rh-mobb · foster-rh · Mar 19, 2026 · Mar 19, 2026
diff --git a/charts/aws-privateca-issuer/.helmignore → archive/aws-privateca-issuer/.helmignore b/charts/aws-privateca-issuer/.helmignore → archive/aws-privateca-issuer/.helmignore
diff --git a/charts/aws-privateca-issuer/Chart.yaml → archive/aws-privateca-issuer/Chart.yaml b/charts/aws-privateca-issuer/Chart.yaml → archive/aws-privateca-issuer/Chart.yaml
diff --git a/charts/aws-privateca-issuer/README.md → archive/aws-privateca-issuer/README.md b/charts/aws-privateca-issuer/README.md → archive/aws-privateca-issuer/README.md
diff --git a/...cert-manager.io_awspcaclusterissuers.yaml → ...cert-manager.io_awspcaclusterissuers.yaml b/...cert-manager.io_awspcaclusterissuers.yaml → ...cert-manager.io_awspcaclusterissuers.yaml
diff --git a/...awspca.cert-manager.io_awspcaissuers.yaml → ...awspca.cert-manager.io_awspcaissuers.yaml b/...awspca.cert-manager.io_awspcaissuers.yaml → ...awspca.cert-manager.io_awspcaissuers.yaml
diff --git a/...s-privateca-issuer/templates/_helpers.tpl → ...s-privateca-issuer/templates/_helpers.tpl b/...s-privateca-issuer/templates/_helpers.tpl → ...s-privateca-issuer/templates/_helpers.tpl
diff --git a/...rivateca-issuer/templates/deployment.yaml → ...rivateca-issuer/templates/deployment.yaml b/...rivateca-issuer/templates/deployment.yaml → ...rivateca-issuer/templates/deployment.yaml
diff --git a/...privateca-issuer/templates/namespace.yaml → ...privateca-issuer/templates/namespace.yaml b/...privateca-issuer/templates/namespace.yaml → ...privateca-issuer/templates/namespace.yaml
diff --git a/...plates/operator-install-job-pre-hook.yaml → ...plates/operator-install-job-pre-hook.yaml b/...plates/operator-install-job-pre-hook.yaml → ...plates/operator-install-job-pre-hook.yaml
diff --git a/...ateca-issuer/templates/operatorgroup.yaml → ...ateca-issuer/templates/operatorgroup.yaml b/...ateca-issuer/templates/operatorgroup.yaml → ...ateca-issuer/templates/operatorgroup.yaml
diff --git a/...ca-issuer/templates/pcaclusterissuer.yaml → ...ca-issuer/templates/pcaclusterissuer.yaml b/...ca-issuer/templates/pcaclusterissuer.yaml → ...ca-issuer/templates/pcaclusterissuer.yaml
diff --git a/.../aws-privateca-issuer/templates/rbac.yaml → .../aws-privateca-issuer/templates/rbac.yaml b/.../aws-privateca-issuer/templates/rbac.yaml → .../aws-privateca-issuer/templates/rbac.yaml
diff --git a/...eca-issuer/templates/service-monitor.yaml → ...eca-issuer/templates/service-monitor.yaml b/...eca-issuer/templates/service-monitor.yaml → ...eca-issuer/templates/service-monitor.yaml
diff --git a/...s-privateca-issuer/templates/service.yaml → ...s-privateca-issuer/templates/service.yaml b/...s-privateca-issuer/templates/service.yaml → ...s-privateca-issuer/templates/service.yaml
diff --git a/...vateca-issuer/templates/subscription.yaml → ...vateca-issuer/templates/subscription.yaml b/...vateca-issuer/templates/subscription.yaml → ...vateca-issuer/templates/subscription.yaml
diff --git a/charts/aws-privateca-issuer/values.yaml → archive/aws-privateca-issuer/values.yaml b/charts/aws-privateca-issuer/values.yaml → archive/aws-privateca-issuer/values.yaml
diff --git a/charts/external-secrets-operator/Chart.yaml b/charts/external-secrets-operator/Chart.yaml
@@ -1,8 +1,13 @@
 apiVersion: v2
 name: external-secrets-operator
 description: External Secrets Operator with AWS Secrets Manager integration via IRSA
-version: 1.0.0
+version: 1.0.1
 type: application
 home: https://rh-mobb.github.io/validated-pattern-helm-charts/
 maintainers:
   - name: rh-mobb
+dependencies:
+  - name: helper-status-checker
+    version: 4.4.3
+    repository: https://rosa-hcp-dedicated-vpc.github.io/helm-repository/
+    condition: helper-status-checker.enabled
diff --git a/charts/external-secrets-operator/values.yaml b/charts/external-secrets-operator/values.yaml
@@ -21,3 +21,14 @@ target:
   namespace: istio-system
   secretName: aws-credentials
   refreshInterval: 1h
+
+helper-status-checker:
+  enabled: true
+  approver: true
+  checks:
+    - operatorName: external-secrets-operator
+      subscriptionName: external-secrets-operator
+      namespace:
+        name: external-secrets
+      serviceAccount:
+        name: "external-secrets-install-check"
diff --git a/charts/letsencrypt-clusterissuer/Chart.yaml b/charts/letsencrypt-clusterissuer/Chart.yaml
@@ -1,8 +1,13 @@
 apiVersion: v2
 name: letsencrypt-clusterissuer
-description: Let's Encrypt ACME ClusterIssuer with DNS-01 Route 53 solver (uses IRSA, no static credentials)
-version: 1.0.0
+description: Installs cert-manager operator and creates a Let's Encrypt ACME ClusterIssuer with DNS-01 Route 53 solver (uses IRSA, no static credentials)
+version: 1.0.1
 type: application
 home: https://rh-mobb.github.io/validated-pattern-helm-charts/
 maintainers:
   - name: rh-mobb
+dependencies:
+  - name: helper-status-checker
+    version: 4.4.3
+    repository: https://rosa-hcp-dedicated-vpc.github.io/helm-repository/
+    condition: helper-status-checker.enabled
diff --git a/charts/letsencrypt-clusterissuer/templates/certmanager.yaml b/charts/letsencrypt-clusterissuer/templates/certmanager.yaml
@@ -0,0 +1,14 @@
+apiVersion: operator.openshift.io/v1alpha1
+kind: CertManager
+metadata:
+  name: cluster
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  managementState: Managed
+  {{- if .Values.certManager.overrideArgs }}
+  controllerConfig:
+    overrideArgs:
+      {{- toYaml .Values.certManager.overrideArgs | nindent 6 }}
+  {{- end }}
diff --git a/charts/letsencrypt-clusterissuer/templates/namespace.yaml b/charts/letsencrypt-clusterissuer/templates/namespace.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app: cert-manager
+  name: cert-manager
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager-operator
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
diff --git a/charts/letsencrypt-clusterissuer/templates/operatorgroup.yaml b/charts/letsencrypt-clusterissuer/templates/operatorgroup.yaml
@@ -0,0 +1,7 @@
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: cert-manager-operator
+  namespace: cert-manager-operator
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
diff --git a/charts/letsencrypt-clusterissuer/templates/subscription.yaml b/charts/letsencrypt-clusterissuer/templates/subscription.yaml
@@ -0,0 +1,22 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: {{ .Values.subscription.name }}
+  namespace: cert-manager-operator
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  channel: {{ .Values.subscription.channel }}
+  {{- if .Values.certManagerRole }}
+  config:
+    env:
+      - name: ROLEARN
+        value: {{ .Values.certManagerRole }}
+  {{- end }}
+  installPlanApproval: {{ .Values.subscription.installPlanApproval }}
+  name: {{ .Values.subscription.name }}
+  source: {{ .Values.subscription.source }}
+  sourceNamespace: {{ .Values.subscription.sourceNamespace }}
+  {{- if .Values.subscription.startingCSV }}
+  startingCSV: {{ .Values.subscription.startingCSV }}
+  {{- end }}
diff --git a/charts/letsencrypt-clusterissuer/values.yaml b/charts/letsencrypt-clusterissuer/values.yaml
@@ -7,3 +7,29 @@ acme:
 route53:
   hostedZoneID: ""
   region: ap-southeast-4
+
+subscription:
+  name: openshift-cert-manager-operator
+  channel: stable-v1
+  installPlanApproval: Manual
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+  startingCSV: ""
+
+certManagerRole: ""
+
+certManager:
+  overrideArgs:
+    - "--dns01-recursive-nameservers-only"
+    - "--dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53"
+
+helper-status-checker:
+  enabled: true
+  approver: true
+  checks:
+    - operatorName: openshift-cert-manager-operator
+      subscriptionName: openshift-cert-manager-operator
+      namespace:
+        name: cert-manager-operator
+      serviceAccount:
+        name: "cert-manager-install-check"