|
| 1 | +--- |
| 2 | +title: cainjector CLI reference |
| 3 | +description: "cert-manager cainjector CLI documentation" |
| 4 | +--- |
| 5 | +``` |
| 6 | +
|
| 7 | +cert-manager CA injector is a Kubernetes addon to automate the injection of CA data into |
| 8 | +webhooks and APIServices from cert-manager certificates. |
| 9 | +
|
| 10 | +It will ensure that annotated webhooks and API services always have the correct |
| 11 | +CA data from the referenced certificates, which can then be used to serve API |
| 12 | +servers and webhook servers. |
| 13 | +
|
| 14 | +Usage: |
| 15 | + cainjector [flags] |
| 16 | +
|
| 17 | +Flags: |
| 18 | + --config string Path to a file containing a CAInjectorConfiguration object used to configure the controller |
| 19 | + --enable-apiservices-injectable Inject CA data to annotated APIServices. This functionality is not required if cainjector is only used as cert-manager's internal component and setting it to false might reduce memory consumption (default true) |
| 20 | + --enable-certificates-data-source Enable configuring cert-manager.io Certificate resources as potential sources for CA data. Requires cert-manager.io Certificate CRD to be installed. This data source can be disabled to reduce memory consumption if you only use cainjector as part of cert-manager's installation (default true) |
| 21 | + --enable-customresourcedefinitions-injectable Inject CA data to annotated CustomResourceDefinitions. This functionality is not required if cainjector is only used as cert-manager's internal component and setting it to false might slightly reduce memory consumption (default true) |
| 22 | + --enable-mutatingwebhookconfigurations-injectable Inject CA data to annotated MutatingWebhookConfigurations. This functionality is required for cainjector to work correctly as cert-manager's internal component (default true) |
| 23 | + --enable-profiling Enable profiling for controller. |
| 24 | + --enable-validatingwebhookconfigurations-injectable Inject CA data to annotated ValidatingWebhookConfigurations. This functionality is required for cainjector to correctly function as cert-manager's internal component (default true) |
| 25 | + --feature-gates mapStringBool A set of key=value pairs that describe feature gates for alpha/experimental features. Options are: |
| 26 | + AllAlpha=true|false (ALPHA - default=false) |
| 27 | + AllBeta=true|false (BETA - default=false) |
| 28 | + CAInjectorMerging=true|false (BETA - default=true) |
| 29 | + ServerSideApply=true|false (ALPHA - default=false) |
| 30 | + -h, --help help for cainjector |
| 31 | + --kubeconfig string Paths to a kubeconfig. Only required if out-of-cluster. |
| 32 | + --leader-elect If true, cainjector will perform leader election between instances to ensure no more than one instance of cainjector operates at a time (default true) |
| 33 | + --leader-election-lease-duration duration The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 1m0s) |
| 34 | + --leader-election-namespace string Namespace used to perform leader election. Only used if leader election is enabled (default "kube-system") |
| 35 | + --leader-election-renew-deadline duration The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled. (default 40s) |
| 36 | + --leader-election-retry-period duration The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled. (default 15s) |
| 37 | + --log-flush-frequency duration Maximum number of seconds between log flushes (default 5s) |
| 38 | + --logging-format string Sets the log format. Permitted formats: "json" (gated by LoggingBetaOptions), "text". (default "text") |
| 39 | + --metrics-dynamic-serving-ca-secret-name string name of the secret used to store the CA that signs serving certificates |
| 40 | + --metrics-dynamic-serving-ca-secret-namespace string namespace of the secret used to store the CA that signs metrics serving certificates |
| 41 | + --metrics-dynamic-serving-dns-names strings DNS names that should be present on certificates generated by the metrics dynamic serving CA |
| 42 | + --metrics-dynamic-serving-leaf-duration duration leaf duration of metrics serving certificates (default 168h0m0s) |
| 43 | + --metrics-listen-address string The host and port that the metrics endpoint should listen on. The value '0' disables the metrics server (default "0.0.0.0:9402") |
| 44 | + --metrics-tls-cert-file string path to the file containing the TLS certificate to serve metrics with |
| 45 | + --metrics-tls-cipher-suites strings Comma-separated list of cipher suites for the metrics server. If omitted, the default Go cipher suites will be used. Possible values: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_RC4_128_SHA |
| 46 | + --metrics-tls-min-version string Minimum TLS version supported by the metrics server. If omitted, the default Go minimum version will be used. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13 |
| 47 | + --metrics-tls-private-key-file string path to the file containing the TLS private key to serve metrics with |
| 48 | + --namespace string If set, this limits the scope of cainjector to a single namespace. If set, cainjector will not update resources with certificates outside of the configured namespace. |
| 49 | + --profiler-address string The host and port that Go profiler should listen on, i.e localhost:6060. Ensure that profiler is not exposed on a public address. Profiler will be served at /debug/pprof. (default "localhost:6060") |
| 50 | + -v, --v Level number for the log level verbosity |
| 51 | + --vmodule pattern=N,... comma-separated list of pattern=N settings for file-filtered logging (only works for text log format) |
| 52 | +``` |
0 commit comments