Skip to content

Commit 50b9860

Browse files
minmzzhangminmzzhang
committed
feat: Externalize ZTVP charts: cert-manager
Signed-off-by: Min Zhang <minzhang@redhat.com>
1 parent 23282a3 commit 50b9860

14 files changed

Lines changed: 287 additions & 19 deletions

‎.github/linters/.checkov.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,13 @@ directory:
55
skip-path:
66
- tests
77
skip-check:
8-
- CKV_K8S_49 # Minimize wildcard use in Roles and ClusterRoles
9-
- CKV_K8S_155 # Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations
10-
- CKV_K8S_156 # Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests
11-
- CKV_K8S_157 # Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings
12-
- CKV_K8S_158 # Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles
8+
# CKV_K8S_49: Minimize wildcard use in Roles and ClusterRoles
9+
- CKV_K8S_49
10+
# CKV_K8S_155: ClusterRoles for admission webhook configurations
11+
- CKV_K8S_155
12+
# CKV_K8S_156: ClusterRoles to approve CertificateSigningRequests
13+
- CKV_K8S_156
14+
# CKV_K8S_157: Roles/ClusterRoles to bind RoleBindings or ClusterRoleBindings
15+
- CKV_K8S_157
16+
# CKV_K8S_158: Roles/ClusterRoles to escalate Roles or ClusterRoles
17+
- CKV_K8S_158

‎.github/workflows/superlinter.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,5 @@ jobs:
1414
with:
1515
sl_env: |
1616
VALIDATE_BIOME_FORMAT=false
17+
# Exclude Helm chart templates (contain {{ }}; not valid YAML)
18+
FILTER_REGEX_EXCLUDE=.*/templates/.*

‎.github/workflows/update-helm-repo.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
# This invokes the workflow named 'publish-charts' in the umbrella repo
23
# It expects to have a secret called CHARTS_REPOS_TOKEN which contains
34
# the GitHub token that has permissions to invoke workflows and commit code
@@ -23,13 +24,15 @@ permissions:
2324

2425
jobs:
2526
helmlint:
26-
uses: validatedpatterns/helm-charts/.github/workflows/helmlint.yml@69fd10ef9199eecd093fca715ae9765c78750efc # October 6, 2025
27+
# October 6, 2025
28+
uses: validatedpatterns/helm-charts/.github/workflows/helmlint.yml@69fd10ef9199eecd093fca715ae9765c78750efc
2729
permissions:
2830
contents: read
2931

3032
update-helm-repo:
3133
needs: [helmlint]
32-
uses: validatedpatterns/helm-charts/.github/workflows/update-helm-repo.yml@69fd10ef9199eecd093fca715ae9765c78750efc # October 6, 2025
34+
# October 6, 2025
35+
uses: validatedpatterns/helm-charts/.github/workflows/update-helm-repo.yml@69fd10ef9199eecd093fca715ae9765c78750efc
3336
permissions:
3437
contents: read
3538
secrets:

‎.prettierignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Helm template files contain {{ }} and are not plain YAML
2+
templates/
3+
# Keep [ ] for yamllint; Prettier would change to []
4+
values.yaml

‎.yamllint‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
extends: default
2+
ignore:
3+
- templates/
4+
- templates/**
5+
- "**/templates/**"
6+
rules:
7+
document-start: disable
8+
line-length:
9+
max: 80
10+
brackets:
11+
min-spaces-inside: 0
12+
max-spaces-inside: 1

‎Chart.yaml‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,27 @@
1+
---
12
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
3+
name: ocp-certmanager
4+
description: >
5+
A Helm chart to deploy OpenShift cert-manager operator with proper
6+
DNS nameserver configuration.
7+
type: application
8+
# This is the chart version. This version number should be incremented each
9+
# time you make changes to the chart and its templates, including the app
10+
# version. Versions are expected to follow Semantic Versioning (semver.org).
11+
version: 0.2.0
12+
13+
# This is the version number of the application being deployed. This version
14+
# number should be incremented each time you make changes to the application.
15+
# It is recommended to use it with quotes.
16+
appVersion: "1.16.0"
17+
home: https://github.com/validatedpatterns/ocp-certmanager-chart
18+
maintainers:
19+
- name: Validated Patterns Team
20+
email: validatedpatterns@googlegroups.com
21+
icon: https://validatedpatterns.io/images/validated-patterns.png
322
keywords:
4-
- pattern
5-
name: vp-template
6-
version: 0.0.1
23+
- cert-manager
24+
- ssl
25+
- tls
26+
- certificates
27+
- openshift

‎Makefile‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,10 @@ test: helm-lint helm-unittest ## Runs helm lint and unit tests
3636
.PHONY: super-linter
3737
super-linter: ## Runs super linter locally
3838
rm -rf .mypy_cache
39-
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40-
-e VALIDATE_BIOME_FORMAT=false \
41-
-v $(PWD):/tmp/lint:rw,z \
42-
-w /tmp/lint \
43-
ghcr.io/super-linter/super-linter:slim-v8
39+
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40+
-e VALIDATE_BIOME_FORMAT=false \
41+
-e "FILTER_REGEX_EXCLUDE=.*/templates/.*" \
42+
-e VALIDATE_GITHUB_ACTIONS_ZIZMOR=false \
43+
-v $(PWD):/tmp/lint:rw,z \
44+
-w /tmp/lint \
45+
ghcr.io/super-linter/super-linter:slim-v8

‎README.md‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,33 @@
1-
# vp-template
1+
# ocp-certmanager
22

3-
![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square)
3+
![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square)
44

5-
A Helm chart to serve as the Validated Patterns Template
5+
A Helm chart to deploy OpenShift cert-manager operator with proper DNS nameserver configuration.
66

77
This chart is used to serve as the template for Validated Patterns Charts
88

99
## Notable changes
1010

11+
**Homepage:** <https://github.com/validatedpatterns/ocp-certmanager-chart>
12+
13+
## Maintainers
14+
15+
| Name | Email | Url |
16+
| ----------------------- | ------------------------------------ | --- |
17+
| Validated Patterns Team | <validatedpatterns@googlegroups.com> | |
18+
19+
## Values
20+
21+
| Key | Type | Default | Description |
22+
| ----------------------------------- | ------ | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
23+
| certmgrOperator.additionalArgs | list | `[]` | Arguments for the cert-manager controller (optional). Example: `--acme-http01-solver-nameservers=8.8.8.8:53,1.1.1.1:53`, `--v=2`. |
24+
| certmgrOperator.credentialsRequests | list | `[]` | Cloud credentials for cert-manager (optional). Multiple credentials can be set for different providers and used by DNS solvers. |
25+
| certmgrOperator.issuers | list | `[]` | Issuers for cert-manager (optional). Multiple issuers can be set for different challenges. |
26+
| certmgrOperator.nameservers | list | `["8.8.8.8:53","1.1.1.1:53"]` | DNS servers (`ip:port`) for DNS01 challenges. Defaults to 8.8.8.8:53 and 1.1.1.1:53. See [cert-manager DNS01 nameserver docs](https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check). |
27+
| global | string | depends on the individual settings | Dictionary of global settings for this chart. |
28+
| installerType | string | `"argocd"` | |
29+
| operatorChannel | string | `"stable-v1"` | Channel to install cert-manager from (default: `stable-v1`). |
30+
1131
---
1232

1333
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎templates/.keep‎

Whitespace-only changes.

‎templates/_helpers.tpl‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{{- /*
2+
Validations for the acme issuer
3+
*/ -}}
4+
{{- define "acme.validations" -}}
5+
{{- if not .solvers }}
6+
{{- fail "For the acme issuer, you must specify the properties solvers" }}
7+
{{- end }}
8+
{{- end }}
9+
10+
{{- /*
11+
Validations for the credentials-request
12+
*/ -}}
13+
{{- define "credential-request.validations" -}}
14+
{{- if not .secretRef }}
15+
{{- fail "CredentialRequest requires a SecretRef definition" }}
16+
{{- end }}
17+
{{- if not .providerSpec }}
18+
{{- fail "CredentialRequest requires a providerSpec definition" }}
19+
{{- end }}
20+
{{- end }}

0 commit comments

Comments
 (0)