Skip to content

[koptan] add cert-manager and webhook resources to helm chart #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mahmoudk1000 merged 1 commit into from
Apr 1, 2026
Merged

[koptan] add cert-manager and webhook resources to helm chart #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
.claude/
38 changes: 38 additions & 0 deletions charts/koptan/templates/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{{- if .Values.certManager.enabled }}
{{- if .Values.webhook.enabled }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "koptan.fullname" . }}-serving-cert
namespace: {{ .Release.Namespace }}
labels:
{{- include "koptan.labels" . | nindent 4 }}
spec:
dnsNames:
- {{ include "koptan.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc
- {{ include "koptan.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
issuerRef:
kind: Issuer
name: {{ include "koptan.fullname" . }}-selfsigned-issuer
secretName: webhook-server-cert
{{- end }}
{{- if .Values.metrics.secure }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "koptan.fullname" . }}-metrics-certs
namespace: {{ .Release.Namespace }}
labels:
{{- include "koptan.labels" . | nindent 4 }}
spec:
dnsNames:
- {{ include "koptan.fullname" . }}-metrics-service.{{ .Release.Namespace }}.svc
- {{ include "koptan.fullname" . }}-metrics-service.{{ .Release.Namespace }}.svc.cluster.local
issuerRef:
kind: Issuer
name: {{ include "koptan.fullname" . }}-selfsigned-issuer
secretName: metrics-server-cert
{{- end }}
Comment on lines +21 to +37

Copilot AI Mar 31, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The metrics Certificate is rendered whenever certManager.enabled is true, even if metrics.secure is false (and metrics-service / metrics TLS mounts may not be rendered). Gate the metrics certificate on metrics.secure (or render the metrics Service/mounts whenever this certificate is created) to avoid creating unused resources and potential confusion.

Copilot uses AI. Check for mistakes.
{{- end }}
56 changes: 55 additions & 1 deletion charts/koptan/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
{{- $webhookCerts := and .Values.webhook.enabled .Values.certManager.enabled }}
{{- $metricsCerts := and .Values.metrics.secure .Values.certManager.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
Expand Down Expand Up @@ -28,12 +30,31 @@ spec:
args:
- --leader-elect
- --health-probe-bind-address=:8081
{{- if .Values.metrics.secure }}
- --metrics-bind-address=:{{ .Values.metrics.port }}
{{- end }}
{{- if $webhookCerts }}
- --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
{{- end }}
{{- if $metricsCerts }}
- --metrics-cert-path=/tmp/k8s-metrics-server/metrics-certs
{{- end }}
Comment on lines 1 to +41

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

metrics.secure: true does not imply certManager.enabled: true, but the Deployment will still set --metrics-bind-address and open the metrics container port while cert mounts / metrics Service / metrics RBAC are only created when cert-manager is enabled. This creates a partial configuration that can break startup or expose an endpoint unexpectedly; consider enforcing the dependency with a Helm fail/required check or gating all related pieces on a single condition.

Copilot uses AI. Check for mistakes.
image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
ports:
- name: http
containerPort: 8080
protocol: TCP
{{- if .Values.webhook.enabled }}
- name: webhook-server
containerPort: 9443
protocol: TCP
{{- end }}
{{- if .Values.metrics.secure }}
- name: metrics
containerPort: {{ .Values.metrics.port }}
protocol: TCP
Comment on lines +33 to +56

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

metrics.secure changes --metrics-bind-address to :{{ .Values.metrics.port }} even when certManager.enabled is false, but TLS is only configured when $metricsCerts is true (--metrics-cert-path + secret mount). With metrics.secure=true and certManager.enabled=false, metrics are likely served plaintext on the “secure” port and the default Service (templates/service.yaml) will still point at targetPort: http (8080), which won’t be listening anymore. Consider making --metrics-bind-address (and the metrics container port) conditional on $metricsCerts, or alternatively keep metrics on 8080 unless certs are configured and update/disable the default Service accordingly.

Copilot uses AI. Check for mistakes.
{{- end }}
resources:
limits:
cpu: 500m
Expand All @@ -59,4 +80,37 @@ spec:
port: 8081
initialDelaySeconds: 5
periodSeconds: 10
volumes: []
{{- if or $webhookCerts $metricsCerts }}
volumeMounts:
{{- if $webhookCerts }}
- mountPath: /tmp/k8s-webhook-server/serving-certs
name: webhook-certs
readOnly: true
{{- end }}
{{- if $metricsCerts }}
- mountPath: /tmp/k8s-metrics-server/metrics-certs
name: metrics-certs
readOnly: true
{{- end }}
{{- end }}
{{- if or $webhookCerts $metricsCerts }}
volumes:
{{- if $webhookCerts }}
- name: webhook-certs
secret:
secretName: webhook-server-cert
{{- end }}
{{- if $metricsCerts }}
- name: metrics-certs
secret:
secretName: metrics-server-cert
optional: false
items:
- key: ca.crt
path: ca.crt
- key: tls.crt
path: tls.crt
- key: tls.key
path: tls.key
{{- end }}
Comment on lines +97 to +115

Copilot AI Mar 31, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If neither webhook-certs nor metrics-certs are enabled (e.g., certManager.enabled: false, or both webhook.enabled: false and metrics.secure: false), this template still renders a volumes: key with no list items, which becomes null in YAML/JSON and is invalid for PodSpec.volumes. Either omit the volumes block entirely when empty or render volumes: [] as a safe default.

Copilot uses AI. Check for mistakes.
{{- end }}
11 changes: 11 additions & 0 deletions charts/koptan/templates/issuer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{{- if .Values.certManager.enabled }}

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issuer is created whenever certManager.enabled is true, even if neither webhook.enabled nor metrics.secure are enabled (i.e., no Certificate resources will be rendered). Consider gating the Issuer on whether at least one certificate is needed to avoid installing unused cert-manager resources.

Suggested change
{{- if .Values.certManager.enabled }}
{{- if and .Values.certManager.enabled (or .Values.webhook.enabled .Values.metrics.secure) }}

Copilot uses AI. Check for mistakes.
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ include "koptan.fullname" . }}-selfsigned-issuer
namespace: {{ .Release.Namespace }}
labels:
{{- include "koptan.labels" . | nindent 4 }}
spec:
selfSigned: {}
{{- end }}
Comment on lines +1 to +11

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issuer.yaml renders an Issuer whenever certManager.enabled is true, even if neither webhook.enabled nor metrics.secure are enabled (so no Certificates are created). Consider gating the Issuer on and .Values.certManager.enabled (or .Values.webhook.enabled .Values.metrics.secure) to avoid creating unused resources.

Copilot uses AI. Check for mistakes.
39 changes: 39 additions & 0 deletions charts/koptan/templates/leader-election-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "koptan.fullname" . }}-leader-election-role

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Role/RoleBinding names must be <=63 chars, but these are formed by appending a long suffix to koptan.fullname (already truncated to 63). For long release names this can exceed the limit and break installs; consider truncating after concatenating the suffix (or using a dedicated helper for leader-election resource names).

Suggested change
name: {{ include "koptan.fullname" . }}-leader-election-role
name: {{ printf "%s-leader-election-role" (include "koptan.fullname" .) | trunc 63 | trimSuffix "-" }}

Copilot uses AI. Check for mistakes.
namespace: {{ .Release.Namespace }}
labels:
{{- include "koptan.labels" . | nindent 4 }}
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
15 changes: 15 additions & 0 deletions charts/koptan/templates/leader-election-rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "koptan.fullname" . }}-leader-election-rolebinding
namespace: {{ .Release.Namespace }}
labels:
{{- include "koptan.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "koptan.fullname" . }}-leader-election-role
subjects:
- kind: ServiceAccount
name: {{ include "koptan.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
36 changes: 36 additions & 0 deletions charts/koptan/templates/metrics-auth-clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
{{- if and .Values.metrics.secure .Values.certManager.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "koptan.fullname" . }}-metrics-auth-role
labels:
{{- include "koptan.labels" . | nindent 4 }}
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "koptan.fullname" . }}-metrics-auth-rolebinding
labels:
{{- include "koptan.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "koptan.fullname" . }}-metrics-auth-role
subjects:
- kind: ServiceAccount
name: {{ include "koptan.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
17 changes: 17 additions & 0 deletions charts/koptan/templates/metrics-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{{- if and .Values.metrics.secure .Values.certManager.enabled }}
apiVersion: v1
kind: Service
metadata:
name: {{ include "koptan.fullname" . }}-metrics-service

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same potential name-length issue as the webhook Service: {{ include "koptan.fullname" . }}-metrics-service can exceed the 63-char Service name limit if the release/fullname is long. Truncate the final string (or use a helper) to keep the rendered name within Kubernetes limits.

Suggested change
name: {{ include "koptan.fullname" . }}-metrics-service
name: {{ include "koptan.fullname" . | trunc 47 | trimSuffix "-" }}-metrics-service

Copilot uses AI. Check for mistakes.
namespace: {{ .Release.Namespace }}
labels:
{{- include "koptan.labels" . | nindent 4 }}
spec:
ports:
- name: https
port: {{ .Values.metrics.port }}
protocol: TCP
targetPort: {{ .Values.metrics.port }}
selector:
{{- include "koptan.selectorLabels" . | nindent 4 }}
{{- end }}
113 changes: 113 additions & 0 deletions charts/koptan/templates/mutatingwebhookconfiguration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
{{- if and .Values.webhook.enabled .Values.certManager.enabled }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
name: {{ include "koptan.fullname" . }}-mutating-webhook-configuration
labels:
{{- include "koptan.labels" . | nindent 4 }}
{{- if .Values.certManager.enabled }}
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "koptan.fullname" . }}-serving-cert
{{- end }}
Comment on lines +1 to +11

Copilot AI Apr 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same gating issue as the validating webhook template: MutatingWebhookConfiguration is only rendered when both webhook.enabled and certManager.enabled are true, despite the description implying only CA injection depends on cert-manager. Consider rendering when webhook.enabled is true and conditionally setting either cert-manager.io/inject-ca-from or a user-provided caBundle.

Copilot uses AI. Check for mistakes.
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "koptan.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate-koptan-felukka-sh-v1alpha-goapp
failurePolicy: Fail
name: mgoapp-v1alpha.kb.io
rules:
- apiGroups:
- koptan.felukka.sh
apiVersions:
- v1alpha
operations:
- CREATE
- UPDATE
resources:
- goapps
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "koptan.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate-koptan-felukka-sh-v1alpha-javaapp
failurePolicy: Fail
name: mjavaapp-v1alpha.kb.io
rules:
- apiGroups:
- koptan.felukka.sh
apiVersions:
- v1alpha
operations:
- CREATE
- UPDATE
resources:
- javaapps
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "koptan.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate-koptan-felukka-sh-v1alpha-slipway
failurePolicy: Fail
name: mslipway-v1alpha.kb.io
rules:
- apiGroups:
- koptan.felukka.sh
apiVersions:
- v1alpha
operations:
- CREATE
- UPDATE
resources:
- slipways
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "koptan.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate-koptan-felukka-sh-v1alpha-voyage
failurePolicy: Fail
name: mvoyage-v1alpha.kb.io
rules:
- apiGroups:
- koptan.felukka.sh
apiVersions:
- v1alpha
operations:
- CREATE
- UPDATE
resources:
- voyages
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "koptan.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate-koptan-felukka-sh-v1alpha-dotnetapp
failurePolicy: Fail
name: mdotnetapp-v1alpha.kb.io
rules:
- apiGroups:
- koptan.felukka.sh
apiVersions:
- v1alpha
operations:
- CREATE
- UPDATE
resources:
- dotnetapps
sideEffects: None
{{- end }}
Loading
Loading