cview-issuer-chart
cview-issuer for cert-manager by Securely LTD
The C-View issuer is known cert-manager issuer Issuers.
It operates through the C-VIEW certificate management platform to process certificate requests within
the organization’s ADCS and supports public certificate authorities like GlobalSign and DigiCert.
1. Prerequisites
2. Cert-manager installation using helm chart
3. C-View issuer installation helm cart
4. C-View issuer installation platform
5. C-View issuer configuration
1. Prerequisites
The following components are required before installing the C-View Issuer
- Kubernetes cluster with version >=1.32.x
- Cert manager with version >=1.19.x (For list of supported versions: Supported versions)
- Jaeger opentracing (optional)
- C-View CLM >= 7.3.x (For more information, contact Securely LTD)
2. Cert-manager installation using helm chart
This is the preferred way to install cert-manager via helm-chart
Add jetstack to helm chart repository support
helm repo add jetstack https://charts.jetstack.io --force-update
Install cert-manager (vanila)
helm upgrade --install \
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.18.3 \
--set crds.enabled=true \
--set enableCertificateOwnerRef=true
Adding support for Gateway API in kubernetes
kubectl apply -f "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml"
Install cert-manager with GatewayAPI Enabled (optional)
helm upgrade --install \
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.18.3 \
--set config.enableGatewayAPI=true \
--set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
--set config.kind="ControllerConfiguration" \
--set crds.enabled=true \
--set enableCertificateOwnerRef=true
Check cert-manager installation
kubectl get pod -n cert-manager
NAME READY STATUS RESTARTS AGE cert-manager-cainjector-598d9958f6-fss8l 1/1 Running 0 1m cert-manager-webhook-7c8c5df7fc-xdjl5 1/1 Running 0 1m cert-manager-54f9895b8c-w2s2x 1/1 Running 0 1m
Adding support for Openshift routes by cert-manager
Using route objects on open shift requires installing the additional package to extend cert-manager behavior.
helm install openshift-routes -n cert-manager oci://ghcr.io/cert-manager/charts/openshift-routes
3. CView Issuer installation helm cart
Add cview-issuer helm chart repository
helm repo add secure-ly https://secure-ly.github.io/cview-issuer-chart/ --force-update
Update to the latest version
helm repo update secure-ly
NAME CHART VERSION APP VERSION DESCRIPTION secure-ly/cview-issuer 0.0.42 0.0.42 C-View issuer plugin for cert-manager
Get a list of all issuer version
helm search repo cview-issuer
NAME CHART VERSION APP VERSION DESCRIPTION secure-ly/cview-issuer 0.0.42 0.0.42 C-View issuer plugin for cert-manager
helm search repo cview-issuer --versions
NAME CHART VERSION APP VERSION DESCRIPTION secure-ly/cview-issuer 0.0.39 0.0.39 C-View issuer plugin for cert-manager secure-ly/cview-issuer 0.0.40 0.0.40 C-View issuer plugin for cert-manager secure-ly/cview-issuer 0.0.42 0.0.42 C-View issuer plugin for cert-manager
4. Target platform Installation commands
Install on Kubernetes
helm upgrade --install \
cview-issuer secure-ly/cview-issuer \
--namespace cview-issuer \
--create-namespace \
--version 0.0.42 \
--set controllerManager.manager.image.tag=0.0.42 \
--set crd.install=true
Install on Openshift
helm upgrade --install \
cview-issuer secure-ly/cview-issuer \
--namespace cview-issuer \
--create-namespace \
--version 0.0.42 \
--set controllerManager.manager.image.tag=0.0.42 \
--set crd.install=true \
--set openshift.enabled=true \
--set openshift.anyuid=true
Customize Installation on Openshift
helm upgrade --install \
cview-issuer secure-ly/cview-issuer \
--namespace cview-issuer \
--create-namespace \
--version 0.0.42 \
--set controllerManager.manager.image.repository=devsecurely/cview-issuer \
--set controllerManager.manager.image.tag=0.0.42 \
--set controllerManager.arguments.cluster-resource-namespace=cview-issuer \
--set openshift.enabled=true \
--set openshift.anyuid=false \
--set crd.install=true
NOTE:
- Set controllerManager.arguments.enable-tracing=”true” to enable jaeger tracing
- Setting openshift.anyuid parameter to false will create a security context constraint. See example (security-context-constraint)
Display helm chart status
helm list -n cview-issuer
NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION cview-issuer cview-issuer 1 2025-12-05 10:31:20.172857068 +0200 CEST deployed cview-issuer-0.0.42 0.0.42
⚙️ 5. C-View Issuer Configuration
🔐 5.1 Required secret objects
5.1.1 C-View Issuer activation key
The C-View Issuer requires a valid license key obtained from the C-View platform before it can process certificate requests
Contact your C-View CLM administrator to obtain a license key. Before deploying it to the cluster,
the license key must be Base64-encoded and stored in the appropriate Kubernetes secret
- Update the key parameter in the following YAML file: (cview-issuer-license-key)
5.1.2 Issuer Credential
This credential is used to identify cview-issuer requests toword the CLM platform.
**Starting with C-View platform version 7.3.0 it’s required to set the authMethod to ‘token’ **.
- Credintial YAML file example: (cview-issuer-credentials)
- Deploy the YAML file to Kubernetes/Openshift
🏢 5.2 C-View Issuer objects
The C-View Issuer configuration defines all parameters required to integrate and operate with the C-View platform. it supports two issuer types, and multiple issuer configurations can be created to address different business or operational requirements. Each issuer configuration is managed independently, allowing you to tailor settings based on the specific use case.
5.2.1 C-View Cluster Issuer
Working in a global scope requires a c-view cluster issuer object. Sample YAML file: (cview-cluster-issuer)
5.2.2 Dedicated C-View Issuer
Working in a dedicated namespace requires a c-view issuer object. Sample YAML file: (cview-issuer)
🏢 5.3 Supported certificates objects
5.3.1 Standard certificate/secret
Use this YAML example to create a certificate object: (Cert-example)
5.3.1.1 Standard certificate/secret as JKS or PKCS12 (.p12)
Use this YAML to create the secrte for the JKS/PKCS12 (.p12) : (cert-store-secret)
Use this YAML example to create a certificate object as JKS or PKCS12 (.p12) : (cert-store-example)
5.3.2 Openshift Route Secret
Use this YAML example to create a certificate for an open shift route: (OpenShift-rout-example)
Unused annotations should be excluded or commented from the yaml file
5.3.3 Ingress Secret
Use this YAML example to create a certificate for ingress: (Ingress-example)
Unused annotations should be excluded or commented from the yaml file
5.3.4 GetWay API Secret
Use this YAML example to create a certificate for cert manager get way API : (getway-api-example)
Unused annotations should be excluded or commented from the yaml file
🏢 5.4 C-View issuer ConfigMap
The default ConfigMAp name is cview-issuer-configmap-override. It is created automatically, and all values are hard-coded for flexible control over issuer actions you may deploy the following config map YAML file: (ConfigMap)