Skip to content

Commit 5fac9ca

Browse files
TaylorMutchTaylorMutch
committed
feat(helm): restore cert-manager PKI support alongside pkiInitJob
Re-add the openshell.issuerSelfSigned helper, the mutual-exclusion guard in pki-hook.yaml, and the certManager condition in the statefulset volume mount. Add server.disableTls: false to values-cert-manager.yaml so the overlay correctly overrides the skaffold dev default. Tested end-to-end with cert-manager issuing mTLS certs and sandbox create over port-forward.
1 parent 2d524d6 commit 5fac9ca

9 files changed

Lines changed: 160 additions & 2 deletions

File tree

‎.agents/skills/helm-dev-environment/SKILL.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ mise run helm:skaffold:run
5757
```
5858

5959
Both commands build the `gateway` and `supervisor` images and deploy the OpenShell Helm
60-
chart. The `pkiInitJob` hook runs on first install to generate mTLS secrets. Envoy Gateway is opt-in; see the Optional Add-ons section below.
60+
chart. The `pkiInitJob` hook runs on first install to generate mTLS secrets. Envoy Gateway opt-in; see the Optional Add-ons section below.
6161

6262
The gateway Service uses ClusterIP. Access is via Envoy Gateway (port `8080`) or `kubectl port-forward`.
6363

@@ -189,6 +189,7 @@ mise run helm:k3s:status
189189
| `deploy/helm/openshell/skaffold.yaml` | Skaffold config — images, Helm releases, values overlays |
190190
| `deploy/helm/openshell/values.yaml` | Default Helm values |
191191
| `deploy/helm/openshell/values-skaffold.yaml` | Dev overrides (image pull policy, local image names) |
192+
| `deploy/helm/openshell/values-cert-manager.yaml` | cert-manager TLS overlay (opt-in; disables pkiInitJob) |
192193
| `deploy/helm/openshell/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
193194
| `deploy/helm/openshell/values-keycloak.yaml` | Keycloak OIDC overlay |
194195
| `deploy/kube/manifests/envoy-gateway-openshell.yaml` | GatewayClass for Envoy Gateway (`mise run helm:gateway:apply`) |

‎deploy/helm/openshell/.helmignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,5 @@ skaffold.yaml
2222
values-keycloak.yaml
2323
values-ingress.yaml
2424
values-gateway.yaml
25+
values-cert-manager.yaml
2526
values-skaffold.yaml

‎deploy/helm/openshell/skaffold.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,17 @@ build:
5959
deploy:
6060
helm:
6161
releases:
62+
# cert-manager — comment this in and add values-cert-manager.yaml below
63+
# when you want cert-manager to manage the PKI instead of pkiInitJob.
64+
# Requires cert-manager CRDs to be installed in the cluster first.
65+
#- name: cert-manager
66+
# repo: https://charts.jetstack.io
67+
# remoteChart: cert-manager
68+
# version: v1.20.2
69+
# namespace: cert-manager
70+
# createNamespace: true
71+
# setValues:
72+
# crds.enabled: true
6273
# Envoy Gateway — Kubernetes Gateway API implementation.
6374
# Installs the Gateway API CRDs and the "eg" GatewayClass.
6475
# Required when grpcRoute.enabled is true in the openshell release.
@@ -77,6 +88,9 @@ deploy:
7788
valuesFiles:
7889
- values.yaml
7990
- values-skaffold.yaml
91+
# Add values-cert-manager.yaml here (and uncomment the cert-manager
92+
# release above) to switch from pkiInitJob to cert-manager for PKI.
93+
#- values-cert-manager.yaml
8094
# To enable OIDC with a local Keycloak instance, run the one-time
8195
# setup task first, then uncomment the line below:
8296
# mise run keycloak:k8s:setup

‎deploy/helm/openshell/templates/_helpers.tpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,9 @@ the supervisor and gateway images stay in sync across releases.
7575
{{- printf "%s:%s" .Values.supervisor.image.repository (.Values.supervisor.image.tag | default .Chart.AppVersion) }}
7676
{{- end }}
7777

78+
{{/*
79+
Namespaced Issuer (selfSigned) for cert-manager CA bootstrap.
80+
*/}}
81+
{{- define "openshell.issuerSelfSigned" -}}
82+
{{- printf "%s-selfsigned" (include "openshell.fullname" .) | trunc 63 | trimSuffix "-" }}
83+
{{- end }}

‎deploy/helm/openshell/templates/cert-manager-pki.yaml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
{{- if .Values.certManager.enabled }}
5+
apiVersion: cert-manager.io/v1
6+
kind: Issuer
7+
metadata:
8+
name: {{ include "openshell.issuerSelfSigned" . }}
9+
namespace: {{ .Release.Namespace }}
10+
labels:
11+
{{- include "openshell.labels" . | nindent 4 }}
12+
spec:
13+
selfSigned: {}
14+
---
15+
apiVersion: cert-manager.io/v1
16+
kind: Certificate
17+
metadata:
18+
name: {{ include "openshell.fullname" . }}-ca
19+
namespace: {{ .Release.Namespace }}
20+
labels:
21+
{{- include "openshell.labels" . | nindent 4 }}
22+
spec:
23+
isCA: true
24+
commonName: openshell-ca
25+
secretName: {{ .Values.certManager.caSecretName | quote }}
26+
privateKey:
27+
algorithm: ECDSA
28+
size: 256
29+
issuerRef:
30+
name: {{ include "openshell.issuerSelfSigned" . }}
31+
kind: Issuer
32+
group: cert-manager.io
33+
---
34+
apiVersion: cert-manager.io/v1
35+
kind: Issuer
36+
metadata:
37+
name: {{ include "openshell.fullname" . }}-ca-issuer
38+
namespace: {{ .Release.Namespace }}
39+
labels:
40+
{{- include "openshell.labels" . | nindent 4 }}
41+
spec:
42+
ca:
43+
secretName: {{ .Values.certManager.caSecretName | quote }}
44+
---
45+
apiVersion: cert-manager.io/v1
46+
kind: Certificate
47+
metadata:
48+
name: {{ include "openshell.fullname" . }}-server
49+
namespace: {{ .Release.Namespace }}
50+
labels:
51+
{{- include "openshell.labels" . | nindent 4 }}
52+
spec:
53+
secretName: {{ .Values.server.tls.certSecretName | quote }}
54+
duration: {{ .Values.certManager.certificateDuration | quote }}
55+
renewBefore: {{ .Values.certManager.certificateRenewBefore | quote }}
56+
commonName: openshell-server
57+
dnsNames:
58+
{{- toYaml .Values.certManager.serverDnsNames | nindent 4 }}
59+
{{- if .Values.certManager.serverIpAddresses }}
60+
ipAddresses:
61+
{{- toYaml .Values.certManager.serverIpAddresses | nindent 4 }}
62+
{{- end }}
63+
privateKey:
64+
algorithm: ECDSA
65+
size: 256
66+
usages:
67+
- server auth
68+
- digital signature
69+
- key encipherment
70+
issuerRef:
71+
name: {{ include "openshell.fullname" . }}-ca-issuer
72+
kind: Issuer
73+
group: cert-manager.io
74+
---
75+
apiVersion: cert-manager.io/v1
76+
kind: Certificate
77+
metadata:
78+
name: {{ include "openshell.fullname" . }}-client
79+
namespace: {{ .Release.Namespace }}
80+
labels:
81+
{{- include "openshell.labels" . | nindent 4 }}
82+
spec:
83+
secretName: {{ .Values.server.tls.clientTlsSecretName | quote }}
84+
duration: {{ .Values.certManager.certificateDuration | quote }}
85+
renewBefore: {{ .Values.certManager.certificateRenewBefore | quote }}
86+
commonName: openshell-client
87+
privateKey:
88+
algorithm: ECDSA
89+
size: 256
90+
usages:
91+
- client auth
92+
- digital signature
93+
- key encipherment
94+
issuerRef:
95+
name: {{ include "openshell.fullname" . }}-ca-issuer
96+
kind: Issuer
97+
group: cert-manager.io
98+
{{- end }}

‎deploy/helm/openshell/templates/pki-hook.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4+
{{- if and .Values.pkiInitJob.enabled .Values.certManager.enabled }}
5+
{{- fail "pkiInitJob.enabled and certManager.enabled cannot both be true; disable one to avoid conflicting PKI sources." }}
6+
{{- end }}
47
{{- if .Values.pkiInitJob.enabled }}
58
{{- $hookName := printf "%s-pki-hook" (include "openshell.fullname" .) }}
69
{{- $ns := .Release.Namespace }}

‎deploy/helm/openshell/templates/statefulset.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ spec:
191191
secretName: {{ .Values.server.tls.certSecretName }}
192192
- name: tls-client-ca
193193
secret:
194-
{{- if .Values.pkiInitJob.enabled }}
194+
{{- if or .Values.pkiInitJob.enabled (and .Values.certManager.enabled .Values.certManager.clientCaFromServerTlsSecret) }}
195195
secretName: {{ .Values.server.tls.certSecretName }}
196196
items:
197197
- key: ca.crt

‎deploy/helm/openshell/values-cert-manager.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# Merge after values.yaml when cert-manager CRDs are installed, e.g.:
5+
# helm install ... -f values.yaml -f values-cert-manager.yaml
6+
# Or add this file to skaffold manifests.helm.releases[].valuesFiles.
7+
server:
8+
disableTls: false
9+
10+
pkiInitJob:
11+
enabled: false
12+
13+
certManager:
14+
enabled: true

‎deploy/helm/openshell/values.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,27 @@ pkiInitJob:
181181
serverIpAddresses:
182182
- 127.0.0.1
183183

184+
# cert-manager Certificate/Issuer resources (requires cert-manager CRDs in-cluster).
185+
# Uses namespaced Issuers only (no ClusterIssuer). Does not install cert-manager itself.
186+
certManager:
187+
enabled: false
188+
# Secret created for the intermediate CA (Certificate with isCA: true).
189+
caSecretName: openshell-ca-tls
190+
# Mount gateway client CA from the server TLS secret's ca.crt (populated by
191+
# cert-manager for certs issued by a CA Issuer). Avoids a separate
192+
# openshell-server-client-ca Secret.
193+
clientCaFromServerTlsSecret: true
194+
certificateDuration: 8760h
195+
certificateRenewBefore: 720h
196+
serverDnsNames:
197+
- openshell
198+
- openshell.openshell.svc
199+
- openshell.openshell.svc.cluster.local
200+
- localhost
201+
- host.docker.internal
202+
serverIpAddresses:
203+
- 127.0.0.1
204+
184205
# Kubernetes Gateway API — HTTPRoute and Gateway resources.
185206
# Requires a Gateway API controller in the cluster. Install Envoy Gateway via
186207
# the skaffold.yaml releases or independently:

0 commit comments

Comments
 (0)