feat: custom/shared issuer support - #313
Open
rbekhtaoui wants to merge 7 commits into
Open
rbekhtaoui wants to merge 7 commits into
rbekhtaoui wants to merge 7 commits into
Conversation
rbekhtaoui
force-pushed
the
rb/helm-cert-manager-issuer
branch
from
September 11, 2026 12:14
faca823 to
5956b00
Compare
rbekhtaoui
force-pushed
the
rb/helm-cert-manager-issuer
branch
from
September 11, 2026 12:19
5956b00 to
fef89f5
Compare
rbekhtaoui
force-pushed
the
rb/helm-cert-manager-issuer
branch
from
September 11, 2026 15:18
d9517c8 to
e3775eb
Compare
lemaitre-aneo
left a comment
lemaitre-aneo
left a comment
Contributor
There was a problem hiding this comment.
mTLS could use the internal issuer if no CA is provided.
Also, I think there could be some refactor to mutualize the implementations of the certs.
Comment on lines
+63
to
+65
| name: {{ list $certManager "existingIssuer" "name" | include "armonik.utils.index" }} | ||
| kind: {{ list $certManager "existingIssuer" "kind" | include "armonik.utils.index" | default "Issuer" }} | ||
| group: {{ list $certManager "existingIssuer" "group" | include "armonik.utils.index" | default "cert-manager.io" }} |
Contributor
There was a problem hiding this comment.
You could simplify if you set a local variable {{ $issuer := $certManager.existingIssuer | default dict }}
Comment on lines
+52
to
+59
| certManager: | ||
| issuer: | ||
| enabled: false | ||
| create: false | ||
| provider: selfSigned | ||
| name: '{{.Release.Name}}-shared-issuer' | ||
| kind: Issuer | ||
| group: cert-manager.io |
Contributor
There was a problem hiding this comment.
Some of those information should not be in global: Only the information about its presence, the name, the kind and the group are required. The others are only required when deploying armonik umbrella chart itself.
Comment on lines
+110
to
+134
| ############################################ | ||
| ###### CERT-MANAGER ISSUER PROVIDERS ###### | ||
| ############################################ | ||
| googleCas: | ||
| # Required when global.armonik.certManager.issuer.provider=googleCas. | ||
| project: "" | ||
| location: "" | ||
| caPoolId: "" | ||
| certificateAuthorityId: "" | ||
| credentials: | ||
| name: "" | ||
| key: credentials.json | ||
|
|
||
| venafi: | ||
| # Required when global.armonik.certManager.issuer.provider=venafi. | ||
| zone: "" | ||
| tpp: | ||
| url: "" | ||
| credentialsRef: | ||
| name: "" | ||
| caBundle: "" | ||
| cloud: | ||
| apiTokenSecretRef: | ||
| name: "" | ||
| key: apikey |
Contributor
There was a problem hiding this comment.
I think this should be in a issuer configuration. Also, I would say we should just forward issuer config as-is without much tweaking, instead of manually exposing each and every parameters.
Co-authored-by: lemaitre-aneo <91961298+lemaitre-aneo@users.noreply.github.com>
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The main goal was to support a custom/external cert-manager issuer instead of only a self-generated one, so ArmoniK can issue its TLS certificates from an existing company CA (venafi, googleCas).
Description
armonik.certManager.issuerhelper inarmonik-common, used consistently by activemq, redis, ingress and the new mongodb Certificate template.certmanager-issuer.yamlnow supports three providers:selfSigned,venafi,googleCas, with validation guards.google-cas-issueroperator, opt-in viaglobal.armonik.operators.googleCasIssuer.deploy.extraDnsNames/ipAddresses.Testing
[When applicable, detail the testing you have performed to ensure that these changes function as intended. Include information about any added tests.]
Impact
[Discuss the impact of your modifications on ArmoniK. This might include effects on performance, configuration, documentation, new dependencies, or changes in behaviour.]
Additional Information
[Any additional information that reviewers should be aware of.]
Checklist