Commit ae67234

"Minimum duration to back off when a certificate request fails (default 1h). "+

"The backoff delay starts at this value and is exponentially increased "+

"with each consecutive failure, up to the configured maximum backoff duration.")

fs.DurationVar(&c.CertificateRequestMaximumBackoffDuration, "certificate-request-maximum-backoff-duration", c.CertificateRequestMaximumBackoffDuration, ""+

"Maximum duration to back off when a certificate request fails. "+

"The backoff delay starts at the minimum backoff duration and is exponentially increased "+

"with each consecutive failure, but will never exceed this maximum (default 32h).")

"description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n apiVersion: controller.config.cert-manager.io/v1alpha1\n kind: ControllerConfiguration\n logging:\n verbosity: 2\n format: text\n leaderElectionConfig:\n namespace: kube-system\n kubernetesAPIQPS: 9000\n kubernetesAPIBurst: 9000\n numberOfConcurrentWorkers: 200\n gatewayAPI:\n enable: true\n # Feature gates as of v1.20.0. Listed with their default values.\n # See https://cert-manager.io/docs/cli/controller/\n featureGates:\n AllAlpha: false # ALPHA - default=false\n AllBeta: false # BETA - default=false\n ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n ExperimentalGatewayAPISupport: true # BETA - default=true\n LiteralCertificateSubject: true # BETA - default=true\n NameConstraints: true # BETA - default=true\n OtherNames: true # BETA - default=true\n SecretsFilteredCaching: true # BETA - default=true\n ServerSideApply: false # ALPHA - default=false\n StableCertificateRequestName: true # BETA - default=true\n UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n # Configure the metrics server for TLS\n # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n metricsTLSConfig:\n dynamic:\n secretNamespace: \"cert-manager\"\n secretName: \"cert-manager-metrics-ca\"\n dnsNames:\n - cert-manager-metrics\n # Configure PEM size limits for certificate validation\n # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)\n pemSizeLimitsConfig:\n maxCertificateSize: 36500 # Maximum size in bytes for individual certificates (default: 36500)\n maxPrivateKeySize: 13000 # Maximum size in bytes for private keys (default: 13000)\n maxChainLength: 95000 # Maximum size in bytes for certificate chains (default: 95000)\n maxBundleSize: 330000 # Maximum size in bytes for certificate bundles (default: 330000)\n # Configure certificate request backoff durations\n certificateRequestMinimumBackoffDuration: 1h\n certificateRequestMaximumBackoffDuration: 32h",

// CertificateRequestMinimumBackoffDuration configures the minimum backoff duration

// when a certificate request fails (default 1h). The backoff delay starts at

// this value and is exponentially increased with each consecutive failure,

// up to the configured maximum backoff duration.

// CertificateRequestMaximumBackoffDuration configures the maximum backoff duration

// when a certificate request fails. The backoff delay starts at

// the minimum backoff duration and is exponentially increased with

// each consecutive failure, but will never exceed this maximum (default 32h).

CertificateRequestMaximumBackoffDuration time.Duration

defaultCertificateRequestMaximumBackoffDuration = 32 * time.Hour

if obj.CertificateRequestMaximumBackoffDuration.IsZero() {

obj.CertificateRequestMaximumBackoffDuration = sharedv1alpha1.DurationFromTime(defaultCertificateRequestMaximumBackoffDuration)

}

"certificateRequestMinimumBackoffDuration": "1h0m0s",

"certificateRequestMaximumBackoffDuration": "32h0m0s"

"time"

allErrors = append(allErrors, validateCertificateRequestBackoffConfig(&cfg.CertificateRequestMinimumBackoffDuration, &cfg.CertificateRequestMaximumBackoffDuration, fldPath)...)

func validateCertificateRequestBackoffConfig(minBackoff, maxBackoff *time.Duration, fldPath *field.Path) field.ErrorList {

var allErrors field.ErrorList

// Validate minimum backoff. Negative values are rejected; zero is

// handled by SetDefaults_ControllerConfiguration before validation runs.

if *minBackoff < 0 {

allErrors = append(allErrors, field.Invalid(

fldPath.Child("certificateRequestMinimumBackoffDuration"),

minBackoff.String(),

"must not be negative",

))

}

// Validate maximum backoff. Negative values are rejected; zero is

// handled by SetDefaults_ControllerConfiguration before validation runs.

if *maxBackoff < 0 {

allErrors = append(allErrors, field.Invalid(

fldPath.Child("certificateRequestMaximumBackoffDuration"),

maxBackoff.String(),

"must not be negative",

))

}

// Validate max >= min (only if both are individually valid)

if *minBackoff > 0 && *maxBackoff > 0 && *maxBackoff < *minBackoff {

allErrors = append(allErrors, field.Invalid(

fldPath.Child("certificateRequestMaximumBackoffDuration"),

maxBackoff.String(),

"must be greater than or equal to certificateRequestMinimumBackoffDuration",

))

}

return allErrors

}