Red Hat OpenShift Container Platform

Explanation of fields in the CertManager custom resource

To configure core components of the cert-manager Operator for Red Hat OpenShift, use the CertManager custom resource (CR). You can define settings for the cert-manager controller, such as the spec.controllerConfig field, to customize your deployment.

The core components of the cert-manager Operator for Red Hat OpenShift are as follows:

Cert-manager controller: You can use the spec.controllerConfig field to configure the cert‑manager controller pod.
Webhook: You can use the spec.webhookConfig field to configure the webhook pod, which handles validation and mutation requests.
CA injector: You can use the spec.cainjectorConfig field to configure the CA injector pod.

Common configurable fields in the CertManager CR for the cert-manager components

You can configure common fields in the spec.controllerConfig, spec.webhookConfig, and spec.cainjectorConfig sections in the CertManager CR to customize the cert-manager components.

Table 33. Common configurable fields in the CertManager CR for the cert-manager components
Field	Type	Description
`overrideArgs`	`string`	You can override the supported arguments for the cert-manager components.
`overrideEnv`	`dict`	You can override the supported environment variables for the cert-manager controller. This field is only supported for the cert-manager controller component.
`overrideReplicas`	`int`	You can configure the replicas for the cert-manager components. The default value is `1`. For production environments, the following replica counts are recommended: controller: 2 cainjector: 2 webhook: At least 3.
`overrideResources`	`object`	You can configure the CPU and memory limits for the cert-manager components.
`overrideScheduling`	`object`	You can configure the pod scheduling constraints for the cert-manager components.

Overridable arguments for the cert-manager components

You can configure the overridable arguments for the cert-manager components in the spec.controllerConfig, spec.webhookConfig, and spec.cainjectorConfig sections in the CertManager CR to customize the cert-manager controller, webhook, and cainjector components.

The following table describes the overridable arguments for the cert-manager components:

Argument Component Description

--dns01-recursive-nameservers=<server_address>

Controller

Provide a comma-separated list of nameservers to query for the DNS-01 self check. The nameservers can be specified either as <host>:<port>, for example, 1.1.1.1:53, or use DNS over HTTPS (DoH), for example, https://1.1.1.1/dns-query.

DNS over HTTPS (DoH) is supported starting only from cert-manager Operator for Red Hat OpenShift version 1.13.0 and later.

--dns01-recursive-nameservers-only

Controller

Specify to only use recursive nameservers instead of checking the authoritative nameservers associated with that domain.

--acme-http01-solver-nameservers=<host>:<port>

Controller

Provide a comma-separated list of <host>:<port> nameservers to query for the Automated Certificate Management Environment (ACME) HTTP01 self check. For example, --acme-http01-solver-nameservers=1.1.1.1:53.

--metrics-listen-address=<host>:<port>

Controller

Specify the host and port for the metrics endpoint. The default value is --metrics-listen-address=0.0.0.0:9402.

--issuer-ambient-credentials

Controller

You can use this argument to configure an ACME Issuer to solve DNS-01 challenges by using ambient credentials.

--enable-certificate-owner-ref

Controller

This argument sets the certificate resource as an owner of the secret where the TLS certificate is stored. For more information, see "Deleting a TLS secret automatically upon Certificate removal".

--acme-http01-solver-resource-limits-cpu

Controller

Defines the maximum CPU limit for ACME HTTP‑01 solver pods. The default value is 100m.

--acme-http01-solver-resource-limits-memory

Controller

Defines the maximum memory limit for ACME HTTP‑01 solver pods. The default value is 64Mi.

--acme-http01-solver-resource-request-cpu

Controller

Defines the minimum CPU request for ACME HTTP‑01 solver pods. The default value is 10m.

--acme-http01-solver-resource-request-memory

Controller

Defines the minimum memory request for ACME HTTP‑01 solver pods. The default value is 64Mi.

--certificate-request-minimum-backoff-duration

Controller

Specify the minimum backoff duration for certificate requests. The default value is 1h0m0s.

--concurrent-workers

Controller

The number of concurrent workers for each controller. The default value is 5.

--kube-api-qps

Controller

The maximum number of queries per second sent to the Kubernetes API server. The default value is 20.

--kube-api-burst

Controller

The maximum burst of queries per second sent to the Kubernetes API server. Must be greater than or equal to --kube-api-qps. The default value is 50.

--max-concurrent-challenges

Controller

The maximum number of ACME challenges that can run concurrently. The default value is 60.

--v=<verbosity_level>

Controller, Webhook, CA injector

Specify the log level verbosity to determine the verbosity of log messages.

Overridable environment variables for the cert-manager controller

You can configure the overridable environment variables for the cert-manager controller in the spec.controllerConfig.overrideEnv field in the CertManager CR to control proxy settings for the cert-manager controller.

The following table describes the overridable environment variables for the cert-manager controller:

Table 35. Overridable environment variables for the cert-manager controller
Environment variable	Description
`HTTP_PROXY`	Proxy server for outgoing HTTP requests.
`HTTPS_PROXY`	Proxy server for outgoing HTTPS requests.
`NO_PROXY`	Comma‑separated list of hosts that bypass the proxy.

Overridable resource parameters for the cert-manager components

You can configure the CPU and memory request and limits for the cert-manager components in the CertManager CR to control resource consumption for the controller, webhook, and cainjector pods.

The following table describes the overridable resource parameters for the cert-manager components:

Table 36. Overridable resource parameters for the cert-manager components
Field	Description
`overrideResources.limits.cpu`	Defines the maximum amount of CPU that a component pod can use.
`overrideResources.limits.memory`	Defines the maximum amount of memory that a component pod can use.
`overrideResources.requests.cpu`	Defines the minimum amount of CPU requested by the scheduler for a component pod.
`overrideResources.requests.memory`	Defines the minimum amount of memory requested by the scheduler for a component pod.

Overridable scheduling parameters for the cert-manager components

To optimize resource usage or isolate specific workloads, you can control the pod placement of your cert-manager components.

You can easily configure node selectors and tolerations by modifying the spec.controllerConfig, spec.webhookConfig, and spec.cainjectorConfig sections of the CertManager custom resource (CR).

The following table describes the pod scheduling parameters for the cert-manager components:

Table 37. Overridable scheduling parameters for the cert-manager components
Field	Description
`overrideScheduling.nodeSelector`	Key and value pairs to constrain pods to specific nodes.
`overrideScheduling.tolerations`	List of tolerations to schedule pods on tainted nodes.