/usr/bin/trust-manager

trust-manager is an operator for distributing bundles in Kubernetes clusters

Sources are loaded by being defined in Bundle resources, and are concatenated
into an output bundle 'target', which can then be made available to all
services across a cluster.

Usage:
  trust-manager [flags]

App flags:

      --leader-elect                              If true, trust-manager will perform leader election between instances to ensure no more than one instance of trust-manager operates at a time (default true)
      --leader-election-lease-duration duration   Lease duration for leader election (default 15s)
      --leader-election-renew-deadline duration   Lease renew deadline for leader election. (default 10s)
      --metrics-port int                          Port to expose Prometheus metrics on 0.0.0.0 on path '/metrics'. (default 9402)
      --readiness-probe-path string               HTTP path to expose the readiness probe server. (default "/readyz")
      --readiness-probe-port int                  Port to expose the readiness probe. (default 6060)

Bundle flags:

      --default-package-location string   Path to a JSON file containing the default certificate package. If set, must be a valid package.
      --filter-expired-certificates       Filter expired certificates from the bundle.
      --filter-non-ca-certs               Filter non-CA certificates, only CAs are used in the resulting Bundle
      --secret-targets-enabled            Controls if secret targets are enabled in the Bundle API.
      --target-namespaces strings         Comma-separated list of namespaces to limit both the manager and target caches.
      --trust-namespace string            Namespace to source trust bundles from. (default "cert-manager")

Logging flags:

      --log-format string   Log format (text or json) (default "text")
  -v, --log-level int       Log level (1-5). (default 1)

Webhook flags:

      --webhook-certificate-dir string   Directory where the Webhook certificate and private key are located. Certificate and private key must be named 'tls.crt' and 'tls.key' respectively. (default "/tls")
      --webhook-host string              Host to serve webhook. (default "0.0.0.0")
      --webhook-port int                 Port to serve webhook. (default 6443)

TLSConfig flags:

      --tls-cipher-suites strings   Comma-separated list of cipher suites for the webhook server. If omitted, the default Go cipher suites will be used.
                                    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
                                    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
      --tls-min-version string      Minimum TLS version supported. If omitted, the default Go minimum version will be used. Possible values: VersionTLS10,VersionTLS11,VersionTLS12,VersionTLS13

Kubernetes flags:

      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                  UID to impersonate for the operation.
      --as-user-extra stringArray      User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.
      --cache-dir string               Default cache directory (default "/tmp/.kube/cache")
      --certificate-authority string   Path to a cert file for the certificate authority
      --client-certificate string      Path to a client certificate file for TLS
      --client-key string              Path to a client key file for TLS
      --cluster string                 The name of the kubeconfig cluster to use
      --context string                 The name of the kubeconfig context to use
      --disable-compression            If true, opt-out of response compression for all requests to the server
      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
  -n, --namespace string               If present, the namespace scope for this CLI request
      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
  -s, --server string                  The address and port of the Kubernetes API server
      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
      --token string                   Bearer token for authentication to the API server
      --user string                    The name of the kubeconfig user to use