-manager replicas  | `1` |
+| `createCustomResource` | Create CRD/TPR with this release | `true` |
+| `clusterResourceNamespace` | Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources | Same namespace as cert-manager pod
+| `leaderElection.Namespace` | Override the namespace used to store the ConfigMap for leader election | Same namespace as cert-manager pod
+| `certificateResourceShortNames` | Custom aliases for Certificate CRD | `["cert", "certs"]` |
+| `extraArgs` | Optional flags for cert-manager | `[]` |
+| `extraEnv` | Optional environment variables for cert-manager | `[]` |
+| `rbac.create` | If `true`, create and use RBAC resources | `true` |
+| `serviceAccount.create` | If `true`, create a new service account | `true` |
+| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template |  |
+| `resources` | CPU/memory resource requests/limits | `requests: {cpu: 10m, memory: 32Mi}` |
+| `nodeSelector` | Node labels for pod assignment | `{}` |
+| `affinity` | Node affinity for pod assignment | `{}` |
+| `tolerations` | Node tolerations for pod assignment | `[]` |
+| `ingressShim.defaultIssuerName` | Optional default issuer to use for ingress resources |  |
+| `ingressShim.defaultIssuerKind` | Optional default issuer kind to use for ingress resources |  |
+| `ingressShim.defaultACMEChallengeType` | Optional default challenge type to use for ingresses using ACME issuers |  |
+| `ingressShim.defaultACMEDNS01ChallengeProvider` | Optional default DNS01 challenge provider to use for ingresses using ACME issuers with DNS01 |  |
+| `podAnnotations` | Annotations to add to the cert-manager pod | `{}` |
+| `podDnsPolicy` | Optional cert-manager pod [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-policy) |  |
+| `podDnsConfig` | Optional cert-manager pod [DNS configurations](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-config) |  |
+| `podLabels` | Labels to add to the cert-manager pod | `{}` |
+| `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
+| `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
+| `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
+
+Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
+
+```console
+$ helm install --name my-release -f values.yaml .
+```
+> **Tip**: You can use the default [values.yaml](values.yaml)
+
+## Contributing
+
+This chart is maintained at [github.com/jetstack/cert-manager](https://github.com/jetstack/cert-manager/tree/master/contrib/charts/cert-manager).

charts/cert-manager/v0.4.1/app-readme.md

+# cert-manager
+
+cert-manager is a Kubernetes addon to automate the management and issuance of
+TLS certificates from various issuing sources.  
+It will ensure certificates are valid and up to date periodically, and attempt
+to renew certificates at an appropriate time before expiry.
+
+## How to Use It
+### [Ingress-shim](https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html#ingress-shim)
+Cert-manager will create Certificate resources that reference the `ClusterIssuer` for all Ingresses that have following annotations.
+```
+kubernetes.io/tls-acme: "true"
+certmanager.k8s.io/cluster-issuer: letsencrypt-staging # your cluerissuer name
+nginx.ingress.kubernetes.io/secure-backends: "true" # optional
+```
+
+For cert-manager to work properly, the following information has to be added on your ingress definition.
+```
+spec:
+  tls:
+  - hosts:
+    - host.example.com
+    secretName: host-example-crt
+```

charts/cert-manager/v0.4.1/questions.yml

+minimum_rancher_version: v2.1.0
+questions:
+- variable: defaultImage
+  default: true
+  description: "Use default Docker image"
+  label: Use Default Image
+  type: boolean
+  show_subquestion_if: false
+  group: "Container Images"
+  subquestions:
+  - variable: image.repository
+    default: "quay.io/jetstack/cert-manager-controller"
+    description: "Cert-Manager Docker image name"
+    type: string
+    label: Cert-Manager Docker Image Name
+  - variable: image.tag
+    default: "v0.4.1"
+    description: "Cert-Manager Docker image tag"
+    type: string
+    label: Cert-Manager Image Tag
+- variable: createCustomResource
+  default: true
+  description: "Create Custom Resource Definition(CRD) of certmanager"
+  label: Create Custom Resource Definition(CRD)
+  type: boolean
+  group: "Settings"
+- variable: ingressShim.defaultIssuerName
+  default: "letsencrypt-staging"
+  required: true
+  type: enum
+  description: "Let's Encrypt ACME clients, use staging environment to avoid hitting rate limits"
+  label: Let's Encrypt Cluster Issuer clients
+  group: "Settings"
+  options:
+  - "letsencrypt-staging"
+  - "letsencrypt-prod"
+- variable: letsencrypt.email
+  default: ""
+  required: true
+  type: string
+  description: "Let's Encrypt register email, for https://letsencrypt.org/docs/staging-environment"
+  label: Let's Encrypt Client Register Email
+  group: "Settings"

charts/cert-manager/v0.4.1/templates/00-namespace.yaml

+{{ if .Values.createNamespaceResource }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Release.Namespace | quote }}
+{{- end }}

charts/cert-manager/v0.4.1/templates/NOTES.txt

+cert-manager has been deployed successfully!
+
+1. In order to begin issuing certificates, you will need to set up a ClusterIssuer
+or Issuer resource, and we have set a default ClusterIssuer called `{{ .Values.letsencrypt.name }}` with your register email <{{ .Values.letsencrypt.email }}>.
+
+More information on the different types of issuers and how to configure them
+can be found in our documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/issuers.html
+
+2. Cert-manager will create Certificate resources that reference the ClusterIssuer `{{ .Values.letsencrypt.name }}` for all Ingresses that have a `kubernetes.io/tls-acme: "true"` annotation.
+
+For information on how to configure cert-manager to automatically provision
+Certificates for Ingress resources, take a look at the `ingress-shim`
+documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html

charts/cert-manager/v0.4.1/templates/_helpers.tpl

+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cert-manager.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "cert-manager.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cert-manager.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cert-manager.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "cert-manager.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

charts/cert-manager/v0.4.1/templates/certificate-crd.yaml

+{{- if .Values.createCustomResource -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: certificates.certmanager.k8s.io
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  scope: Namespaced
+  names:
+    kind: Certificate
+    plural: certificates
+    {{- if .Values.certificateResourceShortNames }}
+    shortNames:
+{{ toYaml .Values.certificateResourceShortNames | indent 6 }}
+    {{- end -}}
+{{- end -}}

charts/cert-manager/v0.4.1/templates/clusterissuer-crd.yaml

+{{- if .Values.createCustomResource -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterissuers.certmanager.k8s.io
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: ClusterIssuer
+    plural: clusterissuers
+  scope: Cluster
+{{- end -}}

charts/cert-manager/v0.4.1/templates/clusterissuer.yaml

+{{- if .Values.clusterissuerEnabled -}}
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.ingressShim.defaultIssuerName }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  acme:
+    {{- if eq .Values.ingressShim.defaultIssuerName "letsencrypt-prod" }}
+    server: "https://acme-v02.api.letsencrypt.org/directory"
+    {{- else if eq .Values.ingressShim.defaultIssuerName "letsencrypt-staging" }}
+    server: "https://acme-staging-v02.api.letsencrypt.org/directory"
+    {{- else }}
+    server: {{ .Values.letsencrypt.server }}
+    {{- end }}
+    email: {{ .Values.letsencrypt.email }}
+    privateKeySecretRef:
+      name: {{ .Values.ingressShim.defaultIssuerName }}-account-key
+    http01: {}
+{{- end -}}

charts/cert-manager/v0.4.1/templates/deployment.yaml

+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "cert-manager.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ template "cert-manager.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "cert-manager.name" . }}
+        release: {{ .Release.Name }}
+{{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+      {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ template "cert-manager.serviceAccountName" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+        {{- if .Values.clusterResourceNamespace }}
+          - --cluster-resource-namespace={{ .Values.clusterResourceNamespace }}
+        {{- else }}
+          - --cluster-resource-namespace=$(POD_NAMESPACE)
+        {{- end }}
+        {{- if .Values.leaderElection.namespace }}
+          - --leader-election-namespace={{ .Values.leaderElection.namespace }}
+        {{- else }}
+          - --leader-election-namespace=$(POD_NAMESPACE)
+        {{- end }}
+        {{- if .Values.extraArgs }}
+{{ toYaml .Values.extraArgs | indent 10 }}
+        {{- end }}
+          {{- with .Values.ingressShim }}
+          {{- if .defaultIssuerName }}
+          - --default-issuer-name={{ .defaultIssuerName }}
+          {{- end }}
+          {{- if .defaultIssuerKind }}
+          - --default-issuer-kind={{ .defaultIssuerKind }}
+          {{- end }}
+          {{- if .defaultACMEChallengeType }}
+          - --default-acme-issuer-challenge-type={{ .defaultACMEChallengeType }}
+          {{- end }}
+          {{- if .defaultACMEDNS01ChallengeProvider }}
+          - --default-acme-issuer-dns01-provider-name={{ .defaultACMEDNS01ChallengeProvider }}
+          {{- end }}
+          {{- end }}
+          env:
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+        {{- if .Values.extraEnv }}
+{{ toYaml .Values.extraEnv | indent 10 }}
+        {{- end }}
+          {{- if .Values.http_proxy }}
+          - name: HTTP_PROXY
+            value: {{ .Values.http_proxy }}
+          {{- end }}
+          {{- if .Values.https_proxy }}
+          - name: HTTPS_PROXY
+            value: {{ .Values.https_proxy }}
+          {{- end }}
+          {{- if .Values.no_proxy }}
+          - name: NO_PROXY
+            value: {{ .Values.no_proxy }}
+          {{- end }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- if .Values.podDnsPolicy }}
+      dnsPolicy: {{ .Values.podDnsPolicy }}
+{{- end }}
+{{- if .Values.podDnsConfig }}
+      dnsConfig:
+{{ toYaml .Values.podDnsConfig | indent 8 }}
+{{- end }}

charts/cert-manager/v0.4.1/templates/issuer-crd.yaml

+{{- if .Values.createCustomResource -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: issuers.certmanager.k8s.io
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: Issuer
+    plural: issuers
+  scope: Namespaced
+{{- end -}}

charts/cert-manager/v0.4.1/templates/rbac.yaml

+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ template "cert-manager.fullname" . }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups: ["certmanager.k8s.io"]
+    resources: ["certificates", "issuers", "clusterissuers"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    # TODO: remove endpoints once 0.4 is released. We include it here in case
+    # users use the 'master' version of the Helm chart with a 0.2.x release of
+    # cert-manager that still performs leader election with Endpoint resources.
+    # We advise users don't do this, but some will anyway and this will reduce
+    # friction.
+    resources: ["endpoints", "configmaps", "secrets", "events", "services", "pods"]
+    verbs: ["*"]
+  - apiGroups: ["extensions"]
+    resources: ["ingresses"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "cert-manager.fullname" . }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "cert-manager.fullname" . }}
+subjects:
+  - name: {{ template "cert-manager.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace | quote }}
+    kind: ServiceAccount
+{{- end -}}

charts/cert-manager/v0.4.1/templates/serviceaccount.yaml

+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "cert-manager.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- end -}}

charts/cert-manager/v0.4.1/values.yaml

+# Default values for cert-manager.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+replicaCount: 1
+
+image:
+  repository: quay.io/jetstack/cert-manager-controller
+  tag: v0.4.1
+  pullPolicy: IfNotPresent
+
+createCustomResource: true
+
+# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
+# resources. By default, the same namespace as cert-manager is deployed within is
+# used. This namespace will not be automatically created by the Helm chart.
+clusterResourceNamespace: ""
+
+leaderElection:
+  # Override the namespace used to store the ConfigMap for leader election
+  namespace: ""
+
+certificateResourceShortNames: ["cert", "certs"]
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
+# Optional additional arguments
+extraArgs: []
+  # Use this flag to set a namespace that cert-manager will use to store
+  # supporting resources required for each ClusterIssuer (default is kube-system)
+  # - --cluster-resource-namespace=kube-system
+
+extraEnv: []
+# - name: SOME_VAR
+#   value: 'some value'
+
+resources: {}
+  # requests:
+  #   cpu: 10m
+  #   memory: 32Mi
+
+podAnnotations: {}
+
+podLabels: {}
+# Optional DNS settings, useful if you have a public and private DNS zone for
+# the same domain on Route 53. What follows is an example of ensuring
+# cert-manager can access an ingress or DNS TXT records at all times.
+# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
+# the cluster to work.
+# podDnsPolicy: "None"
+# podDnsConfig:
+#   nameservers:
+#     - "1.1.1.1"
+#     - "8.8.8.8"
+
+nodeSelector: {}
+
+ingressShim:
+  defaultIssuerName: "letsencrypt-staging"
+  defaultIssuerKind: "ClusterIssuer"
+  defaultACMEChallengeType: "http01"
+  # defaultACMEDNS01ChallengeProvider: ""
+
+letsencrypt:
+  email: user@example.com
+  # specifies custom letsencrypt server, both staing and prod letsencrypt has default value in clusterissuer.yaml
+  server: "https://https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# This is used by the static manifest generator in order to create a static
+# namespace manifest for the namespace that cert-manager is being installed
+# within. It should **not** be used if you are using Helm for deployment.
+createNamespaceResource: false
+
+# Use these variables to configure the HTTP_PROXY environment variables
+# http_proxy: "http://proxy:8080"
+# http_proxy: "http://proxy:8080"
+# no_proxy: 127.0.0.1,localhost
+
+clusterissuerEnabled: true