apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: prometheus.io/path: /metrics prometheus.io/port: "9402" prometheus.io/scrape: "true" creationTimestamp: "2026-06-09T13:53:28Z" generateName: cert-manager-c69c859c4- labels: app: cert-manager app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cert-manager app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: c69c859c4 name: cert-manager-c69c859c4-57gdp namespace: cert-manager ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: cert-manager-c69c859c4 uid: 51ecc7b9-9a16-45f3-9503-9e30e8b3199f resourceVersion: "590" uid: 22e1357d-0aa9-4f63-9526-aa5940d4d614 spec: containers: - args: - --v=2 - --cluster-resource-namespace=$(POD_NAMESPACE) - --leader-election-namespace=kube-system - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.14.0 - --max-concurrent-challenges=60 env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-controller:v1.14.0 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 8 httpGet: path: /livez port: http-healthz scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 15 name: cert-manager-controller ports: - containerPort: 9402 name: http-metrics protocol: TCP - containerPort: 9403 name: http-healthz protocol: TCP resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-rf6j7 readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: false nodeName: chart-test-swarm-run-65-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager serviceAccountName: cert-manager terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: kube-api-access-rf6j7 projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:33Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:28Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:33Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:33Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:28Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://e28d7a5276acc1ec7d7a862683aaa5080d93679f4e39a81162f3d5a802cfcd7d image: quay.io/jetstack/cert-manager-controller:v1.14.0 imageID: quay.io/jetstack/cert-manager-controller@sha256:341c15d96d08a6a5bcaeb035b5054c34c00c7ad38eda5c235594d11dc7767b10 lastState: {} name: cert-manager-controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:53:33Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.5 podIPs: - ip: 10.244.0.5 qosClass: BestEffort startTime: "2026-06-09T13:53:28Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T13:53:28Z" generateName: cert-manager-cainjector-d6d64f75f- labels: app: cainjector app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cainjector app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: d6d64f75f name: cert-manager-cainjector-d6d64f75f-t2qrw namespace: cert-manager ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: cert-manager-cainjector-d6d64f75f uid: 2e0f1b6e-7ed9-4925-9170-c7b98872d645 resourceVersion: "579" uid: eec220dd-cab5-4099-a358-199cbaaec2ac spec: containers: - args: - --v=2 - --leader-election-namespace=kube-system env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-cainjector:v1.14.0 imagePullPolicy: IfNotPresent name: cert-manager-cainjector resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-p557p readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: false nodeName: chart-test-swarm-run-65-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager-cainjector serviceAccountName: cert-manager-cainjector terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: kube-api-access-p557p projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:32Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:28Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:32Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:32Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:28Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://a2d6be7ff61934c41d45f5e76c68124262fb32bcd0dba765ed59dbaf0e756fe2 image: quay.io/jetstack/cert-manager-cainjector:v1.14.0 imageID: quay.io/jetstack/cert-manager-cainjector@sha256:b897b367f16313ebbd75f218a1df88b9326b9129688bfc9114d57848d8d5082b lastState: {} name: cert-manager-cainjector ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:53:32Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: BestEffort startTime: "2026-06-09T13:53:28Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T13:53:28Z" generateName: cert-manager-webhook-566849c7fc- labels: app: webhook app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: webhook app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: 566849c7fc name: cert-manager-webhook-566849c7fc-lz4g2 namespace: cert-manager ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: cert-manager-webhook-566849c7fc uid: 04a0cd70-4421-451c-993c-b20ba0fa8229 resourceVersion: "599" uid: 1b540217-b13a-410b-a604-3c1e6c9c3297 spec: containers: - args: - --v=2 - --secure-port=10250 - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca - --dynamic-serving-dns-names=cert-manager-webhook - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-webhook:v1.14.0 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /livez port: 6080 scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: cert-manager-webhook ports: - containerPort: 10250 name: https protocol: TCP - containerPort: 6080 name: healthcheck protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6080 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-65hv4 readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: false nodeName: chart-test-swarm-run-65-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager-webhook serviceAccountName: cert-manager-webhook terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: kube-api-access-65hv4 projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:31Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:28Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:38Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:38Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:53:28Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://9fa569ca86a690f55615e3f80c2e224e61900dbcf8721d944da017ad6e7eb596 image: quay.io/jetstack/cert-manager-webhook:v1.14.0 imageID: quay.io/jetstack/cert-manager-webhook@sha256:d09da2b626132bb17eb62f2f9d7e921198c6bc001b40f0aa3ba079968db471ed lastState: {} name: cert-manager-webhook ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:53:31Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.7 podIPs: - ip: 10.244.0.7 qosClass: BestEffort startTime: "2026-06-09T13:53:28Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" labels: app: cert-manager app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cert-manager app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 name: cert-manager namespace: cert-manager resourceVersion: "502" uid: 9620ace0-8258-4ebf-a0cc-f8dfcb5c3346 spec: clusterIP: 10.96.99.77 clusterIPs: - 10.96.99.77 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: tcp-prometheus-servicemonitor port: 9402 protocol: TCP targetPort: 9402 selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" labels: app: webhook app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: webhook app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 name: cert-manager-webhook namespace: cert-manager resourceVersion: "504" uid: f14812c3-cd96-45e1-96c7-01c98f5af946 spec: clusterIP: 10.96.155.83 clusterIPs: - 10.96.155.83 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: https port: 443 protocol: TCP targetPort: https selector: app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: webhook sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" generation: 1 labels: app: cert-manager app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cert-manager app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 name: cert-manager namespace: cert-manager resourceVersion: "594" uid: 79416c65-bf89-42e1-bf7f-e55c1625c0f1 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: prometheus.io/path: /metrics prometheus.io/port: "9402" prometheus.io/scrape: "true" creationTimestamp: null labels: app: cert-manager app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cert-manager app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 spec: containers: - args: - --v=2 - --cluster-resource-namespace=$(POD_NAMESPACE) - --leader-election-namespace=kube-system - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.14.0 - --max-concurrent-challenges=60 env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-controller:v1.14.0 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 8 httpGet: path: /livez port: http-healthz scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 15 name: cert-manager-controller ports: - containerPort: 9402 name: http-metrics protocol: TCP - containerPort: 9403 name: http-healthz protocol: TCP resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: false nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager serviceAccountName: cert-manager terminationGracePeriodSeconds: 30 status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:53:33Z" lastUpdateTime: "2026-06-09T13:53:33Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:53:28Z" lastUpdateTime: "2026-06-09T13:53:33Z" message: ReplicaSet "cert-manager-c69c859c4" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" generation: 1 labels: app: cainjector app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cainjector app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 name: cert-manager-cainjector namespace: cert-manager resourceVersion: "581" uid: bb6db5a7-dd6d-4270-97eb-ccfe56714a24 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cainjector strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: app: cainjector app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cainjector app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 spec: containers: - args: - --v=2 - --leader-election-namespace=kube-system env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-cainjector:v1.14.0 imagePullPolicy: IfNotPresent name: cert-manager-cainjector resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: false nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager-cainjector serviceAccountName: cert-manager-cainjector terminationGracePeriodSeconds: 30 status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:53:32Z" lastUpdateTime: "2026-06-09T13:53:32Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:53:28Z" lastUpdateTime: "2026-06-09T13:53:32Z" message: ReplicaSet "cert-manager-cainjector-d6d64f75f" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" generation: 1 labels: app: webhook app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: webhook app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 name: cert-manager-webhook namespace: cert-manager resourceVersion: "603" uid: f20be124-4147-4ea3-afde-616cb9c73975 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: webhook strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: app: webhook app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: webhook app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 spec: containers: - args: - --v=2 - --secure-port=10250 - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca - --dynamic-serving-dns-names=cert-manager-webhook - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-webhook:v1.14.0 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /livez port: 6080 scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: cert-manager-webhook ports: - containerPort: 10250 name: https protocol: TCP - containerPort: 6080 name: healthcheck protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6080 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: false nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager-webhook serviceAccountName: cert-manager-webhook terminationGracePeriodSeconds: 30 status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:53:38Z" lastUpdateTime: "2026-06-09T13:53:38Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:53:28Z" lastUpdateTime: "2026-06-09T13:53:38Z" message: ReplicaSet "cert-manager-webhook-566849c7fc" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" generation: 1 labels: app: cert-manager app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cert-manager app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: c69c859c4 name: cert-manager-c69c859c4 namespace: cert-manager ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: cert-manager uid: 79416c65-bf89-42e1-bf7f-e55c1625c0f1 resourceVersion: "593" uid: 51ecc7b9-9a16-45f3-9503-9e30e8b3199f spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager pod-template-hash: c69c859c4 template: metadata: annotations: prometheus.io/path: /metrics prometheus.io/port: "9402" prometheus.io/scrape: "true" creationTimestamp: null labels: app: cert-manager app.kubernetes.io/component: controller app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cert-manager app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: c69c859c4 spec: containers: - args: - --v=2 - --cluster-resource-namespace=$(POD_NAMESPACE) - --leader-election-namespace=kube-system - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.14.0 - --max-concurrent-challenges=60 env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-controller:v1.14.0 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 8 httpGet: path: /livez port: http-healthz scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 15 name: cert-manager-controller ports: - containerPort: 9402 name: http-metrics protocol: TCP - containerPort: 9403 name: http-healthz protocol: TCP resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: false nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager serviceAccountName: cert-manager terminationGracePeriodSeconds: 30 status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" generation: 1 labels: app: cainjector app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cainjector app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: d6d64f75f name: cert-manager-cainjector-d6d64f75f namespace: cert-manager ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: cert-manager-cainjector uid: bb6db5a7-dd6d-4270-97eb-ccfe56714a24 resourceVersion: "580" uid: 2e0f1b6e-7ed9-4925-9170-c7b98872d645 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cainjector pod-template-hash: d6d64f75f template: metadata: creationTimestamp: null labels: app: cainjector app.kubernetes.io/component: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: cainjector app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: d6d64f75f spec: containers: - args: - --v=2 - --leader-election-namespace=kube-system env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-cainjector:v1.14.0 imagePullPolicy: IfNotPresent name: cert-manager-cainjector resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: false nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager-cainjector serviceAccountName: cert-manager-cainjector terminationGracePeriodSeconds: 30 status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: cert-manager meta.helm.sh/release-namespace: cert-manager creationTimestamp: "2026-06-09T13:53:28Z" generation: 1 labels: app: webhook app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: webhook app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: 566849c7fc name: cert-manager-webhook-566849c7fc namespace: cert-manager ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: cert-manager-webhook uid: f20be124-4147-4ea3-afde-616cb9c73975 resourceVersion: "602" uid: 04a0cd70-4421-451c-993c-b20ba0fa8229 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: webhook pod-template-hash: 566849c7fc template: metadata: creationTimestamp: null labels: app: webhook app.kubernetes.io/component: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: webhook app.kubernetes.io/version: v1.14.0 helm.sh/chart: cert-manager-v1.14.0 pod-template-hash: 566849c7fc spec: containers: - args: - --v=2 - --secure-port=10250 - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca - --dynamic-serving-dns-names=cert-manager-webhook - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: quay.io/jetstack/cert-manager-webhook:v1.14.0 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /livez port: 6080 scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: cert-manager-webhook ports: - containerPort: 10250 name: https protocol: TCP - containerPort: 6080 name: healthcheck protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 6080 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: false nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault serviceAccount: cert-manager-webhook serviceAccountName: cert-manager-webhook terminationGracePeriodSeconds: 30 status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 kind: List metadata: resourceVersion: ""