aws-load-balancer-controller: certificate with extra issuerRef conf

Author: siryur

stable/aws-load-balancer-controller/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: aws-load-balancer-controller
 description: AWS Load Balancer Controller Helm chart for Kubernetes
-version: 1.13.4
+version: 1.13.5
 appVersion: v2.13.4
 home: https://github.com/aws/eks-charts
 icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png

stable/aws-load-balancer-controller/README.md

@@ -258,6 +258,7 @@ The default values set by the application itself can be confirmed [here](https:/
 | `podDisruptionBudget`                          | Limit the disruption for controller pods. Require at least 2 controller replicas and 3 worker nodes                                                                                                                   | `{}`                                              |
 | `updateStrategy`                               | Defines the update strategy for the deployment                                                                                                                                                                        | `{}`                                              |
 | `enableCertManager`                            | If enabled, cert-manager issues the webhook certificates instead of the helm template, requires cert-manager and it's CRDs to be installed                                                                            | `false`                                           |
+| `certManager.extraIssuerRef`                   | Extra block to add to the Certificate IssuerRef.                                                                                                                                                                      | `{}`                                              |
 | `certManager.duration`                         | Overrides the default expiry duration for the webhook certificates. defaults to `90d`                                                                                                                                 | `""`                                              |
 | `certManager.renewBefore`                      | Overrides the renewal time period duration for the webhook certificates. defaults to `60d`                                                                                                                            | `""`                                              |
 | `enableEndpointSlices`                         | If enabled, controller uses k8s EndpointSlices instead of Endpoints for IP targets                                                                                                                                    | `false`                                           |

stable/aws-load-balancer-controller/templates/webhook.yaml

@@ -236,6 +236,9 @@ spec:
   issuerRef:
     kind: Issuer
     name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer
+    {{- with .Values.certManager.extraIssuerRef }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }}
   {{- with .Values.certManager -}}
   {{ if .duration }}

stable/aws-load-balancer-controller/values.yaml

@@ -117,6 +117,8 @@ enableCertManager: false
 
 # Overrideable variables when enableCertManager is set to true
 certManager:
+  extraIssuerRef:
+    # group: cert-manager.io
   duration:
   renewBefore: