cert-manager
Hard
Security
What has to happen to a CertificateRequest before an issuer will sign it?
Select your answer:
Show answer and explanation
Answer: It must get an Approved condition, which the built-in approver adds by default
Explanation
Issuers only sign CertificateRequests that carry an Approved condition and no Denied condition. By default the cert-manager controller approves every request for its built-in issuers. To control what can be requested, you turn off the built-in approver and run approver-policy, which approves or denies requests against CertificateRequestPolicy resources.
More hard cert-manager questions
- Which annotation tells cainjector to fill a webhook configuration's caBundle from a cert-manager Certificate?
- cert-manager can't be given API access to the DNS zone for example.com. How can you still use DNS-01 for it?
- Which of the following is a valid way to revoke a certificate in cert-manager?
- Which of the following is a valid way to configure a Vault issuer?
- What is the purpose of the 'keystores' field in a Certificate resource?
- What is the purpose of the 'encodeUsagesInRequest' field in a Certificate resource?