approver-policy API Reference

Packages:

policy.cert-manager.io/v1alpha1

`policy.cert-manager.io/v1alpha1`

Resource Types:

CertificateRequestPolicy

`CertificateRequestPolicy`

CertificateRequestPolicy is an object for describing a "policy profile" that makes decisions on whether applicable CertificateRequests should be approved or denied.

Name	Type	Description	Required
apiVersion	string	policy.cert-manager.io/v1alpha1	true
kind	string	CertificateRequestPolicy	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	CertificateRequestPolicySpec defines the desired state of CertificateRequestPolicy.	false
status	object	CertificateRequestPolicyStatus defines the observed state of the CertificateRequestPolicy.	false

`CertificateRequestPolicy.spec`

CertificateRequestPolicySpec defines the desired state of CertificateRequestPolicy.

Name	Type	Description	Required
selector	object	Selector is used for selecting over which CertificateRequests this CertificateRequestPolicy is appropriate for and so will used for its approval evaluation.	true
allowed	object	Allowed is the set of attributes that are "allowed" by this policy. A CertificateRequest will only be considered permissible for this policy if the CertificateRequest has the same or less as what is allowed. Empty or `nil` allowed fields mean CertificateRequests are not allowed to have that field present to be permissible.	false
constraints	object	Constraints is the set of attributes that must be satisfied by the CertificateRequest for the request to be permissible by the policy. Empty or `nil` constraint fields mean CertificateRequests satisfy that field with any value of their corresponding attribute.	false
plugins	map[string]object	Plugins define a set of plugins and their configuration that should be executed when this policy is evaluated against a CertificateRequest. A plugin must already be built within approver-policy for it to be available.	false

`CertificateRequestPolicy.spec.selector`

Selector is used for selecting over which CertificateRequests this CertificateRequestPolicy is appropriate for and so will used for its approval evaluation.

Name	Type	Description	Required
issuerRef	object	IssuerRef is used to match this CertificateRequestPolicy against processed CertificateRequests. This policy will only be evaluated against a CertificateRequest whose `spec.issuerRef` field matches `spec.selector.issuerRef`. CertificateRequests will not be processed on unmatched `issuerRef` if defined, regardless of whether the requestor is bound by RBAC. Accepts wildcards "". Omitted values are equivalent to "". The following value will match all `issuerRefs`: `issuerRef: {}`	false
namespace	object	Namespace is used to select on Namespaces, meaning the CertificateRequestPolicy will only match on CertificateRequests that have been created in matching selected Namespaces. If this field is omitted, all Namespaces are selected.	false

`CertificateRequestPolicy.spec.selector.issuerRef`

IssuerRef is used to match this CertificateRequestPolicy against processed CertificateRequests. This policy will only be evaluated against a CertificateRequest whose spec.issuerRef field matches spec.selector.issuerRef. CertificateRequests will not be processed on unmatched issuerRef if defined, regardless of whether the requestor is bound by RBAC. Accepts wildcards "". Omitted values are equivalent to "". The following value will match all issuerRefs: issuerRef: {}

Name	Type	Description	Required
group	string	Group is the wildcard selector to match the `spec.issuerRef.group` field on requests. Accepts wildcards "*". An omitted field or value of `nil` matches all.	false
kind	string	Kind is the wildcard selector to match the `spec.issuerRef.kind` field on requests. Accepts wildcards "*". An omitted field or value of `nil` matches all.	false
name	string	Name is the wildcard selector to match the `spec.issuerRef.name` field on requests. Accepts wildcards "*". An omitted field or value of `nil` matches all.	false

`CertificateRequestPolicy.spec.selector.namespace`

Namespace is used to select on Namespaces, meaning the CertificateRequestPolicy will only match on CertificateRequests that have been created in matching selected Namespaces. If this field is omitted, all Namespaces are selected.

Name	Type	Description	Required
matchLabels	map[string]string	MatchLabels is the set of Namespace labels that select on CertificateRequests which have been created in a Namespace matching the selector.	false
matchNames	[]string	MatchNames are the set of Namespace names that select on CertificateRequests that have been created in a matching Namespace. Accepts wildcards "*".	false

`CertificateRequestPolicy.spec.allowed`

Allowed is the set of attributes that are "allowed" by this policy. A CertificateRequest will only be considered permissible for this policy if the CertificateRequest has the same or less as what is allowed. Empty or nil allowed fields mean CertificateRequests are not allowed to have that field present to be permissible.

Name	Type	Description	Required
commonName	object	CommonName defines the X.509 Common Name that is permissible.	false
dnsNames	object	DNSNames defines the X.509 DNS SANs that may be requested for. Accepts wildcards "*".	false
emailAddresses	object	EmailAddresses defines the X.509 Email SANs that may be requested for.	false
ipAddresses	object	IPAddresses defines the X.509 IP SANs that may be requested for.	false
isCA	boolean	IsCA defines whether it is permissible for a CertificateRequest to have the `spec.IsCA` field set to `true`. An omitted field, value of `nil` or `false`, forbids the `spec.IsCA` field from bring `true`. A value of `true` permits CertificateRequests setting the `spec.IsCA` field to `true`.	false
subject	object	Subject defines the X.509 subject that is permissible. An omitted field or value of `nil` forbids any Subject being requested.	false
uris	object	URIs defines the X.509 URI SANs that may be requested for.	false
usages	[]enum	Usages defines the list of permissible key usages that may appear on the CertificateRequest `spec.keyUsages` field. An omitted field or value of `nil` forbids any Usages being requested. An empty slice `[]` is equivalent to `nil`.	false

`CertificateRequestPolicy.spec.allowed.commonName`

CommonName defines the X.509 Common Name that is permissible.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Value is also defined.	false
value	string	Value defines the value that is permissible to be present on the request. Accepts wildcards "*". An omitted field or value of `nil` forbids the value from being requested. An empty string is equivalent to `nil`, however an empty string pared with Required as `true` is an impossible condition that always denies. Value may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.dnsNames`

DNSNames defines the X.509 DNS SANs that may be requested for. Accepts wildcards "*".

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.emailAddresses`

EmailAddresses defines the X.509 Email SANs that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.ipAddresses`

IPAddresses defines the X.509 IP SANs that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject`

Subject defines the X.509 subject that is permissible. An omitted field or value of nil forbids any Subject being requested.

Name	Type	Description	Required
countries	object	Countries define the X.509 Subject Countries that may be requested for.	false
localities	object	Localities defines the X.509 Subject Localities that may be requested for.	false
organizationalUnits	object	OrganizationalUnits defines the X.509 Subject Organizational Units that may be requested for.	false
organizations	object	Organizations define the X.509 Subject Organizations that may be requested for.	false
postalCodes	object	PostalCodes defines the X.509 Subject Postal Codes that may be requested for.	false
provinces	object	Provinces defines the X.509 Subject Provinces that may be requested for.	false
serialNumber	object	SerialNumber defines the X.509 Subject Serial Number that may be requested for.	false
streetAddresses	object	StreetAddresses defines the X.509 Subject Street Addresses that may be requested for.	false

`CertificateRequestPolicy.spec.allowed.subject.countries`

Countries define the X.509 Subject Countries that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.localities`

Localities defines the X.509 Subject Localities that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.organizationalUnits`

OrganizationalUnits defines the X.509 Subject Organizational Units that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.organizations`

Organizations define the X.509 Subject Organizations that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.postalCodes`

PostalCodes defines the X.509 Subject Postal Codes that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.provinces`

Provinces defines the X.509 Subject Provinces that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.serialNumber`

SerialNumber defines the X.509 Subject Serial Number that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Value is also defined.	false
value	string	Value defines the value that is permissible to be present on the request. Accepts wildcards "*". An omitted field or value of `nil` forbids the value from being requested. An empty string is equivalent to `nil`, however an empty string pared with Required as `true` is an impossible condition that always denies. Value may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.subject.streetAddresses`

StreetAddresses defines the X.509 Subject Street Addresses that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.allowed.uris`

URIs defines the X.509 URI SANs that may be requested for.

Name	Type	Description	Required
required	boolean	Required marks this field as being a required value on the request. May only be set to true if Values is also defined. Default is nil which marks the field as not required.	false
values	[]string	Defines the values that are permissible to be present on request. Accepts wildcards "*". An omitted field or value of `nil` forbids any value on the related field in the request from being requested. An empty slice `[]` is equivalent to `nil`, however an empty slice pared with Required `true` is an impossible condition that always denies. Values may not be `nil` if Required is `true`.	false

`CertificateRequestPolicy.spec.constraints`

Constraints is the set of attributes that must be satisfied by the CertificateRequest for the request to be permissible by the policy. Empty or nil constraint fields mean CertificateRequests satisfy that field with any value of their corresponding attribute.

Name	Type	Description	Required
maxDuration	string	MaxDuration defines the maximum duration a certificate may be requested for. Values are inclusive (i.e. a max value of `1h` will accept a duration of `1h`). MaxDuration and MinDuration may be the same value. An omitted field or value of `nil` permits any maximum duration. If MaxDuration is defined, a duration must be requested on the CertificateRequest.	false
minDuration	string	MinDuration defines the minimum duration a certificate may be requested for. Values are inclusive (i.e. a min value of `1h` will accept a duration of `1h`). MinDuration and MaxDuration may be the same value. An omitted field or value of `nil` permits any minimum duration. If MinDuration is defined, a duration must be requested on the CertificateRequest.	false
privateKey	object	PrivateKey defines the shape of permissible private keys that may be used for the request with this policy. An omitted field or value of `nil` permits the use of any private key by the requestor.	false

`CertificateRequestPolicy.spec.constraints.privateKey`

PrivateKey defines the shape of permissible private keys that may be used for the request with this policy. An omitted field or value of nil permits the use of any private key by the requestor.

Name Type Description Required

Name	Type	Description	Required
algorithm	enum	Algorithm defines the allowed crypto algorithm that is used by the requestor for their private key in their request. An omitted field or value of `nil` permits any Algorithm. Enum: RSA, ECDSA, Ed25519	false
maxSize	integer	MaxSize defines the maximum key size a requestor may use for their private key. Values are inclusive (i.e. a min value of `2048` will accept a size of `2048`). MaxSize and MinSize may be the same value. An omitted field or value of `nil` permits any maximum size.	false
minSize	integer	MinSize defines the minimum key size a requestor may use for their private key. Values are inclusive (i.e. a min value of `2048` will accept a size of `2048`). MinSize and MaxSize may be the same value. An omitted field or value of `nil` permits any minimum size.	false

algorithm

enum

Algorithm defines the allowed crypto algorithm that is used by the requestor for their private key in their request. An omitted field or value of nil permits any Algorithm.

Enum: RSA, ECDSA, Ed25519

false

maxSize

integer

MaxSize defines the maximum key size a requestor may use for their private key. Values are inclusive (i.e. a min value of 2048 will accept a size of 2048). MaxSize and MinSize may be the same value. An omitted field or value of nil permits any maximum size.

false

minSize

integer

MinSize defines the minimum key size a requestor may use for their private key. Values are inclusive (i.e. a min value of 2048 will accept a size of 2048). MinSize and MaxSize may be the same value. An omitted field or value of nil permits any minimum size.

false

`CertificateRequestPolicy.spec.plugins[key]`

CertificateRequestPolicyPluginData is configuration needed by the plugin approver to evaluate a CertificateRequest on this policy.

Name	Type	Description	Required
values	map[string]string	Values define a set of well-known, to the plugin, key value pairs that are required for the plugin to successfully evaluate a request based on this policy.	false

`CertificateRequestPolicy.status`

CertificateRequestPolicyStatus defines the observed state of the CertificateRequestPolicy.

Name	Type	Description	Required
conditions	[]object	List of status conditions to indicate the status of the CertificateRequestPolicy. Known condition types are `Ready`.	false

`CertificateRequestPolicy.status.conditions[index]`

CertificateRequestPolicyCondition contains condition information for a CertificateRequestPolicyStatus.

Name	Type	Description	Required
status	string	Status of the condition, one of ('True', 'False', 'Unknown').	true
type	string	Type of the condition, known values are (`Ready`).	true
lastTransitionTime	string	LastTransitionTime is the timestamp corresponding to the last status change of this condition. Format: date-time	false
message	string	Message is a human readable description of the details of the last transition, complementing reason.	false
observedGeneration	integer	If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the CertificateRequestPolicy. Format: int64	false
reason	string	Reason is a brief machine readable explanation for the condition's last transition.	false