x509-certificate-exporter/dev/values.yaml

# Helm values shared by the Tilt dev loop and `task test:e2e`. These extend the
# chart's defaults to cover every fixture in dev/scenarios:
#
#   - kubernetes.io/tls (PEM in tls.crt) — default behaviour
#   - Opaque PEM with custom data keys
#   - Opaque PKCS#12 (encrypted via passphraseKey + passwordless via
#     tryEmptyPassphrase)
#   - Opaque JKS truststore (passphrase from passphraseKey)
#   - ConfigMaps holding tls.crt
#   - Per-cert error metrics, relative-time metrics
#   - exposeSecretLabels for the rich-DN scenario
#   - excludeNamespaceLabels to verify the negative case
---
secretsExporter:
  enabled: true

  secretTypes:
    # PEM in standard TLS secrets
    - type: kubernetes.io/tls
      key: tls.crt
    # PEM in Opaque secrets (custom data key)
    - type: Opaque
      key: cert.pem
    - type: Opaque
      key: tls.crt
    - type: Opaque
      key: ca.crt
    # Encrypted PKCS#12 — passphrase pulled from a sibling key in the same Secret
    - type: Opaque
      key: keystore.p12
      format: pkcs12
      pkcs12:
        passphraseKey: keystore-passphrase
    # PKCS#12 truststore (multiple CAs, no leaf)
    - type: Opaque
      key: truststore.p12
      format: pkcs12
      pkcs12:
        passphraseKey: keystore-passphrase
    # Passwordless PKCS#12 — tryEmptyPassphrase falls back to ""
    - type: Opaque
      key: keystore-empty.p12
      format: pkcs12
      pkcs12:
        tryEmptyPassphrase: true
    # Raw DER — single cert or CRL blob (the CDP-style `.crl` pattern).
    # Both branches of the DER parser are exercised via two distinct
    # data keys.
    - type: Opaque
      key: cert.der
      format: der
    - type: Opaque
      key: revocation.crl
      format: der
    # JKS truststore — passphrase pulled from a sibling key in the same Secret
    - type: Opaque
      key: truststore.jks
      format: jks
      jks:
        passphraseKey: jks-passphrase
    # JCEKS truststore (magic 0xCECECECE) — same `format: jks`, auto-detected
    - type: Opaque
      key: truststore.jceks
      format: jks
      jks:
        passphraseKey: jks-passphrase
    # JKS passwordless — tryEmptyPassphrase falls back to ""
    - type: Opaque
      key: truststore-empty.jks
      format: jks
      jks:
        tryEmptyPassphrase: true
    # PKCS#12 with passphrase in a separate same-namespace Secret
    - type: Opaque
      key: keystore-vaulted.p12
      format: pkcs12
      pkcs12:
        passphraseSecretRef:
          name: vault
          key: pkcs12-passphrase
    # JKS with passphrase in a separate same-namespace Secret
    - type: Opaque
      key: truststore-vaulted.jks
      format: jks
      jks:
        passphraseSecretRef:
          name: vault
          key: jks-passphrase

  # Watch ConfigMaps holding a tls.crt key.
  configMapKeys:
    - tls.crt

  # Skip the negatively-named namespace (proves namespace name exclusion)
  # and every `x509ce-glob-*` namespace (proves glob exclusion).
  excludeNamespaces:
    - x509ce-excl-name
    - "x509ce-glob-*"

  # Skip Secrets whose name matches this glob (proves secret name
  # glob exclusion).
  excludeSecrets:
    - "x509ce-skip-*"

  # Skip the negatively-labelled namespace (proves namespace label exclusion).
  excludeNamespaceLabels:
    - x509ce-test/ignore=true

  # Skip individual Secrets carrying the x509ce-test/ignore=true label
  # (proves secret-level label exclusion is wired server-side).
  excludeLabels:
    - x509ce-test/ignore=true

  # Surface a few labels from labelled Secrets as Prometheus labels.
  exposeSecretLabels:
    - environment
    - team

  # Surface the same labels from labelled ConfigMaps. The CM fixture in
  # dev/scenarios/scenarios.go applies these too — exercising the
  # writer (k8s source) → reader (registry) prefix contract end-to-end.
  exposeConfigMapLabels:
    - environment
    - team

# Enable the gated metric families so dev sees everything and the e2e
# suite can assert on them. `exposeNotBeforeMetric` is needed in
# particular for the `not-yet-valid` scenario, which is precisely about
# `NotBefore > now`.
exposePerCertificateErrorMetrics: true
exposeRelativeMetrics: true
exposeNotBeforeMetric: true

image:
  pullPolicy: Always