// Module included in the following assemblies:
//
// * security/cert_manager_operator/cert-manager-trust-manager.adoc

:_mod-docs-content-type: REFERENCE
[id="cert-manager-trust-manager-fields_{context}"]
= Trust manager custom resource fields

[role="_abstract"]
You can configure the behavior of the trust-manager operand by modifying the `TrustManager` custom resource (CR).

:FeatureName: Distributing certificates by using trust manager
include::snippets/technology-preview.adoc[leveloffset=+1]

The following table lists the parameters for configuring trust-manager settings.

[cols="3,1,5a",options="header"]
|===
|Field |Type |Description

|`spec.controllerConfig.labels`
|`object`
|Optional. Specifies a list of key-value pairs to apply as labels to all resources created for the trust manager deployment.

|`spec.controllerConfig.annotations`
|`object`
|Optional. Specifies a list of key-value pairs to apply as annotations to all resources created for the trust manager deployment.

|`spec.trustManagerConfig.affinity`
|`object`
|Optional. Specifies the scheduling constraints for the trust manager pod. For more information, see link:https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/[Assigning Pods to Nodes].

|`spec.trustManagerConfig.defaultCAPackage`
|`object`
|Optional. Configures the default CA package for trust manager. When enabled, the Operator uses the {product-title} trusted CA bundle injection mechanism.

|`spec.trustManagerConfig.defaultCAPackage.policy`
|`string`
|Optional. Specifies whether the default CA package feature is enabled. When set to `Enabled`, the Operator configures the trusted CA bundle to trust manager. When set to `Disabled`, no default CA package is configured. The default value is `Disabled`.

[NOTE]
====
To enable the `useDefaultCAs: true` setting in your Bundle CR, you must set the value to `Enabled`.
====

|`spec.trustManagerConfig.filterExpiredCertificates`
|`string`
|Optional. Specifies whether trust manager filters out expired certificates from trust bundles before distributing them. When set to `Enabled`, the expired certificates are removed from bundles. When set to `Disabled`, the expired certificates are included in bundles. The default value is `Disabled`.

|`spec.trustManagerConfig.logLevel`
|`integer`
|Optional. Specifies the verbosity of trust manager logging. The minimum value is `1` and the maximum value is `5`. The default value is `1`.

|`spec.trustManagerConfig.logFormat`
|`string`
|Optional. Specifies the output format for trust manager logging. The supported formats are `text` and `json`. The default value is `text`.

|`spec.trustManagerConfig.nodeSelector`
|`object`
|Optional. Specifies the key-value pairs that limit which nodes can host the trust manager pod. You can specify a maximum of 50 node selectors. For more information, see link:https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/[Assigning Pods to Nodes].

|`spec.trustManagerConfig.resources`
|`object`
|Optional. Defines the compute resource requirements for the trust manager pod.

|`spec.trustManagerConfig.secretTargets`
|`object`
|Optional. Defines the configuration for writing trust bundles to `Secrets`.

|`spec.trustManagerConfig.secretTargets.authorizedSecrets`
|`array`
|Optional. A list of specific secret names that trust manager is authorized to create and update.

[NOTE]
====
If `spec.trustManagerConfig.secretTargets.policy` is set to `Custom`, you must specify a value. If `spec.trustManagerConfig.secretTargets.policy` is set to `Disabled`, you must not specify a value.
====

|`spec.trustManagerConfig.secretTargets.policy`
|`string`
|Optional. Specifies whether trust manager can write trust bundles to `Secrets`. When set to `Disabled`, trust manager cannot write trust bundles to `Secrets`. When set to `Custom`, trust manager is granted permission to create and update only the secrets listed in the `authorizedSecrets` parameter. The default value is `Disabled`.

|`spec.trustManagerConfig.tolerations`
|`array`
|Optional. Allows the trust manager pod to be scheduled on nodes with specific taints. You can specify a maximum of 50 tolerations.

|`spec.trustManagerConfig.trustNamespace`
|`string`
|Optional. Specifies the namespace where trust manager locates CA certificate sources, such as ConfigMaps and Secrets. This namespace must exist before you create the TrustManager custom resource. The default value is `cert-manager`.

[NOTE]
====
You cannot change the value once set.
====
|===