Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.certificate.enabled

If enable/disable the Cert-Manager extension.

Environment variable: QUARKUS_CERTIFICATE_ENABLED

boolean

true

quarkus.certificate.name

The name of the certificate resource to be generated. If not provided, it will use the default name for the application resources.

Environment variable: QUARKUS_CERTIFICATE_NAME

string

quarkus.certificate.secret-name

SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer.

Environment variable: QUARKUS_CERTIFICATE_SECRET_NAME

string

required

quarkus.certificate.common-name

CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs.

Environment variable: QUARKUS_CERTIFICATE_COMMON_NAME

string

quarkus.certificate.duration

The lifetime of the Certificate.

Environment variable: QUARKUS_CERTIFICATE_DURATION

string

quarkus.certificate.renew-before

How long before the currently issued certificate’s expiry cert-manager should renew the certificate. The default is 2⁄3 of the issued certificate’s duration.

Environment variable: QUARKUS_CERTIFICATE_RENEW_BEFORE

string

quarkus.certificate.dns-names

The list of Subject Alternative Names.

Environment variable: QUARKUS_CERTIFICATE_DNS_NAMES

list of string

quarkus.certificate.ip-addresses

The list of IP address subjectAltNames to be set on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_IP_ADDRESSES

list of string

quarkus.certificate.uris

The list of URI subjectAltNames to be set on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_URIS

list of string

quarkus.certificate.email-addresses

The list of email subjectAltNames to be set on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_EMAIL_ADDRESSES

list of string

quarkus.certificate.is-ca

If true, it will mark this Certificate as valid for certificate signing.

Environment variable: QUARKUS_CERTIFICATE_IS_CA

boolean

quarkus.certificate.usages

The set of x509 usages that are requested for the certificate.

Environment variable: QUARKUS_CERTIFICATE_USAGES

list of string

quarkus.certificate.encode-usages-in-request

Environment variable: QUARKUS_CERTIFICATE_ENCODE_USAGES_IN_REQUEST

boolean

false

quarkus.certificate.volume-mount-path

Environment variable: QUARKUS_CERTIFICATE_VOLUME_MOUNT_PATH

string

/etc/certs

quarkus.certificate.autoconfigure

Environment variable: QUARKUS_CERTIFICATE_AUTOCONFIGURE

none, automatic, all, https-only, cluster-only

automatic

The reference to the issuer for this certificate This configuration section is optional

Type

Default

quarkus.certificate.issuer-ref.name

The name of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_ISSUER_REF_NAME

string

required

quarkus.certificate.issuer-ref.kind

The kind of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_ISSUER_REF_KIND

string

quarkus.certificate.issuer-ref.group

The group of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_ISSUER_REF_GROUP

string

The CA issuer configuration This configuration section is optional

Type

Default

quarkus.certificate.ca.secret-name

The name of the secret used to sign Certificates issued by this Issuer.

Environment variable: QUARKUS_CERTIFICATE_CA_SECRET_NAME

string

required

quarkus.certificate.ca.crl-distribution-points

The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked.

Environment variable: QUARKUS_CERTIFICATE_CA_CRL_DISTRIBUTION_POINTS

list of string

The Vault issuer configuration This configuration section is optional

Type

Default

quarkus.certificate.vault.server

The connection address for the Vault server, e.g: “https://vault.example.com:8200”.

Environment variable: QUARKUS_CERTIFICATE_VAULT_SERVER

string

required

quarkus.certificate.vault.path

The mount path of the Vault PKI backend’s sign endpoint, e.g: “my_pki_mount/sign/my-role-name”.

Environment variable: QUARKUS_CERTIFICATE_VAULT_PATH

string

required

quarkus.certificate.vault.namespace

Environment variable: QUARKUS_CERTIFICATE_VAULT_NAMESPACE

string

quarkus.certificate.vault.ca-bundle

The PEM-encoded CA bundle (base64-encoded) used to validate Vault server certificate.

Environment variable: QUARKUS_CERTIFICATE_VAULT_CA_BUNDLE

string

required

The reference where to retrieve the Vault token This configuration section is optional

Type

Default

quarkus.certificate.vault.auth-token-secret-ref.name

The name of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_TOKEN_SECRET_REF_NAME

string

required

quarkus.certificate.vault.auth-token-secret-ref.key

The key of the entry in the Secret resource’s data field to be used.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_TOKEN_SECRET_REF_KEY

string

required

The Vault authentication using App Role auth mechanism This configuration section is optional

Type

Default

quarkus.certificate.vault.auth-app-role.path

The App Role authentication backend is mounted in Vault, e.g: “approle”

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_APP_ROLE_PATH

string

required

quarkus.certificate.vault.auth-app-role.role-id

The App Role authentication backend when setting up the authentication backend in Vault.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_APP_ROLE_ROLE_ID

string

required

The reference to a key in a Secret that contains the App Role secret used to authenticate with Vault This configuration section is optional

Type

Default

quarkus.certificate.vault.auth-app-role.secret-ref.name

The name of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_APP_ROLE_SECRET_REF_NAME

string

required

quarkus.certificate.vault.auth-app-role.secret-ref.key

The key of the entry in the Secret resource’s data field to be used.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_APP_ROLE_SECRET_REF_KEY

string

required

The Vault authentication using Kubernetes service account This configuration section is optional

Type

Default

quarkus.certificate.vault.auth-kubernetes.mount-path

The mount path to use when authenticating with Vault.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_KUBERNETES_MOUNT_PATH

string

required

quarkus.certificate.vault.auth-kubernetes.role

The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_KUBERNETES_ROLE

string

required

The reference to a key in a Secret that contains the App Role secret used to authenticate with Vault This configuration section is optional

Type

Default

quarkus.certificate.vault.auth-kubernetes.secret-ref.name

The name of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_KUBERNETES_SECRET_REF_NAME

string

required

quarkus.certificate.vault.auth-kubernetes.secret-ref.key

The key of the entry in the Secret resource’s data field to be used.

Environment variable: QUARKUS_CERTIFICATE_VAULT_AUTH_KUBERNETES_SECRET_REF_KEY

string

required

The self-signed issuer configuration This configuration section is optional

Type

Default

quarkus.certificate.self-signed.enabled

If the self-signed issuer should be generated.

Environment variable: QUARKUS_CERTIFICATE_SELF_SIGNED_ENABLED

boolean

false

quarkus.certificate.self-signed.crl-distribution-points

The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked.

Environment variable: QUARKUS_CERTIFICATE_SELF_SIGNED_CRL_DISTRIBUTION_POINTS

list of string

Full X509 name specification (https://golang This configuration section is optional

Type

Default

quarkus.certificate.subject.organizations

The organizations to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_ORGANIZATIONS

list of string

quarkus.certificate.subject.countries

The countries to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_COUNTRIES

list of string

quarkus.certificate.subject.organizational-units

The organizational Units to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_ORGANIZATIONAL_UNITS

list of string

quarkus.certificate.subject.localities

The cities to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_LOCALITIES

list of string

quarkus.certificate.subject.provinces

The State/Provinces to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_PROVINCES

list of string

quarkus.certificate.subject.street-addresses

The street addresses to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_STREET_ADDRESSES

list of string

quarkus.certificate.subject.postal-codes

The postal codes to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_POSTAL_CODES

list of string

quarkus.certificate.subject.serial-number

The serial number to be used on the Certificate.

Environment variable: QUARKUS_CERTIFICATE_SUBJECT_SERIAL_NUMBER

string

The Keystores generation configuration This configuration section is optional

Type

Default

JKS configures options for storing a JKS keystore in the spec This configuration section is optional

Type

Default

quarkus.certificate.keystores.jks.create

Create enables keystore creation for the Certificate.

Environment variable: QUARKUS_CERTIFICATE_KEYSTORES_JKS_CREATE

boolean

false

quarkus.certificate.keystores.jks.password-secret-ref.name

The name of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_KEYSTORES_JKS_PASSWORD_SECRET_REF_NAME

string

required

quarkus.certificate.keystores.jks.password-secret-ref.key

The key of the entry in the Secret resource’s data field to be used.

Environment variable: QUARKUS_CERTIFICATE_KEYSTORES_JKS_PASSWORD_SECRET_REF_KEY

string

required

PKCS12 configures options for storing a PKCS12 keystore in the spec This configuration section is optional

Type

Default

quarkus.certificate.keystores.pkcs12.create

Create enables keystore creation for the Certificate.

Environment variable: QUARKUS_CERTIFICATE_KEYSTORES_PKCS12_CREATE

boolean

false

quarkus.certificate.keystores.pkcs12.password-secret-ref.name

The name of the resource being referred to.

Environment variable: QUARKUS_CERTIFICATE_KEYSTORES_PKCS12_PASSWORD_SECRET_REF_NAME

string

required

quarkus.certificate.keystores.pkcs12.password-secret-ref.key

The key of the entry in the Secret resource’s data field to be used.

Environment variable: QUARKUS_CERTIFICATE_KEYSTORES_PKCS12_PASSWORD_SECRET_REF_KEY

string

required

#quarkus-certificate_quarkus.certificate.private-key This configuration section is optional

Type

Default

quarkus.certificate.private-key.rotation-policy

RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed.

Environment variable: QUARKUS_CERTIFICATE_PRIVATE_KEY_ROTATION_POLICY

unset, never, always

unset

quarkus.certificate.private-key.encoding

Environment variable: QUARKUS_CERTIFICATE_PRIVATE_KEY_ENCODING

unset, pkcs1, pkcs8

unset

quarkus.certificate.private-key.algorithm

Environment variable: QUARKUS_CERTIFICATE_PRIVATE_KEY_ALGORITHM

unset, rsa, ed25519, ecdsa

unset

quarkus.certificate.private-key.size

Environment variable: QUARKUS_CERTIFICATE_PRIVATE_KEY_SIZE

int

-1