Skip to content

cert-manager Development and Maintenance Guide📜

This document is the maintainer runbook for updating and validating the Big Bang integrated cert-manager package in this repository.

Scope and Track📜

  • Repository scope: cert-manager package only
  • Maintenance track: bb_integrated
  • Related packages handled in separate repos: cert-manager-trust-manager, cert-manager-approver-policy
  • Big Bang umbrella integration is maintained in big-bang/bigbang alongside this package

How to Upgrade cert-manager📜

  1. Review upstream release notes and upgrade guidance:
  2. https://github.com/cert-manager/cert-manager/releases
  3. https://github.com/cert-manager/cert-manager/tree/master/deploy/charts/cert-manager
  4. Check out the Renovate branch (usually renovate/ironbank) or create a feature branch from main.
  5. Update chart/Chart.yaml:
  6. bump chart dependency cert-manager version under alias upstream
  7. bump package version and append Big Bang suffix (for example -bb.0)
  8. verify appVersion is aligned
  9. Update image tags and references:
  10. ensure chart/values.yaml image tags match target version
  11. ensure chart/Chart.yaml annotation helm.sh/images matches values
  12. Ensure approved image sources (registry1.dso.mil/ironbank/*) are preserved
  13. Update dependencies and lockfiles:
helm dependency update ./chart
  1. Update CHANGELOG.md with a new entry for the bumped package version.
  2. Regenerate README.md using the Big Bang gluon + helm-docs process.
  3. Open/update MR in Draft, run CI, and address failures before review.

Required Validation📜

Run these checks before requesting review.

  1. Run Helm unit tests:
helm unittest chart -f 'tests/unit/*.yaml'
  1. Run Helm lint and template checks:
helm dependency build chart
helm lint chart
helm template cert-manager chart -f tests/test-values.yaml >/tmp/cert-manager-rendered.yaml
  1. Run chart runtime tests with helm test (Gluon script runner):
helm upgrade --install cert-manager ./chart -n cert-manager --create-namespace --wait --set bbtests.enabled=true
helm test cert-manager -n cert-manager
  1. Validate upgrade path by running helm test after upgrade:
helm upgrade cert-manager ./chart -n cert-manager --wait --set bbtests.enabled=true
helm test cert-manager -n cert-manager
  1. Confirm helm test coverage includes:
  2. CRD presence checks
  3. cert-manager deployment readiness checks
  4. positive issuer/certificate issuance
  5. negative issuer/certificate failure behavior (Ready=False)

Big Bang Integration Testing (When Needed)📜

For changes likely to affect umbrella behavior (CRDs, Istio behavior, policy, or lifecycle), run package-against-bigbang testing using your branch.

Example tests/test-values.yaml style override in Big Bang:

packages:
  cert-manager:
    enabled: true
    sourceType: git
    git:
      repo: https://repo1.dso.mil/big-bang/product/packages/cert-manager.git
      path: chart
      branch: "<your-branch>"
      tag: null

CRD and Lifecycle Notes📜

  • cert-manager installs CRDs; verify install/upgrade/rollback behavior for each meaningful version bump.
  • Document any CRD caveats in MR upgrade notes.
  • Keep default behavior safe and unchanged when package is not enabled by umbrella deployment.

Security and Policy Expectations📜

RBAC📜

  • RBAC resources are generated by upstream chart templates.
  • During upgrade, compare rendered RBAC objects to verify no unexpected permission expansion.

Network Policy📜

  • This package currently does not ship custom Big Bang network policies.
  • If network policies are introduced, include explicit allow paths for:
  • kube-apiserver egress
  • DNS egress
  • cert-manager webhook/controller/cainjector communication

Runtime Security📜

  • Keep securityContext and runAsNonRoot settings aligned with approved hardening baseline across controller, webhook, cainjector, and startup check.

Big Bang Modifications to Upstream (Current)📜

High-level package deltas from upstream chart behavior:

  • upstream chart consumed via dependency alias upstream
  • Big Bang metadata annotations in chart/Chart.yaml
  • Iron Bank image overrides in chart/values.yaml
  • runtime security defaults set in values
  • Istio helper templates under chart/templates/bigbang/istio
  • package smoke test script in tests/scripts/test_issuer.sh