Red Hat OpenShift Container Platform

Customizing cert-manager by overriding arguments from the cert-manager Operator API

You can override the supported arguments for the cert-manager Operator for Red Hat OpenShift by adding a spec.controllerConfig section in the CertManager resource.

Prerequisites

You have access to the Red Hat OpenShift Container Platform cluster as a user with the cluster-admin role.

Procedure

Edit the CertManager resource by running the following command:
```
$ oc edit certmanager cluster
```

Add a spec.controllerConfig section with the following override arguments:

apiVersion: operator.openshift.io/v1alpha1
kind: CertManager
metadata:
  name: cluster
  ...
spec:
  ...
  controllerConfig:
    overrideArgs:
      - '--dns01-recursive-nameservers=<server_address>'
      - '--dns01-recursive-nameservers-only'
      - '--acme-http01-solver-nameservers=<host>:<port>'
      - '--v=<verbosity_level>'
      - '--metrics-listen-address=<host>:<port>'
      - '--issuer-ambient-credentials'
      - '--acme-http01-solver-resource-limits-cpu=<quantity>'
      - '--acme-http01-solver-resource-limits-memory=<quantity>'
      - '--acme-http01-solver-resource-request-cpu=<quantity>'
      - '--acme-http01-solver-resource-request-memory=<quantity>'
      - '--certificate-request-minimum-backoff-duration=<duration>'
      - '--concurrent-workers=<quantity>'
      - '--kube-api-qps=<quantity>'
      - '--kube-api-burst=<quantity>'
      - '--max-concurrent-challenges=<quantity>'
  webhookConfig:
    overrideArgs:
      - '--v=<verbosity_level>'
  cainjectorConfig:
    overrideArgs:
      - '--v=<verbosity_level>'

For information about the overridable aruguments, see "Overridable arguments for the cert-manager components" in "Explanation of fields in the CertManager custom resource".

Save your changes and quit the text editor to apply your changes.

Verification

Verify that arguments are updated for cert-manager pods by running the following command:

$ oc get pods -n cert-manager -o yaml

Example output

...
  metadata:
    name: cert-manager-6d4b5d4c97-kldwl
    namespace: cert-manager
...
  spec:
    containers:
    - args:
      # ...
        - --acme-http01-solver-nameservers=1.1.1.1:53
        - --concurrent-workers=5
        - --dns01-recursive-nameservers=1.1.1.1:53
        - --dns01-recursive-nameservers-only
        - --kube-api-burst=50
        - --kube-api-qps=20
        - --max-concurrent-challenges=60
        - --metrics-listen-address=0.0.0.0:9042
        - --v=6
...
  metadata:
    name: cert-manager-cainjector-866c4fd758-ltxxj
    namespace: cert-manager
...
  spec:
    containers:
    - args:
      # ...
        - --v=2
...
  metadata:
    name: cert-manager-webhook-6d48f88495-c88gd
    namespace: cert-manager
...
  spec:
    containers:
    - args:
      # ...
        - --v=2