Skip to content

command-cert-manger-issuer v2.6.1: Add priorityClassName to Deployment #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
irby wants to merge 10 commits into
base: release-2.6
Choose a base branch
from
Open

command-cert-manger-issuer v2.6.1: Add priorityClassName to Deployment #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
53856ec
command-cert-manager-issuer 2.6.0: Optional CA, Updated Default Healt…
indrora Jun 3, 2026
0eb6bcc
Add priorityClassName
slammajamma28 Jun 11, 2026
ff50682
remove quote
slammajamma28 Jun 11, 2026
5369f77
Update README
slammajamma28 Jun 29, 2026
8a10d32
chore(AB#89226): add docs on how to contribute to the project
irby Jul 1, 2026
481ff15
chore: update CHANGELOG
irby Jul 1, 2026
bcef427
Merge branch 'release-2.6' into epic/AB#89767/priority-class-name
irby Jul 1, 2026
9724e90
Merge pull request #72 from slammajamma28/priority-class
irby Jul 1, 2026
f83c713
Potential fix for pull request finding
irby Jul 1, 2026
a169931
Potential fix for pull request finding
irby Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
# v2.6.1
## Features
- Added [priorityClassName](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/) as an optional specification on the Deployment resource.
Comment thread
irby marked this conversation as resolved.
## Chores
- Updated the `CONTRIBUTING.md` guide with notes for how external contributors can contribute to this project.

# v2.6.0
## Features
- Allow `certificateAuthorityLogicalName` to be optional when using an enrollment pattern.
Expand Down
30 changes: 21 additions & 9 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,24 @@
# Command Cert Manager Issuer Contribution Guide

## Requirements
- Go (>= 1.24)
## How to contribute

### External Contributors - Submitting a PR

Since external contributors can't create branches directly on our repositories, go ahead and open your PR against `main`. Our team will handle retargeting it to the appropriate release branch as part of our internal review process. You may see your PR retargeted or, in some cases, closed and replaced with an internal PR carrying your commits. In either case, your contribution will be preserved.

### Release cadence

We have an internal review process for every release we make. This process can sometimes take a few days or weeks depending on resourcing.

## Development

### Requirements
- Go (>= 1.26.2)
- golangci-lint (>= 2.4.0) ([installation notes](https://github.com/golangci/golangci-lint?tab=readme-ov-file#install-golangci-lint))
- helm (>= 3.x) — required to render chart templates for manifest linting ([installation notes](https://helm.sh/docs/intro/install/))
- conftest — policy testing tool powered by Open Policy Agent; installed automatically by `make lint-manifests`

## Installing dependencies
### Installing dependencies
Project dependencies can be installed by running the following:

```bash
Expand All @@ -19,14 +31,14 @@ The following command can be used to add missing requirements or remove unused m
go mod tidy
```

## Running unit tests
### Running unit tests
The following command can be run to run the project unit tests:

```bash
go test -v ./...
```

## Running linters
### Running linters
The project uses golangci-lint to lint the codebase. The following command can be run to run the linters:

```bash
Expand All @@ -39,7 +51,7 @@ or, alternatively:
make lint
```

## Updating generated manifests
### Updating generated manifests

This command will update the generated custom resource definitions under `config/crd/bases`:

Expand All @@ -50,7 +62,7 @@ make generate manifests
> [!IMPORTANT]
> There is no automated process to automatically update the CRDs under `deploy/charts/command-cert-manager-issuer`. If any changes are made to the CRDs, the generated CRDs under `config/crd/bases` must be copied to `deploy/charts/command-cert-manager-issuer/crds` to ensure the Helm chart is up to date.

## Linting Helm manifests
### Linting Helm manifests

The Helm chart under `deploy/charts/command-cert-manager-issuer` is linted with two tools on every PR:
- **conftest** — runs custom Rego policies located in the [`policy/`](policy/) directory against the rendered manifests
Expand All @@ -69,13 +81,13 @@ To inspect the rendered templates without linting:
make helm-template
```

### Adding or modifying policies
#### Adding or modifying policies

Rego policies live in [`policy/`](policy/). Each `.rego` file in that directory is evaluated by conftest against every resource in the rendered chart. Add a new `.rego` file to enforce additional rules. For example, `policy/roles.rego` enforces that all `Role` resources declare an explicit namespace.

kube-linter checks can be tuned in [.kube-linter.yaml](.kube-linter.yaml). To exclude a check, add its name under the `exclude` key.

## Running end-to-end tests
### Running end-to-end tests
A comprehensive end-to-end test suite is available to verify the issuer code works against cert-manager and a Keyfactor Command instance.

Instructions on how to run the end-to-end test suite can be found [here](./e2e/README.md).
52 changes: 28 additions & 24 deletions deploy/charts/command-cert-manager-issuer/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,29 +63,33 @@ helm install command-cert-manager-issuer command-issuer/command-cert-manager-iss

The following table lists the configurable parameters of the `command-cert-manager-issuer` chart and their default values.

| Parameter | Description | Default |
|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------|
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
| `image.repository` | Image repository | `ghcr.io/keyfactor/command-cert-manager-issuer` |
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
| `image.tag` | Image tag | `""` |
| `imagePullSecrets` | Image pull secrets | `[]` |
| `nameOverride` | Name override | `""` |
| `fullnameOverride` | Full name override | `""` |
| `crd.create` | Specifies if CRDs will be created | `true` |
| `crd.annotations` | Annotations to add to the CRD | `{}` |
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
| Parameter | Description | Default |
|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------|
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
| `image.repository` | Image repository | `ghcr.io/keyfactor/command-cert-manager-issuer` |
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
| `image.tag` | Image tag | `""` |
| `imagePullSecrets` | Image pull secrets | `[]` |
| `nameOverride` | Name override | `""` |
| `fullnameOverride` | Full name override | `""` |
| `secretConfig.useClusterRoleForSecretAccess` | Specifies if the ServiceAccount should be granted access to the Secret resource using a ClusterRole | `false` |
| `secretConfig.useClusterRoleForConfigMapAccess` | Specifies if the ServiceAccount should be granted access to the ConfigMap resource using a ClusterRole | `false` |
| `crd.create` | Specifies if CRDs will be created | `true` |
| `crd.annotations` | Annotations to add to the CRD | `{}` |
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
| `serviceAccount.labels` | Labels to add to the service account | `{}` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
| `serviceAccount.automountServiceAccountToken` | Controls whether Kubernetes automatically mounts the service account token into the pod. When `false` (default), a projected volume is used instead, giving explicit control over token expiration and file permissions. Setting to `true` uses Kubernetes' default token mount, which has no expiration and is less restrictive — only recommended if the projected volume approach causes compatibility issues. | `false` |
| `serviceAccount.projectedTokenVolume.expirationSeconds` | Lifetime in seconds of the projected service account token. The kubelet will rotate the token before it expires. Only applies when `automountServiceAccountToken` is `false`. | `3607` |
| `serviceAccount.projectedTokenVolume.defaultMode` | File permission bits for the projected token volume. Only applies when `automountServiceAccountToken` is `false`. | `0444` |
| `podAnnotations` | Annotations for the pod | `{}` |
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
| `nodeSelector` | Node labels for pod assignment | `{}` |
| `tolerations` | Tolerations for pod assignment | `[]` |
| `env` | Environmental variables set for pod | `{}` |
| `secretConfig.useClusterRoleForSecretAccess` | Specifies if the ServiceAccount should be granted access to the Secret resource using a ClusterRole | `false` |
| `defaultHealthCheckInterval` | Specifies the default health check interval for issuers | `""` (uses the default in the code which is 10 minutes) |
| `serviceAccount.projectedTokenVolume.defaultMode` | File permission bits for the projected token volume. Only applies when `automountServiceAccountToken` is `false`. | `0444` |
| `podLabels` | Labels for the pod | `{}` |
| `podAnnotations` | Annotations for the pod | `{}` |
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
| `nodeSelector` | Node labels for pod assignment | `{}` |
| `tolerations` | Tolerations for pod assignment | `[]` |
| `priorityClassName` | Priority class to set for pod | `""` |
| `defaultHealthCheckInterval` | Specifies the default health check interval for issuers | `""` (uses the default in the code which is 10 minutes)|
| `env` | Environmental variables set for pod | `{}` |
3 changes: 3 additions & 0 deletions deploy/charts/command-cert-manager-issuer/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,4 +121,7 @@ spec:
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName | quote }}
{{- end }}
Comment thread
Copilot marked this conversation as resolved.
Comment thread
Copilot marked this conversation as resolved.
terminationGracePeriodSeconds: 10
2 changes: 2 additions & 0 deletions deploy/charts/command-cert-manager-issuer/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,8 @@ nodeSelector: {}

tolerations: []

priorityClassName: ""

defaultHealthCheckInterval: ""

env: {}
Expand Down
Loading