Add CA-injector Job for webhook caBundle rotation - #594
Open
shivangi660 wants to merge 1 commit into
Open
shivangi660 wants to merge 1 commit into
shivangi660 wants to merge 1 commit into
Conversation
) certmanager.caBundle is a static value that goes stale when the external CA rotates, for deployments running certmanager.enabled: false with their own TLS cert (e.g. a platform-managed PKI, see temporalio#590/temporalio#593). Adds an opt-in certmanager.caInjector.enabled Helm hook Job (ServiceAccount + ClusterRole scoped to get/patch on just this release's two ValidatingWebhookConfigurations by resourceName + Job) that reads the CA from a Secret and JSON-patches clientConfig.caBundle on both ValidatingWebhookConfigurations at every install/upgrade, so the API server always trusts the currently-live cert regardless of rotation. Off by default; ignored when certmanager.enabled: true.
shivangi660
requested review from
a team,
eniko-dif and
jlegrone
as code owners
September 15, 2026 08:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #591
Summary
certmanager.caBundleis a static value — fine for a one-time cert, but goes stale whenever the external CA rotates, for deployments runningcertmanager.enabled: falsewith their own TLS cert issuance (e.g. a platform-managed PKI; see #590 / #593 for the crash-loop that motivated configurable cert paths in the first place).Adds an opt-in
certmanager.caInjectorHelm post-install/post-upgrade hook Job:ServiceAccount+ClusterRole(scoped toget/patchon just this release's twoValidatingWebhookConfigurations viaresourceNames) +ClusterRoleBinding.Jobrunningbitnami/kubectlthat reads a CA from a mounted Secret (certmanager.caInjector.caSecretName/caSecretKey) and JSON-patchesclientConfig.caBundleon bothValidatingWebhookConfigurations.Runs at every install/upgrade, so the API server's trust always matches whatever cert is currently live — no manual re-sync needed when the CA rotates. Off by default (
certmanager.caInjector.enabled: false); ignored entirely whencertmanager.enabled: true(cert-manager already handles this via its own CA injection annotation).Test plan
helm lint helm/temporal-worker-controllerhelm templatewithcertmanager.caInjector.enabled: truerenders ServiceAccount/ClusterRole/ClusterRoleBinding/Job correctly, scoped to the release's own webhook config names.caInjector.enabled: false, the default) produces zero ca-injector resources — confirmed no change to existing output.values.schema.jsonupdated alongsidevalues.yamlperhack/check-helm-values-schema.sh.