Skip to content

OTC-230: adds ESO support for cert-manager#207

Closed
hkailantzis wants to merge 28 commits intomainfrom
OTC-230-ESO-alignment
Closed

OTC-230: adds ESO support for cert-manager#207
hkailantzis wants to merge 28 commits intomainfrom
OTC-230-ESO-alignment

Conversation

@hkailantzis
Copy link
Copy Markdown
Contributor

@hkailantzis hkailantzis commented Mar 18, 2026

closes OTC-230.

#214 needs to be merged first.

  • adds opt-in for multiple ESO's ExternalSecret resources (pull)
  • adds opt-in for multiple ESO's PushSecret resource to a SecretStore (and only when pull mode is not enabled), default updatePolicy: IfNotExists
  • introduces common Lib chart where the ESO templating and relevant values are in place.

Tested on new dev Playground (infrastructure-charts/local-charts):

  • External Secret/PullSecret -> tested that the k8s secret was created successfully with the relevant values from Vault (dns user admin accessKey/SecretKey)
  • PushSecret support -> To be able to PushSecret to Vault from the existing k8s secret.
  • If PullSecret is enabled, then PushSecret is not deployed (as a safeswitch to avoid clashing with existing Vault Secrets)
  • Test that the switch to the original dependency chart is working (cert-manager-webhook-opentelekomcloud).

Note: akyriako/cert-manager-webhook-opentelekomcloud#10 has been merged, and is available in v0.2.0. -> so dependency change back to original -> bumped Chart version and AppVersion to 1.17.5

@hkailantzis hkailantzis requested a review from canaykin March 18, 2026 15:33
@hkailantzis hkailantzis self-assigned this Mar 18, 2026
@hkailantzis hkailantzis marked this pull request as draft March 19, 2026 10:45
@hkailantzis hkailantzis marked this pull request as draft March 19, 2026 10:45
@hkailantzis hkailantzis requested review from mattef92 and removed request for canaykin March 19, 2026 12:36
@hkailantzis hkailantzis marked this pull request as ready for review March 27, 2026 14:46
Comment thread charts/cert-manager/Chart.yaml Outdated
Comment thread charts/cert-manager/Chart.yaml
Comment thread charts/cert-manager/README.md Outdated
Comment thread charts/cert-manager/Changelog.md Outdated
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml Outdated
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml Outdated
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
@hkailantzis hkailantzis mentioned this pull request Mar 30, 2026
@hkailantzis hkailantzis force-pushed the OTC-230-ESO-alignment branch from 7ffde39 to 1d5a689 Compare April 1, 2026 10:52
Comment thread charts/cert-manager/values.yaml Outdated
@hkailantzis hkailantzis requested review from krankkkk and mattef92 April 1, 2026 11:04
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml Outdated
Comment thread charts/cert-manager/templates/clusterissuer-otc-dns.yaml Outdated
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/Changelog.md
@hkailantzis hkailantzis requested a review from mattef92 April 9, 2026 11:42
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/aksk-secret-otc-dns.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/templates/external-secrets.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
Comment thread charts/cert-manager/values.yaml Outdated
@hkailantzis hkailantzis requested a review from mattef92 April 13, 2026 11:33
Comment thread charts/cert-manager/templates/external-secret.yaml Outdated
decodingStrategy: {{ $secretConfig.decodingStrategy | default $spec.decodingStrategy }}
metadataPolicy: {{ $secretConfig.metadataPolicy | default $spec.metadataPolicy }}
{{- end }}
---
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Either this seems to be too much, or it's missing in the push secret

Copy link
Copy Markdown
Contributor Author

@hkailantzis hkailantzis Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

went one step further to either have common values for all secrets (default) or override where desired. Was meant to be for pull mode only, but they're valid also for PushSecrets. will add the option also there.

@github-advanced-security
Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@hkailantzis hkailantzis requested a review from mattef92 April 13, 2026 16:40
Comment thread charts/cert-manager/values.yaml
Comment thread charts/common/Chart.yaml
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The common chart has to be merged before adjusting the cert-manager. Otherwise we need a follow-up PR regarding the chart.lock etc. of the cert-manager.

# mefker @ Mac in ~/code/github/charts/charts/cert-manager on git:OTC-230-ESO-alignment x [7:51:06] 
$ helm template . -s templates/external-secrets.yaml -f values-test.yaml
Error: An error occurred while checking for chart dependencies. You may need to run `helm dependency build` to fetch missing dependencies: found in Chart.yaml, but missing in charts/ directory: common

# mefker @ Mac in ~/code/github/charts/charts/cert-manager on git:OTC-230-ESO-alignment x [7:51:24] C:1
$ helm dependency build
Error: the lock file (Chart.lock) is out of sync with the dependencies file (Chart.yaml). Please update the dependencies

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also displayed in the Github Workflows, the pipeline fails

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

empty file should be omitted. Was this copy-paste from cert-manager or created by default via Helm create?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its in every chart. I can remove it.

@hkailantzis hkailantzis requested a review from mattef92 April 14, 2026 13:28
hkailantzis and others added 2 commits April 14, 2026 15:52
* feat(common): OTC-230: add opt-in for ESO resources  in a common Lib helm chart

* Auto update of README.md files

* chores(*): add new lines

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@hkailantzis
Copy link
Copy Markdown
Contributor Author

closing in favor of #215, which has cleaner history

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants