Skip to content

CMPClusterIssuer

CMPClusterIssuer is a cluster-scoped cert-manager issuer. Credential and trust Secrets are read from the controller cluster resource namespace, not from the workload namespace.

API

Field Value
API group certmanager.misiektoja.github.io
Version v1alpha1
Kind CMPClusterIssuer
Scope Cluster
cert-manager issuer type cmpclusterissuers.certmanager.misiektoja.github.io

Cluster resource namespace

The controller flag --cluster-resource-namespace selects where credential Secrets live.

The Helm chart sets it to the release namespace, which is the namespace the chart binds the credential reader in, so a release installed anywhere reads its CMPClusterIssuer Secrets from its own namespace with no extra configuration. Set manager.clusterResourceNamespace to read them from somewhere else, and the chart adds a credential reader RoleBinding there as well. That case needs rbac.namespaced to be false, since a Role cannot be bound outside its own namespace.

CMPClusterIssuer reconciliation is disabled when rbac.namespaced=true. That mode watches only CMPIssuer resources in the Helm release namespace.

The installer manifest installs into cmp-issuer-system and relies on the compiled-in default of the same name. Change both together if you retarget the manifest.

Store PBM credentials, signature bootstrap material and CMP trust anchors in that namespace. Reference them by name only in the issuer spec.

Example

apiVersion: certmanager.misiektoja.github.io/v1alpha1
kind: CMPClusterIssuer
metadata:
  name: example
spec:
  endpoint:
    url: http://cmp.example.net/pkix/
    timeout: 30s
    maxResponseSize: 1048576
  protocol:
    version: 2
    initialEnrollment: P10CR
    recipient: CN=Example CA,O=Example
    confirmation: Explicit
  protection:
    type: Signature
    signature:
      secretRef:
        name: cmp-signature-credentials
      certificateKey: tls.crt
      privateKeyKey: tls.key
      chainKey: ca.crt
  cmpTrust:
    caSecretRef:
      name: cmp-trust
      key: ca.crt

Spec and status

The spec and status schemas are identical to CMPIssuer. Only scope and Secret resolution differ.

When to use which issuer

Issuer Credential location Typical use
CMPIssuer Same namespace as the issuer Tenant or application isolation
CMPClusterIssuer Cluster resource namespace Shared CMP endpoint and credentials

RBAC

The base install grants Secret read access in cmp-issuer-system through a RoleBinding to the cmp-issuer-credential-reader ClusterRole. No per-namespace RoleBinding is required for cluster issuers.