/usr/bin/cmd

cert-manager istio agent for signing istio agent certificate signing requests through cert-manager

Usage:
  cert-manager-istio-csr [flags]

App flags:

      --log-format string             log output format: text|json (default "text")
  -v, --log-level uint32              Log level (1-5). (default 1)
      --metrics-port int              Port to expose Prometheus metrics on 0.0.0.0 on path '/metrics'. (default 9402)
      --readiness-probe-path string   HTTP path to expose the readiness probe server. (default "/readyz")
      --readiness-probe-port int      Port to expose the readiness probe. (default 6060)

Cert-manager flags:

  -c, --certificate-namespace string                   Namespace to request certificates. (default "istio-system")
  -e, --issuer-enabled                                 Enable the default issuer, the application will not become ready until this issuer is available. (default true)
  -g, --issuer-group string                            Group of the issuer to sign istio workload certificates. (default "cert-manager.io")
  -k, --issuer-kind string                             Kind of the issuer to sign istio workload certificates. (default "Issuer")
  -u, --issuer-name string                             Name of the issuer to sign istio workload certificates. (default "istio-ca")
  -d, --preserve-certificate-requests                  If enabled, will preserve created CertificateRequests, rather than deleting when they are ready. *WARNING*: do not use in production environments as over time requests will consume large amounts of etcd and API server resources.
      --runtime-issuance-config-map-name string        Name of a ConfigMap to watch at runtime for issuer details. If such a ConfigMap is found, overrides issuer-name, issuer-kind and issuer-group
      --runtime-issuance-config-map-namespace string   Namespace for ConfigMap to be watched at runtime for issuer details

Kubernetes flags:

      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                  UID to impersonate for the operation.
      --as-user-extra stringArray      User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.
      --cache-dir string               Default cache directory (default "/tmp/.kube/cache")
      --certificate-authority string   Path to a cert file for the certificate authority
      --client-certificate string      Path to a client certificate file for TLS
      --client-key string              Path to a client key file for TLS
      --cluster string                 The name of the kubeconfig cluster to use
      --context string                 The name of the kubeconfig context to use
      --disable-compression            If true, opt-out of response compression for all requests to the server
      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
  -n, --namespace string               If present, the namespace scope for this CLI request
      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
  -s, --server string                  The address and port of the Kubernetes API server
      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
      --token string                   Bearer token for authentication to the API server
      --user string                    The name of the kubeconfig user to use

TLS flags:

      --root-ca-file string                     File location of a PEM encoded Roots CA bundle to be used as root of trust for TLS in the mesh. If empty, the CA returned from the cert-manager issuer will be used.
      --serving-certificate-dns-names strings   A list of DNS names to request for the server's serving certificate which will be presented to istio-agents. (default [cert-manager-istio-csr.cert-manager.svc])
  -t, --serving-certificate-duration duration   Certificate duration of serving certificates. Will be renewed after 2/3 of the duration. (default 1h0m0s)
      --serving-certificate-key-size int        Number of bits to use for the server's serving certificate (RSAKeySize). (default 2048)
      --serving-signature-algorithm string      The type of signature algorithm to use when generating private keys. Currently only RSA and ECDSA are supported. By default RSA is used. (default "RSA")
      --trust-domain string                     The Istio cluster's trust domain. (default "cluster.local")

Server flags:

      --ca-trusted-node-accounts strings           A list of service accounts that are allowed to use node authentication for CSRs. Node authentication allows an identity to create CSRs on behalf of other identities, but only if there is a pod running on the same node with that identity. This is intended for use with node proxies.
      --cluster-id string                          The ID of the istio cluster to verify. (default "Kubernetes")
      --enable-client-cert-authenticator           Enable the client certificate authenticator.
  -m, --max-client-certificate-duration duration   Maximum duration a client certificate can be requested and valid for. Will override with this value if the requested duration is larger (default 1h0m0s)
  -a, --serving-address string                     Address to serve certificates gRPC service. (default "0.0.0.0:6443")

Controller flags:

      --configmap-namespace-selector string      Selector to filter on namespaces where the controller creates istio-ca-root-cert ConfigMap. Supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)
      --disable-kubernetes-client-rate-limiter   Allows the default client-go rate limiter to be disabled if the Kubernetes API server supports [API Priority and Fairness](https://kubernetes.io/docs/concepts/cluster-administration/flow-control/)
      --leader-election-namespace string         Namespace to use for controller leader election. (default "istio-system")
      --max-concurrent-reconciles int            Maximum number of concurrent reconciles for controllers. (default 1)

Additional-annotations flags:

      --certificate-request-additional-annotations stringToString   Additional annotations to include on created CertificateRequests resources. (default [])

Istiod-cert flags:

      --istiod-cert-additional-annotations stringToString   Additional annotations to add for the istiod cert (if enabled). (default [])
      --istiod-cert-additional-dns-names strings            Additional DNS names to use for istiod cert (if enabled). Useful if istiod needs to be accessible outside of the cluster
      --istiod-cert-duration duration                       Requested duration of the istiod certificate, if enabled (default 1h0m0s)
      --istiod-cert-enabled                                 Whether to dynamically provision the istiod certificate
      --istiod-cert-istio-revisions strings                 A list of istio revisions which should have DNS SAN entries in the dynamic istiod cert
      --istiod-cert-key-algorithm string                    Key algorithm to use for the istiod cert. Can be RSA or ECDSA. (default "RSA")
      --istiod-cert-key-size int                            Parameter for istiod certificate key. For RSA, must be a number of bits >= 2048. For ECDSA, can only be 256 or 384, corresponding to P-256 and P-384 respectively. (default 2048)
      --istiod-cert-name string                             Name of the Certificate resource to use for dynamic istiod provisioning (default "istiod-dynamic")
      --istiod-cert-namespace string                        Namespace for the dynamic istiod cert (default "istio-system")
      --istiod-cert-renew-before duration                   How long to wait before trying to renew the istiod certificate (if enabled). Must be less than duration. (default 30m0s)