cert-manager webhook

Validating and mutating admission webhook for cert-manager. Apache-2.0. linux/amd64.

Pin this image by digest.

published Latest tag v1.21.2-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/cert-manager-webhook@sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277

Pull:

podman pull oci.thepeoples.io/hardened/cert-manager-webhook@sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/cert-manager-webhook@sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277

Published 2026-10-11T05:12:35Z38.7 MiB compressed

Usage

TLS certificates come from the in-cluster ClusterIssuer private-ca, bootstrapped by a namespaced SelfSigned Issuer. This batch does not use Let's Encrypt or any external ACME endpoint. Metrics are on in the values below; comments mark the production settings.

Example, not validated on this page until a matching published digest is recorded.

Image pin overlay:

webhook:
  image:
    name: cert-manager-webhook
    tag: "v1.21.2-tpio.1"
    digest: "sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277"

Production Helm values (metrics on, private CA only where TLS applies):

# Production-oriented Helm values for oci://quay.io/jetstack/charts/cert-manager v1.21.2.
# Image pins come from catalog/image-meta.json chart_values and the generated
# values-images overlay (imageRegistry/imageNamespace plus per-component digest).
# Issuers: SelfSigned bootstrap → ClusterIssuer private-ca
# (validate/manifests/private-ca.yaml). No external ACME.
# Turn Prometheus annotations off with prometheus.enabled: false.
# https://cert-manager.io/docs/installation/helm/
# https://cert-manager.io/docs/devops-tips/prometheus-metrics/
# https://cert-manager.io/docs/configuration/selfsigned/
# https://cert-manager.io/docs/configuration/ca/
# https://artifacthub.io/packages/helm/cert-manager/cert-manager/1.21.2

crds:
  enabled: true
  keep: true # keep CRDs on helm uninstall so Certificates are not GC'd by accident

# Controller replicas >1 need leader election (chart default in kube-system).
# https://cert-manager.io/docs/installation/best-practice/
replicaCount: 2
podDisruptionBudget:
  enabled: true
  minAvailable: 1

# Prometheus scrape annotations on the controller and webhook (chart default true).
# ServiceMonitor stays off unless Prometheus Operator CRDs are installed.
prometheus:
  enabled: true # set false to skip prometheus.io annotations
  servicemonitor:
    enabled: false
  podmonitor:
    enabled: false

# Default security context from the chart; keep it explicit.
# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext:
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
  readOnlyRootFilesystem: true

resources:
  requests: {cpu: 50m, memory: 64Mi}
  limits: {cpu: 250m, memory: 256Mi}

webhook:
  replicaCount: 2
  timeoutSeconds: 30
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop: [ALL]
    readOnlyRootFilesystem: true
  resources:
    requests: {cpu: 50m, memory: 64Mi}
    limits: {cpu: 250m, memory: 128Mi}

cainjector:
  replicaCount: 2
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop: [ALL]
    readOnlyRootFilesystem: true
  resources:
    requests: {cpu: 50m, memory: 64Mi}
    limits: {cpu: 250m, memory: 128Mi}

# Chart ships acmesolver for HTTP-01 Challenges. This estate does not create
# ACME Issuers; the solver image is still pinned so the chart can render.
startupapicheck:
  enabled: true

config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  kind: ControllerConfiguration
  logging:
    verbosity: 2
    format: text # chart example; json is also valid for ControllerConfiguration

In-cluster issuer (SelfSigned bootstrap → ClusterIssuer private-ca):

# In-cluster private CA used by Traefik and Envoy TLS, and by the cert-manager
# Certificate check. A namespaced SelfSigned Issuer bootstraps CA certificate
# private-ca; ClusterIssuer private-ca then signs leaf certificates in any
# namespace (clusterResourceNamespace = cert-manager release namespace).
# No external ACME. Validation evidence must name issuerRef.name: private-ca.
# https://cert-manager.io/docs/configuration/selfsigned/
# https://cert-manager.io/docs/configuration/ca/
# https://cert-manager.io/docs/usage/certificate/
apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned-bootstrap
  namespace: cert-manager
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: private-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: hardened-oci-private-ca
  secretName: private-ca
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-bootstrap
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: private-ca
spec:
  ca:
    secretName: private-ca
---
# Demo leaf for Traefik tlsStore.default.defaultCertificate and Envoy Gateway
# TLS. Issue a copy in the ingress namespace (or reference this Secret) so
# Traefik/Envoy can mount it. issuerRef.name is private-ca.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ingress-tls
  namespace: cert-manager
spec:
  secretName: ingress-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: whoami.hardened.example
  dnsNames:
    - whoami.hardened.example
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: private-ca
    kind: ClusterIssuer
    group: cert-manager.io

helm repo add jetstack https://charts.jetstack.io
helm upgrade --install cert-manager jetstack/cert-manager --version v1.21.2 \
  --namespace cert-manager --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/cert-manager-webhook@sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/cert-manager-webhook@sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the Admission webhook. Used by cert-manager (admission). Depends on cert-manager cainjector (dependency).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/cert-manager-webhook@sha256:5fcfc4c5665e62fc11ac8adaf1ab012e6e677e3fc662eabeae98327b53d4c277

Rebuild and licence

Same upstream digest (ladder c); distroless/static-debian13 has no apk/apt. Go-binary findings wait for ladder (b).

Licence: Apache-2.0.

cert-manager is Apache-2.0. The distroless/static-debian13 base keeps its own licenses.

Upstream source