Red Hat OpenShift Container Platform

Trust manager custom resource fields

You can configure the behavior of the trust-manager operand by modifying the TrustManager custom resource (CR).

Distributing certificates by using trust manager is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

The following table lists the parameters for configuring trust-manager settings.

Field Type Description

spec.controllerConfig.labels

object

Optional. Specifies a list of key-value pairs to apply as labels to all resources created for the trust manager deployment.

spec.controllerConfig.annotations

object

Optional. Specifies a list of key-value pairs to apply as annotations to all resources created for the trust manager deployment.

spec.trustManagerConfig.affinity

object

Optional. Specifies the scheduling constraints for the trust manager pod. For more information, see Assigning Pods to Nodes.

spec.trustManagerConfig.defaultCAPackage

object

Optional. Configures the default CA package for trust manager. When enabled, the Operator uses the Red Hat OpenShift Container Platform trusted CA bundle injection mechanism.

spec.trustManagerConfig.defaultCAPackage.policy

string

Optional. Specifies whether the default CA package feature is enabled. When set to Enabled, the Operator configures the trusted CA bundle to trust manager. When set to Disabled, no default CA package is configured. The default value is Disabled.

To enable the useDefaultCAs: true setting in your Bundle CR, you must set the value to Enabled.

spec.trustManagerConfig.filterExpiredCertificates

string

Optional. Specifies whether trust manager filters out expired certificates from trust bundles before distributing them. When set to Enabled, the expired certificates are removed from bundles. When set to Disabled, the expired certificates are included in bundles. The default value is Disabled.

spec.trustManagerConfig.logLevel

integer

Optional. Specifies the verbosity of trust manager logging. The minimum value is 1 and the maximum value is 5. The default value is 1.

spec.trustManagerConfig.logFormat

string

Optional. Specifies the output format for trust manager logging. The supported formats are text and json. The default value is text.

spec.trustManagerConfig.nodeSelector

object

Optional. Specifies the key-value pairs that limit which nodes can host the trust manager pod. You can specify a maximum of 50 node selectors. For more information, see Assigning Pods to Nodes.

spec.trustManagerConfig.resources

object

Optional. Defines the compute resource requirements for the trust manager pod.

spec.trustManagerConfig.secretTargets

object

Optional. Defines the configuration for writing trust bundles to Secrets.

spec.trustManagerConfig.secretTargets.authorizedSecrets

array

Optional. A list of specific secret names that trust manager is authorized to create and update.

If spec.trustManagerConfig.secretTargets.policy is set to Custom, you must specify a value. If spec.trustManagerConfig.secretTargets.policy is set to Disabled, you must not specify a value.

spec.trustManagerConfig.secretTargets.policy

string

Optional. Specifies whether trust manager can write trust bundles to Secrets. When set to Disabled, trust manager cannot write trust bundles to Secrets. When set to Custom, trust manager is granted permission to create and update only the secrets listed in the authorizedSecrets parameter. The default value is Disabled.

spec.trustManagerConfig.tolerations

array

Optional. Allows the trust manager pod to be scheduled on nodes with specific taints. You can specify a maximum of 50 tolerations.

spec.trustManagerConfig.trustNamespace

string

Optional. Specifies the namespace where trust manager locates CA certificate sources, such as ConfigMaps and Secrets. This namespace must exist before you create the TrustManager custom resource. The default value is cert-manager.

You cannot change the value once set.