certmanager v1.21.1
Certificate.spec.nameConstraints
x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 This is an Alpha Feature and is only enabled with the `--feature-gates=NameConstraints=true` option set on both the controller and webhook components.
| Field / Type | Description |
|---|---|
critical | if true then the name constraints are marked critical. |
Excluded contains the constraints which must be disallowed. Any name matching a restriction in the excluded field is invalid regardless of information appearing in the permitted | |
Permitted contains the constraints in which the names must be located. |