> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PKI issuer Helm chart (cert-manager)

> Deploy the Infisical PKI Issuer for cert-manager on Kubernetes using the official Helm chart.

The Infisical PKI Issuer is a [cert-manager](https://cert-manager.io/) external issuer that enables automated X.509 certificate issuance and renewal through Infisical Certificate Management. It supports both namespace-scoped (`Issuer`) and cluster-scoped (`ClusterIssuer`) resources.

For more information on Infisical Certificate Management, see the [Certificate Management documentation](https://infisical.com/docs/documentation/platform/pki).

## Installation

**1. Install cert-manager (if not already installed)**

```bash theme={"dark"}
helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true
```

**2. Install the Infisical PKI Issuer**

```bash theme={"dark"}
helm install infisical-pki-issuer \
  oci://helm.oci.cloudsmith.io/infisical/helm-charts/infisical-pki-issuer \
  --namespace infisical-pki \
  --create-namespace
```

**3. Verify the deployment**

```bash theme={"dark"}
kubectl get pods -n infisical-pki
```

## Uninstall

```bash theme={"dark"}
helm uninstall infisical-pki-issuer --namespace infisical-pki
```

## Configuration reference

| Parameter | Default | Description |
| - | - | - |
| `controllerManager.replicas` | `1` | Number of controller replicas. |
| `controllerManager.manager.image.repository` | `docker.io/infisical/pki-issuer` | Container image. |
| `controllerManager.manager.image.tag` | `latest` | Image tag. |
| `controllerManager.manager.resources.requests.cpu` | `10m` | CPU request. |
| `controllerManager.manager.resources.requests.memory` | `64Mi` | Memory request. |
| `controllerManager.manager.resources.limits.cpu` | `500m` | CPU limit. |
| `controllerManager.manager.resources.limits.memory` | `128Mi` | Memory limit. |
| `controllerManager.serviceAccount.annotations` | `{}` | Service account annotations. |

## Default Helm values

```yaml theme={"dark"}
controllerManager:
  manager:
    args:
    - --metrics-bind-address=:8443
    - --leader-elect
    - --health-probe-bind-address=:8081
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    image:
      repository: docker.io/infisical/pki-issuer
      tag: latest
    resources:
      limits:
        cpu: 500m
        memory: 128Mi
      requests:
        cpu: 10m
        memory: 64Mi
  podSecurityContext:
    runAsNonRoot: true
  replicas: 1
  serviceAccount:
    annotations: {}
controllerMetrics:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: 8443
  type: ClusterIP
kubernetesClusterDomain: cluster.local
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.