values.yaml

# +docs:section=AWS Private CA Issuer

# Number of replicas to run of the issuer
replicaCount: 1

image:
  # Image repository
  repository: public.ecr.aws/k1n1h4h4/cert-manager-aws-privateca-issuer
  # Image pull policy
  pullPolicy: IfNotPresent
  # Image tag
  tag: ""

# Disable waiting for CertificateRequests to be Approved before signing
disableApprovedCheck: false

# Disables Kubernetes client-side rate limiting (only use if API Priority & Fairness is enabled on the cluster).
disableClientSideRateLimiting: false

# Optional secrets used for pulling the container image
#
# For example:
#  imagePullSecrets:
#  - name: secret-name
imagePullSecrets: []

# Override the name of the objects created by this chart
nameOverride: ""

# Override the name of the objects created by this chart
fullnameOverride: ""

# Number deployment revisions to keep
revisionHistoryLimit: 10

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

rbac:
  # Specifies whether RBAC should be created
  create: true

service:
  # Type of service to create
  type: ClusterIP
  # Port the service should listen on
  port: 8080

# Annotations to add to the issuer Pod
podAnnotations: {}

# Pod security context 
# +docs:property
podSecurityContext:
  runAsUser: 65532

# Container security context 
# +docs:property
securityContext:
  allowPrivilegeEscalation: false

# Kubernetes pod resources requests/limits
#
# For example:
#  resources:
#    limits:
#      cpu: 100m
#      memory: 128Mi
#    requests:
#      cpu: 100m
#      memory: 128Mi
resources: {}

# Kubernetes node selector: node labels for pod assignment
nodeSelector: {}

# Kubernetes pod tolerations for cert-manager-csi-driver
#
# For example:
#  tolerations:
#  - operator: "Exists"
tolerations: []

# A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
#
# For example:
#   affinity:
#     nodeAffinity:
#      requiredDuringSchedulingIgnoredDuringExecution:
#        nodeSelectorTerms:
#        - matchExpressions:
#          - key: foo.bar.com/role
#            operator: In
#            values:
#            - master
affinity: {}

# List of Kubernetes TopologySpreadConstraints; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
#
# For example:
#   topologySpreadConstraints:
#   - maxSkew: 1
#     topologyKey: topology.kubernetes.io/zone
#     whenUnsatisfiable: ScheduleAnyway
#     labelSelector:
#       matchLabels:
#         app.kubernetes.io/name: aws-privateca-issuer
topologySpreadConstraints: []

# Additional environment variables to set in the Pod
# +docs:type=object
env:

# Additional labels to add to the Pod
podLabels: {}

# Additional volumes on the operator container.
volumes: []

# Additional VolumeMounts on the operator container.
volumeMounts: []

# Configures a disruption budget for the deployment.
#
# Expects input structure similar to https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#poddisruptionbudgetspec-v1-policy
# WITHOUT the pod selector, which is handled by the chart. 
# Per https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#poddisruptionbudgetspec-v1-policy, `maxUnavailable` is mutually
# exclusive with `minAvailable`, you cannot set both.
#
# For example:
#   podDisruptionBudget:
#     maxUnavailable: 1
#
# Or:
#   podDisruptionBudget:
#     minAvailable: 1
#
# But NOT:
#   podDisruptionBudget:
#     minAvailable: 1
#     maxUnavailable: 1
podDisruptionBudget: {}

# +docs:section=Autoscaling

autoscaling:
  # Enable auto scaling using a HorizontalPodAutoscaler
  enabled: false
  # Minimum number of replicas to deploy
  minReplicas: 1
  # Maximum number of replicas to deploy
  maxReplicas: 100
  # CPU threshold to scale at as a percentage of the requested CPUs
  targetCPUUtilizationPercentage: 80
  # Memory threshold to scale at as a percentage of the requested memory
  # +docs:property
  # targetMemoryUtilizationPercentage: 80

# +docs:section=Approver Role
# Options for configuring a target ServiceAccount with the role to approve
# all awspca.cert-manager.io requests.

approverRole:
  # Create the ClusterRole to allow the issuer to approve certificate requests
  enabled: true
  # Service account give approval permission
  serviceAccountName: cert-manager
  # Namespace the service account resides in
  namespace: cert-manager

# +docs:section=Monitoring

serviceMonitor:
  # Create Prometheus ServiceMonitor 
  create: false
  # Annotations to add to the Prometheus ServiceMonitor
  annotations: {}
  # Labels to add to the Prometheus ServiceMonitor
  labels: {}