PKI issuer Helm chart (cert-manager)

The Infisical PKI Issuer is a cert-manager external issuer that enables automated X.509 certificate issuance and renewal through Infisical Certificate Management. It supports both namespace-scoped (Issuer) and cluster-scoped (ClusterIssuer) resources. For more information on Infisical Certificate Management, see the Certificate Management documentation.

Installation

Install cert-manager (if not already installed)

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true

Install the Infisical PKI Issuer

helm install infisical-pki-issuer \
  oci://helm.oci.cloudsmith.io/infisical/helm-charts/infisical-pki-issuer \
  --namespace infisical-pki \
  --create-namespace

Verify the deployment

kubectl get pods -n infisical-pki

Uninstall

helm uninstall infisical-pki-issuer --namespace infisical-pki

Configuration reference

Parameter	Default	Description
`controllerManager.replicas`	`1`	Number of controller replicas.
`controllerManager.manager.image.repository`	`docker.io/infisical/pki-issuer`	Container image.
`controllerManager.manager.image.tag`	`latest`	Image tag.
`controllerManager.manager.resources.requests.cpu`	`10m`	CPU request.
`controllerManager.manager.resources.requests.memory`	`64Mi`	Memory request.
`controllerManager.manager.resources.limits.cpu`	`500m`	CPU limit.
`controllerManager.manager.resources.limits.memory`	`128Mi`	Memory limit.
`controllerManager.serviceAccount.annotations`	`{}`	Service account annotations.
`controllerManager.nodeSelector`	`{}`	Node labels a node must have for the controller pod to run on it.
`controllerManager.tolerations`	`[]`	Tolerations that let the controller pod run on tainted nodes.
`controllerManager.affinity`	`{}`	Node affinity, pod affinity, and pod anti-affinity rules.
`controllerManager.topologySpreadConstraints`	`[]`	Topology spread constraints for spreading controller pods across nodes or zones.
`controllerManager.priorityClassName`	`""`	Name of an existing `PriorityClass` to assign to the controller pod.

The nodeSelector, tolerations, affinity, topologySpreadConstraints, and priorityClassName values require chart version 1.1.0 or later. To select the controller pods in a topology spread constraint or pod anti-affinity rule, use the labels control-plane: controller-manager and app.kubernetes.io/instance: <release name>.

Default Helm values

controllerManager:
  # Node affinity, pod affinity, and pod anti-affinity rules.
  affinity: {}
  manager:
    args:
    - --metrics-bind-address=:8443
    - --leader-elect
    - --health-probe-bind-address=:8081
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    image:
      repository: docker.io/infisical/pki-issuer
      tag: latest
    resources:
      limits:
        cpu: 500m
        memory: 128Mi
      requests:
        cpu: 10m
        memory: 64Mi
  # Labels a node must have for the pod to be scheduled on it.
  nodeSelector: {}
  podSecurityContext:
    runAsNonRoot: true
  # Name of an existing PriorityClass to assign to the pod.
  priorityClassName: ""
  replicas: 1
  serviceAccount:
    annotations: {}
  # Tolerations that let the pod be scheduled on tainted nodes.
  tolerations: []
  # Rules for spreading pods across topology domains such as nodes or zones.
  topologySpreadConstraints: []
controllerMetrics:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: 8443
  type: ClusterIP
kubernetesClusterDomain: cluster.local

Get started

Configure

Operate

PKI issuer Helm chart (cert-manager)

Installation

Uninstall

Configuration reference

Default Helm values