/usr/bin/csi

A cert-manager CSI driver for requesting Athenz certificates from cert-manager on behalf of the mounting Pod.

Usage:
  csi-driver-athenz [flags]

App flags:

      --csi-driver-name string   The name of the CSI driver, as installed in Kubernetes (default "csi.cert-manager.athenz.io")
      --kube-api-burst int       Maximum burst for throttling requests to the Kubernetes API server (0 keeps the client-go default of 10).
      --kube-api-qps float32     Maximum queries-per-second to the Kubernetes API server (0 keeps the client-go default of 5).
  -v, --log-level string         Log level (1-5). (default "1")

Driver flags:

      --data-root string   Path to the in-memory data directory used to store data.
      --endpoint string    Path to the unix socket used to listen for gRPC requests.
      --node-id string     Name of the node the driver is running on.

Cert-manager flags:

      --certificate-request-duration duration                  The duration that created CertificateRequests will use. (default 1h0m0s)
      --extra-certificate-request-annotations stringToString   Comma-separated list of extra annotations to add to certificate requests e.g '--extra-certificate-request-annotations=hello=world,test=annotation' (default [])
      --issuer-group string                                    Group of the issuer that CertificateRequests will be created for. (default "athenz-issuer.athenz.io")
      --issuer-kind string                                     Kind of the issuer that CertificateRequests will be created for. (default "ClusterIssuer")
      --issuer-name string                                     Name of the issuer that CertificateRequests will be created for. (default "athenz-ca")
      --trust-domain string                                    The trust domain that will be requested for on created CertificateRequests. (default "cluster.local")

Volume flags:

      --enable-keystore                                                Enable provisioning of PKCS12 and JKS keystores alongside the PEM identity files. When false (default), no keystores are written and the --file-name-keystore / --file-name-jks / --keystore-password / --keystore-alias flags have no effect.
      --file-name-ca string                                            The file name that the certificate's private key will be written to within the pod's volume directory. (default "ca.crt")
      --file-name-certificate string                                   The file name that signed certificates will be written to within the pod's volume directory. (default "tls.crt")
      --file-name-jks string                                           The file name of the JKS keystore written into the pod's volume. Requires --enable-keystore. Set to an empty string to skip JKS keystore generation while still writing the PKCS12 keystore. (default "service.jks")
      --file-name-key string                                           The file name that the certificate's private key will be written to within the pod's volume directory. (default "tls.key")
      --file-name-keystore openssl pkcs12 -export -noiter -nomaciter   The file name of the PKCS12 keystore written into the pod's volume. Requires --enable-keystore. The keystore contains the private key and leaf certificate using the legacy PKCS12 encoding to mirror the on-disk format produced by openssl pkcs12 -export -noiter -nomaciter. Set to an empty string to skip PKCS12 keystore generation while still writing the JKS keystore. (default "service.pkcs12")
      --keystore-alias string                                          Alias used for the private key entry inside the JKS keystore. Requires --enable-keystore. (default "service")
      --keystore-password-file changeit                                File path whose contents are used as the password to encrypt the PKCS12 and JKS keystores. Ignored when the KEYSTORE_PASSWORD environment variable is set (env wins). When both are unset, the well-known Java default changeit is used. The password is never accepted as a plain CLI flag, to avoid exposing it via `ps`. Requires --enable-keystore.
      --source-ca-bundle string                                        File path that is read by the driver which will be written to all managed volumes to the file location inside volumes defined in --file-name-ca. If undefined, no CA file is written to volumes.
      --volume-write-mode atomic-dir                                   How certificate data is written into the pod's volume. atomic-dir (default) is the upstream csi-lib writer, which replaces the files via a new timestamped directory on every write; consumers that watch a file with raw inotify (istio-agent gateways with file-mounted certificates, for example) lose their watch on every renewal and keep serving the stale certificate. `in-place` rewrites the existing files instead, keeping their inodes so such watches survive renewals. Note that `in-place` rewrites are not atomic against concurrent readers: a reader that catches the window between the write and the truncate must re-read on the next inotify event, as istio-agent does. (default "atomic-dir")

Athenz flags:

      --ca-cert-file string        Athenz CA certificate file path.
      --cert-country-name string   Country name in the service identity certificate. (default "US")
      --cert-org-name string       Organization name in the service identity certificate. (default "Athenz")
      --cloud-provider string      Cloud provider where the driver is running.
      --cloud-region string        Cloud region where the driver is running.
      --dns-domains string         DNS domains to be added in the service identity certificate. Multiple domains can be specified by separating them with commas.
      --provider-prefix string     Provider prefix for the backend provider in ZTS which is responsible for verifying and issuing the identity.
      --zts string                 URL of the ZTS server.

Kubernetes flags:

      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                  UID to impersonate for the operation.
      --as-user-extra stringArray      User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.
      --cache-dir string               Default cache directory (default "/tmp/.kube/cache")
      --certificate-authority string   Path to a cert file for the certificate authority
      --client-certificate string      Path to a client certificate file for TLS
      --client-key string              Path to a client key file for TLS
      --cluster string                 The name of the kubeconfig cluster to use
      --context string                 The name of the kubeconfig context to use
      --disable-compression            If true, opt-out of response compression for all requests to the server
      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
  -n, --namespace string               If present, the namespace scope for this CLI request
      --proxy-url string               Proxy URL to use for requests to the API server
      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
  -s, --server string                  The address and port of the Kubernetes API server
      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
      --token string                   Bearer token for authentication to the API server
      --user string                    The name of the kubeconfig user to use