Support external certificate management for webhooks#344
Merged
Conversation
Closed
6c64a4d to
f5681f1
Compare
There was a problem hiding this comment.
Pull request overview
This PR adds support for external certificate management for Grove's webhook server, allowing users to choose between automatic certificate provisioning (default) and external certificate management (e.g., via cert-manager). This provides flexibility for both development/testing environments and production deployments with enterprise PKI requirements.
Changes:
- Added
autoProvisionandsecretNameconfiguration options to toggle between auto-provisioned and external certificates - Added
caBundleHelm value to support custom CA certificates in webhook configurations - Implemented comprehensive e2e tests for certificate management mode transitions
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| operator/internal/controller/cert/cert.go | Modified ManageWebhookCerts to support both auto-provisioned and external certificate modes |
| operator/e2e/utils/k8s_client.go | Exported applyYAMLData function as ApplyYAMLData for use in new tests |
| operator/e2e/tests/cert_management_test.go | Added comprehensive e2e test suite for certificate management round-trip scenarios |
| operator/e2e/setup/helm.go | Added UpgradeHelmChart and UninstallHelmChart functions with timeout support |
| operator/e2e/setup/grove.go | Added UpgradeGrove function for upgrading Grove configuration |
| operator/e2e/dependencies.yaml | Added cert-manager as a test dependency |
| operator/e2e/dependencies.go | Added cert-manager to HelmCharts struct |
| operator/cmd/main.go | Updated main to pass new certificate configuration parameters |
| operator/charts/values.yaml | Added certificate management configuration options and documentation |
| operator/charts/templates/webhook-server-cert-secret.yaml | Made secret creation conditional based on autoProvision setting |
| operator/charts/templates/pcs-validating-webhook-config.yaml | Added support for custom annotations and caBundle |
| operator/charts/templates/pcs-defaulting-webhook-config.yaml | Added support for custom annotations and caBundle |
| operator/charts/templates/deployment.yaml | Made certificate directory and secret name configurable |
| operator/charts/templates/authorizer-webhook-config.yaml | Added support for custom annotations and caBundle |
| operator/charts/templates/_helpers.tpl | Added certificate configuration to config template |
| operator/api/config/v1alpha1/zz_generated.deepcopy.go | Added deep copy support for new AutoProvision field |
| operator/api/config/v1alpha1/types.go | Added SecretName and AutoProvision fields to WebhookServer struct |
| operator/api/config/v1alpha1/defaults.go | Added defaults for new certificate configuration fields |
| docs/user-guide/certificate-management.md | Added comprehensive certificate management documentation |
| docs/installation.md | Added reference to certificate management guide |
| docs/api-reference/operator-api.md | Updated API documentation with new certificate fields |
| .github/workflows/e2e-test.yaml | Added cert_management test to CI workflow |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Ronkahn21
reviewed
Jan 22, 2026
Ronkahn21
reviewed
Jan 22, 2026
Ronkahn21
left a comment
Contributor
There was a problem hiding this comment.
I will complete the review later today
f5681f1 to
df66b3b
Compare
Ronkahn21
reviewed
Jan 26, 2026
renormalize
previously approved these changes
Jan 28, 2026
renormalize
left a comment
Contributor
There was a problem hiding this comment.
thanks! cert-manager and manual cert generation docs are both perfect.
Contributor
Author
|
I've implemented the feedback on reusing clients rather than constructing time for this specific test suite. I don't want to expand scope to refactor this every where right now. But I created an issue to track doing this eventually |
2cb43cf to
0de5671
Compare
renormalize
previously approved these changes
Jan 29, 2026
Ronkahn21
reviewed
Jan 29, 2026
Ronkahn21
left a comment
Contributor
There was a problem hiding this comment.
One last comment, but LGTM
Ronkahn21
previously approved these changes
Jan 29, 2026
e27b936 to
f136dc5
Compare
Signed-off-by: kangclzjc <kangz@nvidia.com>
Signed-off-by: kangclzjc <kangz@nvidia.com>
Signed-off-by: kangclzjc <kangz@nvidia.com>
Signed-off-by: kangclzjc <kangz@nvidia.com>
Signed-off-by: kangclzjc <kangz@nvidia.com>
f136dc5 to
e601d70
Compare
Ronkahn21
approved these changes
Feb 3, 2026
sanjaychatterjee
approved these changes
Feb 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind feature
What this PR does / why we need it:
Note this PR was originally #233. I have taken it over it order to implement PR feedback and get things moving faster.
This PR adds support for external certificate management for Grove's webhook server. Users can now choose between:
Key changes:
autoProvisionconfiguration option (config.server.webhooks.autoProvision) to toggle between auto-provisioned and external certificatessecretNameconfiguration to specify the Kubernetes Secret containing webhook certificateswebhooks.caBundleHelm value to inject a custom CA bundle into webhook configurationsWhich issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
autoProvision: true(default), behavior is unchanged - Grove generates and manages certificates automaticallyautoProvision: false, the operator expects certificates to exist in the specified Secret before startingcaBundlevalue for external CA certificatesDoes this PR introduce a API change?
Additional documentation e.g., enhancement proposals, usage docs, etc.: