Add global.nodeSelector to helm chart by StingRayZA · Pull Request #7818 · cert-manager/cert-manager

StingRayZA · 2025-06-18T12:06:54Z

Adds a global.nodeSelector option to be able to set nodeSelector for all services in a single location. This is overridable at an individual service level as before.

Pull Request Motivation

Resolves issue #7817

Kind

/kind feature

Release Note

Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services.

cert-manager-prow · 2025-06-18T12:07:05Z

Hi @StingRayZA. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

deploy/charts/cert-manager/templates/cainjector-deployment.yaml

Adds a global.nodeSelector option to be able to set nodeSelector for all services in a single location. This is overridable at an individual service level as before. Signed-off-by: Raimund Hook <rhook@gitlab.com>

erikgb

/ok-to-test

hawksight

From a helm change perspective this looks good to me, thanks for taking the time to contribute it. Don't think i can lgtm or approve it, so still need maintainers to review.

erikgb

/lgtm
/approve

This looks like a valuable addition. I might need it myself. 😉 🚀

cert-manager-prow · 2025-07-01T11:42:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb, hawksight

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.18.2` -> `v1.19.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.19.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.0) [Compare Source](cert-manager/cert-manager@v1.18.2...v1.19.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues. > 📖 Read the full release notes at cert-manager.io: <https://cert-manager.io/docs/releases/release-notes/release-notes-1.19> Changes since `v1.18.0`: #### Feature - Add IPv6 rules to the default network policy ([#7726](cert-manager/cert-manager#7726), [@jcpunk](https://github.com/jcpunk)) - Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#7818](cert-manager/cert-manager#7818), [@StingRayZA](https://github.com/StingRayZA)) - Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#7795](cert-manager/cert-manager#7795), [@sspreitzer](https://github.com/sspreitzer)) - Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#7866](cert-manager/cert-manager#7866), [@erikgb](https://github.com/erikgb)) - Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#7414](cert-manager/cert-manager#7414), [@erikgb](https://github.com/erikgb)) - Added `certmanager_certificate_challenge_status` Prometheus metric. ([#7736](cert-manager/cert-manager#7736), [@hjoshi123](https://github.com/hjoshi123)) - Added `protocol` field for `rfc2136` DNS01 provider ([#7881](cert-manager/cert-manager#7881), [@hjoshi123](https://github.com/hjoshi123)) - Added experimental field `hostUsers` flag to all pods. Not set by default. ([#7973](cert-manager/cert-manager#7973), [@hjoshi123](https://github.com/hjoshi123)) - Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#7972](cert-manager/cert-manager#7972), [@lunarwhite](https://github.com/lunarwhite)) - The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#8017](cert-manager/cert-manager#8017), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#8072](cert-manager/cert-manager#8072), [@prasad89](https://github.com/prasad89)) - Updated `certificate` metrics to the collector approach. ([#7856](cert-manager/cert-manager#7856), [@hjoshi123](https://github.com/hjoshi123)) #### Bug or Regression - ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#7796](cert-manager/cert-manager#7796), [@hjoshi123](https://github.com/hjoshi123)) - BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#7816](cert-manager/cert-manager#7816), [@kinolaev](https://github.com/kinolaev)) - Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#8021](cert-manager/cert-manager#8021), [@lunarwhite](https://github.com/lunarwhite)) - Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#7961](cert-manager/cert-manager#7961), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#7836](cert-manager/cert-manager#7836), [@inteon](https://github.com/inteon)) - This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#8109](cert-manager/cert-manager#8109), [@mladen-rusev-cyberark](https://github.com/mladen-rusev-cyberark)) - Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#7792](cert-manager/cert-manager#7792), [@wallrj](https://github.com/wallrj)) #### Other (Cleanup or Flake) - Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#7761](cert-manager/cert-manager#7761), [@lunarwhite](https://github.com/lunarwhite)) - Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#7928](cert-manager/cert-manager#7928), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#8003](cert-manager/cert-manager#8003), [@hjoshi123](https://github.com/hjoshi123)) - Update kind images to include the Kubernetes 1.33 node image ([#7786](cert-manager/cert-manager#7786), [@wallrj](https://github.com/wallrj)) - Use `maps.Copy` for cleaner map handling ([#8092](cert-manager/cert-manager#8092), [@quantpoet](https://github.com/quantpoet)) - Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#8059](cert-manager/cert-manager#8059), [@armagankaratosun](https://github.com/armagankaratosun)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1711 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

wallrj-cyberark · 2025-10-15T15:49:55Z

@StingRayZA We have released this. Please test and feedback: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.1

StingRayZA · 2025-10-20T14:26:15Z

Please test and feedback: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.1

Hey @wallrj-cyberark
I've given this a test, and it's not actually working as well as I'd hoped 😭 . It seems coalesce will only choose the 'global' if there isn't a local value set - and I'm getting .nodeSelector.kubernetes.io/os: linux getting set somewhere in the chain.

The end result is that having:

global:
  nodeSelector:
    my.selector: true

get's 'ignored' at the individual deployment level - so I'm having to continue to set the nodeSelector for each.

I'm going to log a new PR that proposes using a merge rather than a coalesce - which would have the effect I originally desired.

cert-manager-prow bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jun 18, 2025

erikgb reviewed Jul 1, 2025

View reviewed changes

deploy/charts/cert-manager/templates/cainjector-deployment.yaml Outdated Show resolved Hide resolved

StingRayZA force-pushed the stingrayza/add-global-nodeselector branch from c260bf4 to a46dad0 Compare July 1, 2025 10:37

cert-manager-prow bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 1, 2025

StingRayZA force-pushed the stingrayza/add-global-nodeselector branch from a46dad0 to 7a9490d Compare July 1, 2025 10:58

Add global.nodeSelector to helm chart

5b8ca9b

Adds a global.nodeSelector option to be able to set nodeSelector for all services in a single location. This is overridable at an individual service level as before. Signed-off-by: Raimund Hook <rhook@gitlab.com>

StingRayZA force-pushed the stingrayza/add-global-nodeselector branch from 7a9490d to 5b8ca9b Compare July 1, 2025 11:03

cert-manager-prow bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 1, 2025

erikgb reviewed Jul 1, 2025

View reviewed changes

cert-manager-prow bot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 1, 2025

hawksight approved these changes Jul 1, 2025

View reviewed changes

erikgb reviewed Jul 1, 2025

View reviewed changes

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Jul 1, 2025

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 1, 2025

cert-manager-prow bot merged commit 6a14db4 into cert-manager:master Jul 1, 2025
6 checks passed

StingRayZA mentioned this pull request Jul 1, 2025

Support global.nodeSelector in the Helm chart #7817

Open

StingRayZA mentioned this pull request Oct 20, 2025

Change .global.nodeselector in helm to merge #8195

Merged

wallrj-cyberark mentioned this pull request Nov 5, 2025

[release-1.19] Change .global.nodeselector in helm to merge #8233

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add global.nodeSelector to helm chart#7818

Add global.nodeSelector to helm chart#7818
cert-manager-prow[bot] merged 1 commit intocert-manager:masterfrom
StingRayZA:stingrayza/add-global-nodeselector

StingRayZA commented Jun 18, 2025 •

edited

Loading

Uh oh!

cert-manager-prow bot commented Jun 18, 2025

Uh oh!

Uh oh!

erikgb left a comment

Uh oh!

hawksight left a comment

Uh oh!

erikgb left a comment

Uh oh!

cert-manager-prow bot commented Jul 1, 2025

Uh oh!

Uh oh!

wallrj-cyberark commented Oct 15, 2025

Uh oh!

StingRayZA commented Oct 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

StingRayZA commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow bot commented Jun 18, 2025

Uh oh!

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

hawksight left a comment

Choose a reason for hiding this comment

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

cert-manager-prow bot commented Jul 1, 2025

Uh oh!

Uh oh!

wallrj-cyberark commented Oct 15, 2025

Uh oh!

StingRayZA commented Oct 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

StingRayZA commented Jun 18, 2025 •

edited

Loading