Allow specifying resources in fulcio createcerts job #899

philarcand · 2025-01-29T15:40:53Z

Description of the change

This PR adds the ability to specify resources to the fulcio createcerts job, and documents resources under server.

Existing or Associated Issue(s)

It is currently impossible to specify resources for the fulcio createcerts job, which is problematic for deployments where ResourceQuota is being used, forcing the use of LimitRange.

Checklist

Chart version bumped in Chart.yaml according to semver. Where applicable, update and bump the versions in any associated umbrella chart
Variables are documented in the values.yaml and added to the README.md. The helm-docs utility can be used to generate the necessary content. Use helm-docs --dry-run to preview the content.
JSON Schema generated.
List tests pass for Chart using the Chart Testing tool and the ct lint command.

Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]>

vipulagarwal · 2025-02-02T11:12:38Z

Hi @philarcand, thanks for the PR. Can you update the values schema please? Thanks

…rver Signed-off-by: Philippe Arcand <[email protected]>

philarcand · 2025-02-04T12:18:50Z

Hi @vipulagarwal , thanks for reviewing. I modified the schema in 48d0a71

philarcand · 2025-03-26T13:48:07Z

Hi @vipulagarwal , just checking on the status of this PR.

Bumps the actions group with 1 update: [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/setup-python` from 5.3.0 to 5.4.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@0b93645...4237552) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Hayden Blauzvern <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

…store#908) Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

* ci: add workflow to validate schema Signed-off-by: falcorocks <[email protected]> * fix: policy controller chart schema removes keys required and additonalProperties from the controller chart schema that were added by mistake in 142e34b see https://sigstore.slack.com/archives/C03096V09F1/p1737627750048369 Signed-off-by: falcorocks <[email protected]> * Update .github/workflows/check-schema-policy-controller.yml Co-authored-by: Bob Callaway <[email protected]> Signed-off-by: falcorocks <[email protected]> * ci: remove go version from setup-go step Signed-off-by: falcorocks <[email protected]> * ci: pin version of setup-go action to v5.3.0 digest (latest) Signed-off-by: falcorocks <[email protected]> --------- Signed-off-by: falcorocks <[email protected]> Co-authored-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Philippe Arcand <[email protected]>

…ok deployment (sigstore#894) * feat: add optional resources requests and limits to cleanup job Signed-off-by: falcorocks <[email protected]> * feat: add optional podSecurity context to cleanup job Signed-off-by: falcorocks <[email protected]> * feat: add optional priorityClass to cleanup job Signed-off-by: falcorocks <[email protected]> * feat: add optional priorityClass to webhook Signed-off-by: falcorocks <[email protected]> * feat: add optional envFrom to webhook Signed-off-by: falcorocks <[email protected]> * feat: add optional automountServiceAccountToken to cleanup job Signed-off-by: falcorocks <[email protected]> * feat: add optional automountServiceAccountToken to webhook Signed-off-by: falcorocks <[email protected]> * chore: bump version Signed-off-by: falcorocks <[email protected]> --------- Signed-off-by: falcorocks <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Philippe Arcand <[email protected]>

…store#995) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.8.2 to 3.9.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@3454372...fb28c2b) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 3.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Philippe Arcand <[email protected]>

…store#996) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.9.0 to 3.9.1 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@fb28c2b...398d4b0) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 3.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

* bump fulcio for scaffolding v0.7.24 release Signed-off-by: Bob Callaway <[email protected]> * bump Chart.lock Signed-off-by: Bob Callaway <[email protected]> --------- Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

* bump policy-controller chart for v0.13.0 release Signed-off-by: Bob Callaway <[email protected]> * update schema description Signed-off-by: Bob Callaway <[email protected]> --------- Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

* Trillian: fix log signer forceMaster always true Signed-off-by: Aaron Howland <[email protected]> * Bump trillian to v0.3.7 Signed-off-by: Aaron Howland <[email protected]> --------- Signed-off-by: Aaron Howland <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Aaron Howland <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

This changes the logic for how redis.hostname is set. Either Redis is deployed via K8s, at which point the hostname is either set to the fullname by default or the provided hostname, or Redis is externally managed at which point the hostname is set to the provided hostname. The flags to Rekor will only be set when hostname is not empty, so they will not be set if Redis is disabled or an empty hostname is provided, which is the default. Signed-off-by: Hayden B <[email protected]> Co-authored-by: Hayden B <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Followup from last PR Signed-off-by: Hayden <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

…store#1014) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.9.1 to 3.9.2 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@398d4b0...d58896d) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 3.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

…re#1020) Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: philarcand <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: Philippe Arcand <[email protected]>

Signed-off-by: philarcand <[email protected]>

philarcand · 2025-08-06T20:52:16Z

I rebased this PR and updated the versions if anyone wants to take a look.

philarcand and others added 7 commits January 30, 2025 12:40

Add createcerts.resources to README

0929ac3

Signed-off-by: Philippe Arcand <[email protected]>

Bump up Chart version to 2.6.5

5324f50

Signed-off-by: Philippe Arcand <[email protected]>

Added server.resources to README

7622b46

Signed-off-by: Philippe Arcand <[email protected]>

Updated README with helm-docs

c1a3ea1

Signed-off-by: Philippe Arcand <[email protected]>

bump fulcio chart for 1.6.6 release

0a66ad5

Signed-off-by: Bob Callaway <[email protected]>

put version on version line for readability

062e6c8

Signed-off-by: Bob Callaway <[email protected]>

bump scaffold chart for recent fulcio release

b7a925d

Signed-off-by: Bob Callaway <[email protected]>

philarcand force-pushed the main branch from fb160a9 to b7a925d Compare January 30, 2025 17:41

Merge branch 'sigstore:main' into main

227e0c7

Modified value.schema.json - added resources under createcerts and se…

48d0a71

…rver Signed-off-by: Philippe Arcand <[email protected]>

dependabot bot and others added 17 commits August 5, 2025 14:02

Fix digest for rekor v1.3.9

b8f8183

Signed-off-by: Hayden Blauzvern <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump version

4fa7ba6

Signed-off-by: Hayden Blauzvern <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

add support for cloud sql IAM user in rekor chart (sigstore#906)

9b8d24a

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart for 1.6.4 rekor chart (sigstore#907)

8086088

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

build(deps): bump sigstore/cosign-installer in the actions group (sig…

db0b095

…store#908) Signed-off-by: Philippe Arcand <[email protected]>

fix typo in rekor template (sigstore#910)

63533c0

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart for rekor 1.6.5 (sigstore#911)

5a576cf

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

update trillian chart for iamUsername (sigstore#912)

e64e025

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump rekor chart for new trillian version (sigstore#913)

4dd6e61

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart for rekor/trillian bump (sigstore#914)

1b675f7

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

build(deps): bump the actions group with 2 updates (sigstore#915)

8477390

Signed-off-by: Philippe Arcand <[email protected]>

bump trillian chart for 0.7.21 scaffolding release (sigstore#922)

6ec602d

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump ctlog chart for 0.7.21 scaffolding release (sigstore#923)

dedceb3

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump fulcio chart for v0.7.21 scaffolding release (sigstore#924)

ae9f5c3

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

haydentherapper and others added 27 commits August 5, 2025 14:04

Bump rekor-tiles to v0.1.6 (sigstore#994)

2719af2

Signed-off-by: Philippe Arcand <[email protected]>

bump updatetree chart for scaffolding v0.7.24 release (sigstore#998)

401a6f5

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump trillian for scaffolding v0.7.24 release (sigstore#999)

f04512c

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump tuf chart for scaffolding v0.7.24 release (sigstore#997)

c25cbd1

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump ctlog for scaffolding v0.7.24 release (sigstore#1001)

da27e59

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump prober for scaffolding v0.7.24 release (sigstore#1000)

cc8b48e

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump rekor for scaffolding v0.7.24 release (sigstore#1002)

6d97624

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart for scaffolding v0.7.24 release (sigstore#1005)

7cbbf2b

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

trillian: add log signer etcd servers to values (sigstore#1006)

cee84df

Signed-off-by: Aaron Howland <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

enable election_system option for trillian-log-signer (sigstore#1010)

f8f09df

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump trillian dep for rekor chart (sigstore#1011)

b513fa5

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart for rekor, trillian chart updates (sigstore#1012)

f5aedf9

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Add clarifying comment for setting redis hostname (sigstore#1013)

895f79b

Followup from last PR Signed-off-by: Hayden <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

make rbac object names unique (sigstore#1017)

0e0e983

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump chart for rekor v1.4.0 release (sigstore#1018)

7337ea3

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart with rekor, trillian fixes (sigstore#1019)

7d3a7c7

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

make trillian services headless to enable gRPC load balancing (sigsto…

dcea295

…re#1020) Signed-off-by: Philippe Arcand <[email protected]>

bump scaffold chart for new trillian chart (sigstore#1021)

b9627cc

Signed-off-by: Bob Callaway <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Bump up Chart version to 2.6.13

2449e7d

Signed-off-by: philarcand <[email protected]> Signed-off-by: Philippe Arcand <[email protected]>

Updated readme

276573c

Signed-off-by: Philippe Arcand <[email protected]>

philarcand force-pushed the main branch from b13be8b to 276573c Compare August 5, 2025 18:06

Merge branch 'main' into main

812f536

Signed-off-by: philarcand <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow specifying resources in fulcio createcerts job #899

Allow specifying resources in fulcio createcerts job #899

Uh oh!

philarcand commented Jan 29, 2025

Uh oh!

vipulagarwal commented Feb 2, 2025

Uh oh!

philarcand commented Feb 4, 2025

Uh oh!

philarcand commented Mar 26, 2025

Uh oh!

philarcand commented Aug 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Allow specifying resources in fulcio createcerts job #899

Are you sure you want to change the base?

Allow specifying resources in fulcio createcerts job #899

Uh oh!

Conversation

philarcand commented Jan 29, 2025

Description of the change

Existing or Associated Issue(s)

Checklist

Uh oh!

vipulagarwal commented Feb 2, 2025

Uh oh!

philarcand commented Feb 4, 2025

Uh oh!

philarcand commented Mar 26, 2025

Uh oh!

philarcand commented Aug 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants