Desired state of the Bundle resource.

Status of the Bundle. This is set and managed automatically.

Sources is a set of references to data whose data will sync to the target.

Target is the target location in all namespaces to sync source data to.

ConfigMap is a reference (by name) to a ConfigMap's data key(s), or to a list of ConfigMap's data key(s) using label selector, in the trust Namespace.

InLine is a simple string to append as the source data.

Secret is a reference (by name) to a Secret's data key(s), or to a list of Secret's data key(s) using label selector, in the trust Namespace.

UseDefaultCAs, when true, requests the default CA bundle to be used as a source. Default CAs are available if trust-manager was installed via Helm or was otherwise set up to include a package-injecting init container by using the "--default-package-location" flag when starting the trust-manager controller. If default CAs were not configured at start-up, any request to use the default CAs will fail. The version of the default CA package which is used for a Bundle is stored in the defaultCAPackageVersion field of the Bundle's status field.

IncludeAllKeys is a flag to include all keys in the object's data field to be used. False by default. This field must not be true when Key is set.

Key of the entry in the object's data field to be used.

Name is the name of the source object in the trust Namespace. This field must be left empty when selector is set

Selector is the label selector to use to fetch a list of objects. Must not be set when Name is set.

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels is a map of key-value pairs. A single key-value in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

key is the label key that the selector applies to.

operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

IncludeAllKeys is a flag to include all keys in the object's data field to be used. False by default. This field must not be true when Key is set.

Key of the entry in the object's data field to be used.

Name is the name of the source object in the trust Namespace. This field must be left empty when selector is set

Selector is the label selector to use to fetch a list of objects. Must not be set when Name is set.

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels is a map of key-value pairs. A single key-value in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

key is the label key that the selector applies to.

operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

AdditionalFormats specifies any additional formats to write to the target

ConfigMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to.

NamespaceSelector will, if set, only sync the target resource in Namespaces which match the selector.

Secret is the target Secret that all Bundle source data will be synced to. Using Secrets as targets is only supported if enabled at trust-manager startup. By default, trust-manager has no permissions for writing to secrets and can only read secrets in the trust namespace.

JKS requests a JKS-formatted binary trust bundle to be written to the target. The bundle has "changeit" as the default password. For more information refer to this link https://cert-manager.io/docs/faq/#keystore-passwords Deprecated: Writing JKS is subject for removal. Please migrate to PKCS12. PKCS#12 trust stores created by trust-manager are compatible with Java.

PKCS12 requests a PKCS12-formatted binary trust bundle to be written to the target.

The bundle is by default created without a password. For more information refer to this link https://cert-manager.io/docs/faq/#keystore-passwords

Key is the key of the entry in the object's data field to be used.

Password for JKS trust store

Default: changeit

Key is the key of the entry in the object's data field to be used.

Password for PKCS12 trust store

Default:

Profile specifies the certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 trust store.

If provided, allowed values are: LegacyRC2: Deprecated. Not supported by default in OpenSSL 3 or Java 20. LegacyDES: Less secure algorithm. Use this option for maximal compatibility. Modern2023: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g. because of company policy).

Default value is LegacyRC2 for backward compatibility.

Enum: LegacyRC2, LegacyDES, Modern2023

Key is the key of the entry in the object's data field to be used.

Metadata is an optional set of labels and annotations to be copied to the target.

Annotations is a key value map to be copied to the target.

Labels is a key value map to be copied to the target.

matchExpressions is a list of label selector requirements. The requirements are ANDed.

matchLabels is a map of key-value pairs. A single key-value in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

key is the label key that the selector applies to.

operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

Key is the key of the entry in the object's data field to be used.

Metadata is an optional set of labels and annotations to be copied to the target.

Annotations is a key value map to be copied to the target.

Labels is a key value map to be copied to the target.

List of status conditions to indicate the status of the Bundle. Known condition types are Bundle.

DefaultCAPackageVersion, if set and non-empty, indicates the version information which was retrieved when the set of default CAs was requested in the bundle source. This should only be set if useDefaultCAs was set to "true" on a source, and will be the same for the same version of a bundle with identical certificates.

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

Format: date-time

message is a human readable message indicating details about the transition. This may be an empty string.

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

status of the condition, one of True, False, Unknown.

Enum: True, False, Unknown

type of condition in CamelCase or in foo.example.com/CamelCase.

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

Format: int64
Minimum: 0