Skip to content

helm: add cert-manager as dependency #2793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
beraldoleal wants to merge 1 commit into
base: main
Choose a base branch
from
+48 −5
Open

helm: add cert-manager as dependency #2793

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/cloud-api-adaptor/install/charts/peerpods/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,14 @@ Before installing this chart, ensure you have:
> (`--set webhook.enabled=false`) is only recommended for development or when
> worker nodes have sufficient resources.

> [!WARNING]
> The webhook is enabled by default and requires cert-manager for TLS certificates.
> By default, cert-manager will be installed automatically (`webhook.certManager.install=true`).
> If cert-manager is already installed in your cluster, set `--set webhook.certManager.install=false`.
Copy link
Member

@wainersm wainersm Jan 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @beraldoleal ,

What's the consequence of trying to install the cert-manager if it is already in the cluster? Will it assume the dependency is match and move on? Or try to update the installed version and move on? Or will do something else? (hope it won't put the cluster in bad state)

Copy link
Member Author

@beraldoleal beraldoleal Jan 23, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is that this has some cluster wide resources (like CRDs) and that will fail / conflict. The helm installation would abort, could let the peerpods chart in partial state. You would need to do helm uninstall and try again with the flag set to false.

claude, told-me that it has a flag called "--atomic" that would do that rollback automatically but I never used. From the --help:

" if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used"

(So maybe we should test and document that flag)

>
> Disabling the webhook (`--set webhook.enabled=false`) is only recommended for
> development or when worker nodes have sufficient resources.

## Quick Start

### Option A: Development/Testing (secrets.mode: create)
Expand Down
6 changes: 6 additions & 0 deletions src/webhook/chart/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,3 +18,9 @@ sources:
maintainers:
- name: Confidential Containers Community
url: https://github.com/confidential-containers

dependencies:
- name: cert-manager
version: "v1.16.2"
repository: "oci://quay.io/jetstack/charts"
condition: certManager.enabled,certManager.install
23 changes: 18 additions & 5 deletions src/webhook/chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,34 @@ Before installing this chart, ensure you have:
- **Helm** v3.x or v4.x installed ([installation guide](https://helm.sh/docs/intro/install/))
- **Kubernetes cluster** with appropriate access
- **kubeconfig** configured to access your cluster
- **cert-manager** installed in the cluster ([installation guide](https://cert-manager.io/docs/installation/))

> **Note**: The webhook requires TLS certificates to operate. This chart uses cert-manager
> [!WARNING]
> The webhook requires TLS certificates to operate. This chart uses cert-manager
> to automatically generate and manage these certificates.
>
> By default, cert-manager will be installed automatically (`certManager.install=true`).
> If cert-manager is already installed in your cluster, set `--set certManager.install=false`.
>
> To disable cert-manager integration entirely and provide certificates manually,
> set `--set certManager.enabled=false`.
## Quick Start

### Standalone Installation

**With automatic cert-manager installation (default):**

```bash
# Install cert-manager if not already installed
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.yaml
helm install peerpods-webhook ./chart \
-n confidential-containers-system \
--create-namespace
```

**If cert-manager is already installed:**

# Install the webhook chart
```bash
helm install peerpods-webhook ./chart \
--set certManager.install=false \
-n confidential-containers-system \
--create-namespace
```
Expand Down
9 changes: 9 additions & 0 deletions src/webhook/chart/templates/certmanager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
{{- if .Values.certManager.enabled }}
# Use post-install hooks to ensure cert-manager webhook is ready before creating CRs.
# When cert-manager is installed as a dependency, its CRDs are created but the webhook
# pods may not be running yet. These hooks run after --wait confirms all pods are ready.
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ .Values.namePrefix }}selfsigned-issuer
namespace: {{ .Values.namespace }}
annotations:
helm.sh/hook: post-install,post-upgrade
helm.sh/hook-weight: "1"
spec:
selfSigned: {}
---
Expand All @@ -12,6 +18,9 @@ kind: Certificate
metadata:
name: {{ .Values.namePrefix }}serving-cert
namespace: {{ .Values.namespace }}
annotations:
helm.sh/hook: post-install,post-upgrade
helm.sh/hook-weight: "2"
spec:
dnsNames:
- {{ .Values.namePrefix }}webhook-service.{{ .Values.namespace }}.svc
Expand Down
7 changes: 7 additions & 0 deletions src/webhook/chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,4 +50,11 @@ authProxy:
# cert-manager automates certificate generation, rotation, and trust configuration
# Without this, you would need to manually create and manage webhook certificates
certManager:
# Use cert-manager to generate webhook TLS certificates
# Creates Certificate and Issuer custom resources
# Set to false only if you are providing certificates through another method
enabled: true

# Install cert-manager as a chart dependency
# Set to false if cert-manager is already installed in your cluster
install: true
Loading