36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
# Default values for contour-shared-ca-issuer.
|
|
# Override per-cluster via helm-overrides/<cluster>/contour-shared-ca-issuer/custom-values.yaml.
|
|
|
|
# Namespace where cert-manager is installed. The Root CA Secret and
|
|
# ClusterIssuer's source Secret live here.
|
|
namespace: cert-manager
|
|
|
|
# ClusterIssuer name. Per-app Certificate CRs reference this via
|
|
# `issuerRef.name` (with `kind: ClusterIssuer`). Must match the name used
|
|
# by consumers — e.g. devops-helm-charts/2.0.0/templates/proxyless-grpc-cert.yaml.
|
|
issuerName: contour-ca-issuer
|
|
|
|
# Name of the K8s Secret (in `.namespace`) that holds the Root CA cert + key.
|
|
# Populated by ESO from Vault. ClusterIssuer's `spec.ca.secretName` points here.
|
|
rootCASecretName: contour-shared-ca
|
|
|
|
externalSecret:
|
|
# Create ExternalSecret to sync the Root CA from Vault. Disable if the
|
|
# Secret is provisioned out-of-band (e.g. sealed-secrets or manual).
|
|
enabled: true
|
|
# Vault KV path holding the Root CA (expects keys: tls.crt, tls.key, ca.crt).
|
|
vaultPath: meesho/devops/contour/root-ca
|
|
# Optional pinned Vault KV version.
|
|
vaultVersion: ""
|
|
# ESO refresh interval. "0" disables periodic refresh — rotation is driven
|
|
# by `kubectl annotate externalsecret ... force-sync=...` (see runbook).
|
|
refreshInterval: "0"
|
|
secretStoreRef:
|
|
# Name of the ClusterSecretStore configured for Vault. Typical values:
|
|
# vault-backend — default central ClusterSecretStore
|
|
# vault-backend-new — used in some farmiso clusters
|
|
name: vault-backend
|
|
|
|
commonLabels: {}
|
|
commonAnnotations: {}
|