helm: add cert-manager wrapper chart by danish9039 · Pull Request #3470 · kubeflow/community-distribution

danish9039 · 2026-05-18T15:01:52Z

Summary

Adds an experimental cert-manager Helm wrapper chart under common/cert-manager/helm, co-located with the Kustomize baseline under common/cert-manager.

The chart wraps the upstream Jetstack cert-manager Helm chart at v1.20.2 and adds Kubeflow-specific cert-manager integration resources.

Scope

Add the cert-manager wrapper chart.
Move the wrapper chart from experimental/helm/charts/cert-manager to common/cert-manager/helm.
Update YAML lint config so co-located Helm templates under common/*/helm/templates/** are not treated as raw YAML.
Keep Chart.yaml dependency version as bare semver ("1.20.2") while preserving appVersion: v1.20.2.
Regenerate Chart.lock after the dependency version fix.
Add cert-manager to tests/helm_kustomize_compare.sh with the co-located chart path and --include-crds.
Add Jetstack Helm repo setup before helm dependency build so CI can resolve the cert-manager dependency from a clean runner.

Follow-up

Sync script extension for appVersion/dependency updates will follow separately after the chart location change, so this PR stays focused on co-location and parity proof.

Stacking note

This PR is stacked on the foundation chart shape from #3468.

The wrapper does not render Namespace/cert-manager. The namespace is provided by kubeflow-namespaces, and the Helm release metadata is stored in the cert-manager workload namespace.

This means the intended platform install order is:

kubeflow-namespaces -> kubeflow-platform -> cert-manager

Install shape

helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces --namespace default
helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform --namespace kubeflow-system

helm dep build ./common/cert-manager/helm
helm install cert-manager ./common/cert-manager/helm --namespace cert-manager --wait

Validation

helm dependency list common/cert-manager/helm
helm lint common/cert-manager/helm/
./tests/helm_kustomize_compare.sh cert-manager base
./tests/helm_kustomize_compare_all.sh cert-manager
git diff --check HEAD~1..HEAD

Also validated the cert-manager compare path with an empty Helm repository config to match clean CI runners.

github-actions · 2026-05-18T15:02:45Z

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

Copilot

Pull request overview

Adds an experimental Helm wrapper chart for cert-manager and wires it into the Helm/Kustomize comparison tooling.

Changes:

Introduces the cert-manager wrapper chart, values, templates, lock file, and README.
Adds Kubeflow-specific optional resources for the ClusterIssuer and NetworkPolicies.
Extends comparison scripts to cover cert-manager base and Kubeflow scenarios.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`.gitignore`	Ignores generated Helm dependency archives.
`experimental/helm/charts/cert-manager/.helmignore`	Defines files excluded from chart packaging.
`experimental/helm/charts/cert-manager/Chart.lock`	Locks the Jetstack cert-manager chart dependency.
`experimental/helm/charts/cert-manager/Chart.yaml`	Defines the wrapper chart metadata and dependency.
`experimental/helm/charts/cert-manager/README.md`	Documents install and parity validation flow.
`experimental/helm/charts/cert-manager/ci/values-base.yaml`	Adds base comparison values.
`experimental/helm/charts/cert-manager/ci/values-kubeflow.yaml`	Adds Kubeflow comparison values.
`experimental/helm/charts/cert-manager/templates/kubeflow-resources.yaml`	Adds optional Kubeflow ClusterIssuer and NetworkPolicies.
`experimental/helm/charts/cert-manager/templates/namespace.yaml`	Adds the cert-manager namespace template.
`experimental/helm/charts/cert-manager/values.yaml`	Adds default wrapper chart values.
`tests/helm_kustomize_compare.py`	Allows cert-manager in manifest comparison.
`tests/helm_kustomize_compare.sh`	Adds cert-manager scenarios and rendering logic.
`tests/helm_kustomize_compare_all.sh`	Includes cert-manager in all-scenario comparison runs.

danish9039 · 2026-05-25T16:04:19Z

+
+```bash
+helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces
+helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform


Fixed in the README: kubeflow-platform and cert-manager now use --namespace kubeflow-system.

danish9039 · 2026-05-25T16:04:20Z

    namespace = sys.argv[5] if len(sys.argv) > 5 and not sys.argv[5].startswith('--') else ""

-    if component not in ["katib", "hub", "kserve-models-web-app"]:
+    if component not in ["katib", "hub", "kserve-models-web-app", "cert-manager"]:


Fixed by preserving the Kubeflow cert-manager overlay labels on the overlay-owned resources during comparison.

juliusvonkohout · 2026-05-25T18:03:49Z

Please first update kustomize to the latest available version in a separate PR.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 · 2026-05-31T16:54:53Z

Addressed: cert-manager Kustomize manifests were synchronized to v1.20.2 in #3482, and this chart branch is aligned to that version.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate · 2026-06-07T23:06:43Z

+- upstream cert-manager `v1.20.2`
+- cert-manager CRDs
+- optional `ClusterIssuer/kubeflow-self-signing-issuer`
+- optional Kubeflow cert-manager NetworkPolicies


Here it should be
- optional kubeflow specific cert-manager NetworkPolicies.

Updated the bullet to optional Kubeflow-specific cert-manager NetworkPolicies.

dhanishaphadate · 2026-06-07T23:16:45Z

+- optional `ClusterIssuer/kubeflow-self-signing-issuer`
+- optional Kubeflow cert-manager NetworkPolicies
+
+In the Kubeflow platform install, apply the foundation charts first. The `kubeflow-namespaces` chart provides `Namespace/cert-manager`; this wrapper stores its Helm release metadata in that same workload namespace.


Specify the names of the foundation charts and then mention what they provide.

Chart type Chart

Bootstrap Foundation kubeflow-namespaces

Platform Foundation kubeflow-platform

Added a small table for kubeflow-namespaces and kubeflow-platform with what each foundation chart provides.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate · 2026-06-07T23:18:37Z

+helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces --namespace default
+helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform --namespace kubeflow-system
+
+helm install cert-manager ./experimental/helm/charts/cert-manager --namespace cert-manager --wait


Add a command to pull the dependencies first using Chart.lock

helm dep build ./experimental/helm/charts/cert-manager

Added helm dep build ./experimental/helm/charts/cert-manager before the cert-manager install command.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 13 changed files in this pull request and generated 3 comments.

+elif [[ "$COMPONENT" == "cert-manager" ]]; then
+    helm repo add jetstack https://charts.jetstack.io --force-update >/dev/null
+    helm dependency build "$CHART_DIR" >/dev/null
+    helm template cert-manager "$CHART_DIR" \
+        --namespace "$NAMESPACE" \
+        --values "$HELM_VALUES_ARG" > "$HELM_OUTPUT"


+if [[ "$COMPONENT" == "cert-manager" && "$SCENARIO" == "kubeflow" ]]; then
+    : > "$KUSTOMIZE_OUTPUT"
+    for path in $KUSTOMIZE_PATH; do
+        kustomize build "$path" >> "$KUSTOMIZE_OUTPUT"
+        printf "\n---\n" >> "$KUSTOMIZE_OUTPUT"
+    done
+else
+    kustomize build "$KUSTOMIZE_PATH" > "$KUSTOMIZE_OUTPUT"
+fi


+    helm repo add jetstack https://charts.jetstack.io --force-update >/dev/null
+    helm dependency build "$CHART_DIR" >/dev/null


Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow · 2026-06-15T03:55:57Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kimwnasptd for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

…cript Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot AI review requested due to automatic review settings May 18, 2026 15:01

google-oss-prow Bot added the do-not-merge/work-in-progress label May 18, 2026

google-oss-prow Bot requested review from juliusvonkohout and kimwnasptd May 18, 2026 15:01

google-oss-prow Bot added the size/L label May 18, 2026

Copilot started reviewing on behalf of danish9039 May 18, 2026 15:03 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

danish9039 force-pushed the gsoc/cert-manager-wrapper-chart branch 2 times, most recently from 553f9c5 to 6b1d396 Compare May 19, 2026 19:12

This was referenced May 25, 2026

helm: add Istio wrapper chart #3478

Open

helm: add oauth2-proxy wrapper chart #3479

Open

helm: add Dex wrapper chart #3480

Open

danish9039 force-pushed the gsoc/cert-manager-wrapper-chart branch from 8cf2018 to e1f141d Compare May 25, 2026 16:04

danish9039 added 3 commits May 27, 2026 01:07

helm: add cert-manager wrapper chart

fff2465

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

cert-manager: support existing installations

7088454

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: preserve cert-manager overlay labels in comparison

a945009

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 force-pushed the gsoc/cert-manager-wrapper-chart branch from e1f141d to a945009 Compare May 26, 2026 19:38

helm: align cert-manager wrapper with v1.20.2

d926dd7

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 marked this pull request as ready for review June 1, 2026 13:35

google-oss-prow Bot removed the do-not-merge/work-in-progress label Jun 1, 2026

helm: use foundation-owned cert-manager namespace

f9fb01c

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate reviewed Jun 7, 2026

View reviewed changes

helm: clarify cert-manager network policy wording

9e11606

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate reviewed Jun 7, 2026

View reviewed changes

helm: document cert-manager install prerequisites

47d50d5

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 requested a review from Copilot June 7, 2026 23:43

Copilot AI reviewed Jun 7, 2026

View reviewed changes

danish9039 added 2 commits June 9, 2026 16:57

helm: fix cert-manager namespace name

c30029f

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: move cert-manager chart to common/cert-manager/helm

fe87025

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 3 commits June 15, 2026 09:32

ci: ignore Helm templates in YAML lint

c1f4b67

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: fix cert-manager Chart.yaml version format and add to compare s…

ff7b556

…cript Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: add jetstack repo setup for cert-manager compare

f0e280a

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Chart type	Chart
Bootstrap Foundation	kubeflow-namespaces
Platform Foundation	kubeflow-platform

		helm repo add jetstack https://charts.jetstack.io --force-update >/dev/null
		helm dependency build "$CHART_DIR" >/dev/null

Conversation

danish9039 commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Follow-up

Stacking note

Install shape

Validation

Uh oh!

github-actions Bot commented May 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout commented May 25, 2026

Uh oh!

danish9039 commented May 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

google-oss-prow Bot commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

danish9039 commented May 18, 2026 •

edited

Loading