Skip to content

Commit a324138

Browse files
irbyirby
authored
Merge 9724e90 into 9b31520 
2 parents 9b31520 + 9724e90 commit a324138

5 files changed

Lines changed: 59 additions & 32 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
# v2.6.1
2+
## Features
3+
- Added [priorityClassName](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/) as an optional specification on the Deployment resource.
4+
## Chores
5+
- Updated the `CONTRIBUTING.md` guide with notes for how external contributors can contribute to this project.
6+
17
# v2.6.0
28
## Features
39
- Allow `certificateAuthorityLogicalName` to be optional when using an enrollment pattern.

‎CONTRIBUTING.md‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,24 @@
11
# Command Cert Manager Issuer Contribution Guide
22

3-
## Requirements
3+
## How to contribute
4+
5+
### External Contributors - Submitting a PR
6+
7+
Since external contributors can't create branches directly on our repositories, go ahead and open your PR against `main`. Our team will handle retargeting it to the appropriate release branch as part of our internal review process. You may see your PR retargeted or, in some cases, closed and replaced with an internal PR carrying your commits. In either case, your contribution will be preserved.
8+
9+
### Release cadence
10+
11+
We have an internal review process for every release we make. This process can sometimes take a few days or weeks depending on resourcing.
12+
13+
## Development
14+
15+
### Requirements
416
- Go (>= 1.24)
517
- golangci-lint (>= 2.4.0) ([installation notes](https://github.com/golangci/golangci-lint?tab=readme-ov-file#install-golangci-lint))
618
- helm (>= 3.x) — required to render chart templates for manifest linting ([installation notes](https://helm.sh/docs/intro/install/))
719
- conftest — policy testing tool powered by Open Policy Agent; installed automatically by `make lint-manifests`
820

9-
## Installing dependencies
21+
### Installing dependencies
1022
Project dependencies can be installed by running the following:
1123

1224
```bash
@@ -19,14 +31,14 @@ The following command can be used to add missing requirements or remove unused m
1931
go mod tidy
2032
```
2133

22-
## Running unit tests
34+
### Running unit tests
2335
The following command can be run to run the project unit tests:
2436

2537
```bash
2638
go test -v ./...
2739
```
2840

29-
## Running linters
41+
### Running linters
3042
The project uses golangci-lint to lint the codebase. The following command can be run to run the linters:
3143

3244
```bash
@@ -39,7 +51,7 @@ or, alternatively:
3951
make lint
4052
```
4153

42-
## Updating generated manifests
54+
### Updating generated manifests
4355

4456
This command will update the generated custom resource definitions under `config/crd/bases`:
4557

@@ -50,7 +62,7 @@ make generate manifests
5062
> [!IMPORTANT]
5163
> There is no automated process to automatically update the CRDs under `deploy/charts/command-cert-manager-issuer`. If any changes are made to the CRDs, the generated CRDs under `config/crd/bases` must be copied to `deploy/charts/command-cert-manager-issuer/crds` to ensure the Helm chart is up to date.
5264
53-
## Linting Helm manifests
65+
### Linting Helm manifests
5466

5567
The Helm chart under `deploy/charts/command-cert-manager-issuer` is linted with two tools on every PR:
5668
- **conftest** — runs custom Rego policies located in the [`policy/`](policy/) directory against the rendered manifests
@@ -69,13 +81,13 @@ To inspect the rendered templates without linting:
6981
make helm-template
7082
```
7183

72-
### Adding or modifying policies
84+
#### Adding or modifying policies
7385

7486
Rego policies live in [`policy/`](policy/). Each `.rego` file in that directory is evaluated by conftest against every resource in the rendered chart. Add a new `.rego` file to enforce additional rules. For example, `policy/roles.rego` enforces that all `Role` resources declare an explicit namespace.
7587

7688
kube-linter checks can be tuned in [.kube-linter.yaml](.kube-linter.yaml). To exclude a check, add its name under the `exclude` key.
7789

78-
## Running end-to-end tests
90+
### Running end-to-end tests
7991
A comprehensive end-to-end test suite is available to verify the issuer code works against cert-manager and a Keyfactor Command instance.
8092

8193
Instructions on how to run the end-to-end test suite can be found [here](./e2e/README.md).

‎deploy/charts/command-cert-manager-issuer/README.md‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -63,29 +63,33 @@ helm install command-cert-manager-issuer command-issuer/command-cert-manager-iss
6363

6464
The following table lists the configurable parameters of the `command-cert-manager-issuer` chart and their default values.
6565

66-
| Parameter | Description | Default |
67-
|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------|
68-
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
69-
| `image.repository` | Image repository | `ghcr.io/keyfactor/command-cert-manager-issuer` |
70-
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
71-
| `image.tag` | Image tag | `""` |
72-
| `imagePullSecrets` | Image pull secrets | `[]` |
73-
| `nameOverride` | Name override | `""` |
74-
| `fullnameOverride` | Full name override | `""` |
75-
| `crd.create` | Specifies if CRDs will be created | `true` |
76-
| `crd.annotations` | Annotations to add to the CRD | `{}` |
77-
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
78-
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
79-
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
66+
| Parameter | Description | Default |
67+
|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------|
68+
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
69+
| `image.repository` | Image repository | `ghcr.io/keyfactor/command-cert-manager-issuer` |
70+
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
71+
| `image.tag` | Image tag | `""` |
72+
| `imagePullSecrets` | Image pull secrets | `[]` |
73+
| `nameOverride` | Name override | `""` |
74+
| `fullnameOverride` | Full name override | `""` |
75+
| `secretConfig.useClusterRoleForSecretAccess` | Specifies if the ServiceAccount should be granted access to the Secret resource using a ClusterRole | `false` |
76+
| `secretConfig.useClusterRoleForConfigMapAccess` | Specifies if the ServiceAccount should be granted access to the ConfigMap resource using a ClusterRole | `false` |
77+
| `crd.create` | Specifies if CRDs will be created | `true` |
78+
| `crd.annotations` | Annotations to add to the CRD | `{}` |
79+
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
80+
| `serviceAccount.labels` | Labels to add to the service account | `{}` |
81+
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
82+
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
8083
| `serviceAccount.automountServiceAccountToken` | Controls whether Kubernetes automatically mounts the service account token into the pod. When `false` (default), a projected volume is used instead, giving explicit control over token expiration and file permissions. Setting to `true` uses Kubernetes' default token mount, which has no expiration and is less restrictive — only recommended if the projected volume approach causes compatibility issues. | `false` |
8184
| `serviceAccount.projectedTokenVolume.expirationSeconds` | Lifetime in seconds of the projected service account token. The kubelet will rotate the token before it expires. Only applies when `automountServiceAccountToken` is `false`. | `3607` |
82-
| `serviceAccount.projectedTokenVolume.defaultMode` | File permission bits for the projected token volume. Only applies when `automountServiceAccountToken` is `false`. | `0444` |
83-
| `podAnnotations` | Annotations for the pod | `{}` |
84-
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
85-
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
86-
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
87-
| `nodeSelector` | Node labels for pod assignment | `{}` |
88-
| `tolerations` | Tolerations for pod assignment | `[]` |
89-
| `env` | Environmental variables set for pod | `{}` |
90-
| `secretConfig.useClusterRoleForSecretAccess` | Specifies if the ServiceAccount should be granted access to the Secret resource using a ClusterRole | `false` |
91-
| `defaultHealthCheckInterval` | Specifies the default health check interval for issuers | `""` (uses the default in the code which is 10 minutes) |
85+
| `serviceAccount.projectedTokenVolume.defaultMode` | File permission bits for the projected token volume. Only applies when `automountServiceAccountToken` is `false`. | `0444` |
86+
| `podLabels` | Labels for the pod | `{}` |
87+
| `podAnnotations` | Annotations for the pod | `{}` |
88+
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
89+
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
90+
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
91+
| `nodeSelector` | Node labels for pod assignment | `{}` |
92+
| `tolerations` | Tolerations for pod assignment | `[]` |
93+
| `priorityClassName` | Priority class to set for pod | `""` |
94+
| `defaultHealthCheckInterval` | Specifies the default health check interval for issuers | `""` (uses the default in the code which is 10 minutes)|
95+
| `env` | Environmental variables set for pod | `{}` |

‎deploy/charts/command-cert-manager-issuer/templates/deployment.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,4 +121,7 @@ spec:
121121
tolerations:
122122
{{- toYaml . | nindent 8 }}
123123
{{- end }}
124+
{{- if .Values.priorityClassName }}
125+
priorityClassName: {{ .Values.priorityClassName }}
126+
{{- end }}
124127
terminationGracePeriodSeconds: 10

‎deploy/charts/command-cert-manager-issuer/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ nodeSelector: {}
8989

9090
tolerations: []
9191

92+
priorityClassName: ""
93+
9294
defaultHealthCheckInterval: ""
9395

9496
env: {}

0 commit comments

Comments
 (0)