/usr/bin/trust-manager

trust-manager is an operator for distributing bundles in Kubernetes clusters

Sources are loaded by being defined in Bundle resources, and are concatenated
into an output bundle 'target', which can then be made available to all
services across a cluster.

Usage:
  trust-manager [flags]

App flags:

      --leader-elect                              If true, trust-manager will perform leader election between instances to ensure no more than one instance of trust-manager operates at a time (default true)
      --leader-election-lease-duration duration   Lease duration for leader election (default 15s)
      --leader-election-renew-deadline duration   Lease renew deadline for leader election. (default 10s)
      --metrics-port int                          Port to expose Prometheus metrics on 0.0.0.0 on path '/metrics'. (default 9402)
      --readiness-probe-path string               HTTP path to expose the readiness probe server. (default "/readyz")
      --readiness-probe-port int                  Port to expose the readiness probe. (default 6060)

Bundle flags:

      --default-package-location string   Path to a JSON file containing the default certificate package. If set, must be a valid package.
      --filter-expired-certificates       Filter expired certificates from the bundle.
      --filter-non-ca-certs               Filter non-CA certificates, only CAs are used in the resulting Bundle
      --secret-targets-enabled            Controls if secret targets are enabled in the Bundle API.
      --target-namespaces strings         Comma-separated list of namespaces to limit both the manager and target caches.
      --trust-namespace string            Namespace to source trust bundles from. (default "cert-manager")

Logging flags:

      --log-format string   Log format (text or json) (default "text")
  -v, --log-level int       Log level (1-5). (default 1)

Webhook flags:

      --webhook-certificate-dir string   Directory where the Webhook certificate and private key are located. Certificate and private key must be named 'tls.crt' and 'tls.key' respectively. (default "/tls")
      --webhook-host string              Host to serve webhook. (default "0.0.0.0")
      --webhook-port int                 Port to serve webhook. (default 6443)

TLSConfig flags:

      --tls-cipher-suites strings          Comma-separated list of cipher suites for the webhook server. If omitted, the default Go cipher suites will be used. Only affects TLS 1.2; TLS 1.3 cipher suites are not configurable in Go.
                                           Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                           Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-curve-preferences int32Slice   Comma-separated list of numeric Go crypto/tls CurveID values, as the allowed key exchange mechanisms for the webhook server. Applies to TLS 1.2 and TLS 1.3. The supported values depend on the Go version used. See https://pkg.go.dev/crypto/tls#CurveID for values supported for each Go version. The order of the list is ignored, and key exchange mechanisms are chosen by Go from this list using an internal preference order. If omitted, the default Go curves will be used. (default [])
      --tls-min-version string             Minimum TLS version supported. If omitted, the default Go minimum version will be used. Possible values: VersionTLS10,VersionTLS11,VersionTLS12,VersionTLS13

Kubernetes flags:

      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                  UID to impersonate for the operation.
      --as-user-extra stringArray      User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.
      --cache-dir string               Default cache directory (default "/tmp/.kube/cache")
      --certificate-authority string   Path to a cert file for the certificate authority
      --client-certificate string      Path to a client certificate file for TLS
      --client-key string              Path to a client key file for TLS
      --cluster string                 The name of the kubeconfig cluster to use
      --context string                 The name of the kubeconfig context to use
      --disable-compression            If true, opt-out of response compression for all requests to the server
      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
  -n, --namespace string               If present, the namespace scope for this CLI request
      --proxy-url string               Proxy URL to use for requests to the API server
      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
  -s, --server string                  The address and port of the Kubernetes API server
      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
      --token string                   Bearer token for authentication to the API server
      --user string                    The name of the kubeconfig user to use