Skip to content

issuer-configuration.md

Latest commit

 

History

History
93 lines (85 loc) · 2.73 KB

issuer-configuration.md

File metadata and controls

93 lines (85 loc) · 2.73 KB
Raw

Issuer configuration reference

This page references the Issuer and ClusterIssuer configurations for the cert-manager webhook Hetzner.

The webhook is responsible for one or more issuers, each with its own configuration. It is also possible for each Issuer to use its own Hetzner Cloud API token. The following options are available:

Option Type Default Description
groupName string (Required) Always set this value to acme.hetzner.com, unless you configured a different groupName for the Helm chart.
solverName string (Required) Always set this value to hetzner
config.tokenSecretKeyRef.name string Name of the Kubernetes secret, which stores the Hetzner Cloud API token. Required unless config.tokenFilePath is set.
config.tokenSecretKeyRef.key string Key in the Kubernetes secret, which stores the Hetzner Cloud API token. Required unless config.tokenFilePath is set. Leading and trailing whitespace in the token are trimmed.
config.tokenFilePath string Path to a file containing the Hetzner Cloud API token, mounted into the webhook pod. Mutually exclusive with config.tokenSecretKeyRef; setting both is an error. Leading and trailing whitespace in the file are trimmed.

Example: token from Kubernetes secret

# issuer.yaml
# [...]
solvers:
  - dns01:
      webhook:
        groupName: acme.hetzner.com
        solverName: hetzner
        config:
          tokenSecretKeyRef:
            name: hetzner
            key: token

Example: token from mounted file

Mount the token into the webhook pod (for example via the chart's extraVolumes / extraVolumeMounts values, a projected volume, or a CSI secret driver) and reference its path in the issuer config:

# issuer.yaml
# [...]
solvers:
  - dns01:
      webhook:
        groupName: acme.hetzner.com
        solverName: hetzner
        config:
          tokenFilePath: /var/run/secrets/hetzner/token