helm: add cert-manager wrapper chart by danish9039 · Pull Request #3470 · kubeflow/community-distribution

danish9039 · 2026-05-18T15:01:52Z

Summary

Adds an experimental cert-manager Helm wrapper chart under common/cert-manager/helm, co-located with the Kustomize baseline under common/cert-manager.

The chart wraps the upstream Jetstack cert-manager Helm chart at v1.20.2 and adds Kubeflow-specific cert-manager integration resources.

Scope

Add the cert-manager wrapper chart.
Move the wrapper chart from experimental/helm/charts/cert-manager to common/cert-manager/helm.
Update YAML lint config so co-located Helm templates under common/*/helm/templates/** are not treated as raw YAML.
Keep Chart.yaml dependency version as bare semver ("1.20.2") while preserving appVersion: v1.20.2.
Regenerate Chart.lock after the dependency version fix.
Add cert-manager to tests/helm_kustomize_compare.sh with the co-located chart path and --include-crds.
Add Jetstack Helm repo setup before helm dependency build so CI can resolve the cert-manager dependency from a clean runner.

Follow-up

Sync script extension for appVersion/dependency updates will follow separately after the chart location change, so this PR stays focused on co-location and parity proof.

Stacking note

This PR is stacked on the foundation chart shape from #3468.

The wrapper does not render Namespace/cert-manager. The namespace is provided by kubeflow-namespaces, and the Helm release metadata is stored in the cert-manager workload namespace.

This means the intended platform install order is:

kubeflow-namespaces -> kubeflow-platform -> cert-manager

Install shape

helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces --namespace default
helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform --namespace kubeflow-system

helm dep build ./common/cert-manager/helm
helm install cert-manager ./common/cert-manager/helm --namespace cert-manager --wait

Validation

helm dependency list common/cert-manager/helm
helm lint common/cert-manager/helm/
./tests/helm_kustomize_compare.sh cert-manager base
./tests/helm_kustomize_compare_all.sh cert-manager
git diff --check HEAD~1..HEAD

Also validated the cert-manager compare path with an empty Helm repository config to match clean CI runners.

github-actions · 2026-05-18T15:02:45Z

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

Copilot

Pull request overview

Adds an experimental Helm wrapper chart for cert-manager and wires it into the Helm/Kustomize comparison tooling.

Changes:

Introduces the cert-manager wrapper chart, values, templates, lock file, and README.
Adds Kubeflow-specific optional resources for the ClusterIssuer and NetworkPolicies.
Extends comparison scripts to cover cert-manager base and Kubeflow scenarios.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`.gitignore`	Ignores generated Helm dependency archives.
`experimental/helm/charts/cert-manager/.helmignore`	Defines files excluded from chart packaging.
`experimental/helm/charts/cert-manager/Chart.lock`	Locks the Jetstack cert-manager chart dependency.
`experimental/helm/charts/cert-manager/Chart.yaml`	Defines the wrapper chart metadata and dependency.
`experimental/helm/charts/cert-manager/README.md`	Documents install and parity validation flow.
`experimental/helm/charts/cert-manager/ci/values-base.yaml`	Adds base comparison values.
`experimental/helm/charts/cert-manager/ci/values-kubeflow.yaml`	Adds Kubeflow comparison values.
`experimental/helm/charts/cert-manager/templates/kubeflow-resources.yaml`	Adds optional Kubeflow ClusterIssuer and NetworkPolicies.
`experimental/helm/charts/cert-manager/templates/namespace.yaml`	Adds the cert-manager namespace template.
`experimental/helm/charts/cert-manager/values.yaml`	Adds default wrapper chart values.
`tests/helm_kustomize_compare.py`	Allows cert-manager in manifest comparison.
`tests/helm_kustomize_compare.sh`	Adds cert-manager scenarios and rendering logic.
`tests/helm_kustomize_compare_all.sh`	Includes cert-manager in all-scenario comparison runs.

danish9039 · 2026-05-25T16:04:19Z

+
+```bash
+helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces
+helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform


Fixed in the README: kubeflow-platform and cert-manager now use --namespace kubeflow-system.

danish9039 · 2026-05-25T16:04:20Z

    namespace = sys.argv[5] if len(sys.argv) > 5 and not sys.argv[5].startswith('--') else ""

-    if component not in ["katib", "hub", "kserve-models-web-app"]:
+    if component not in ["katib", "hub", "kserve-models-web-app", "cert-manager"]:


Fixed by preserving the Kubeflow cert-manager overlay labels on the overlay-owned resources during comparison.

juliusvonkohout · 2026-05-25T18:03:49Z

Please first update kustomize to the latest available version in a separate PR.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 · 2026-05-31T16:54:53Z

Addressed: cert-manager Kustomize manifests were synchronized to v1.20.2 in #3482, and this chart branch is aligned to that version.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate · 2026-06-07T23:06:43Z

+- upstream cert-manager `v1.20.2`
+- cert-manager CRDs
+- optional `ClusterIssuer/kubeflow-self-signing-issuer`
+- optional Kubeflow cert-manager NetworkPolicies


Here it should be
- optional kubeflow specific cert-manager NetworkPolicies.

Updated the bullet to optional Kubeflow-specific cert-manager NetworkPolicies.

dhanishaphadate · 2026-06-07T23:16:45Z

+- optional `ClusterIssuer/kubeflow-self-signing-issuer`
+- optional Kubeflow cert-manager NetworkPolicies
+
+In the Kubeflow platform install, apply the foundation charts first. The `kubeflow-namespaces` chart provides `Namespace/cert-manager`; this wrapper stores its Helm release metadata in that same workload namespace.


Specify the names of the foundation charts and then mention what they provide.

Chart type Chart

Bootstrap Foundation kubeflow-namespaces

Platform Foundation kubeflow-platform

Added a small table for kubeflow-namespaces and kubeflow-platform with what each foundation chart provides.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate · 2026-06-07T23:18:37Z

+helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces --namespace default
+helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform --namespace kubeflow-system
+
+helm install cert-manager ./experimental/helm/charts/cert-manager --namespace cert-manager --wait


Add a command to pull the dependencies first using Chart.lock

helm dep build ./experimental/helm/charts/cert-manager

Added helm dep build ./experimental/helm/charts/cert-manager before the cert-manager install command.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 · 2026-06-21T15:30:19Z

/retest

juliusvonkohout · 2026-06-24T16:03:44Z

+  --values ./common/cert-manager/helm/ci/values-kubeflow.yaml --wait
+```
+
+The install is split into base install plus upgrade because `ClusterIssuer` cannot be created until cert-manager CRDs are available.


Suggested change

The install is split into base install plus upgrade because `ClusterIssuer` cannot be created until cert-manager CRDs are available.

The installation is split into base install plus upgrade because `ClusterIssuer` cannot be created until cert-manager CRDs are available.

juliusvonkohout · 2026-06-24T16:05:30Z

Suggested change

ROOT_DIRETORY="$(dirname "$SCRIPT_DIRECTORY")"

juliusvonkohout · 2026-06-24T16:05:39Z

Suggested change

SCRIPT_DIRECTORY="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

juliusvonkohout · 2026-06-24T16:06:06Z

    declare -a failed_components=()

-    for comp in katib hub kserve-models-web-app; do
+    for comp in katib hub kserve-models-web-app cert-manager; do


Suggested change

for comp in katib hub kserve-models-web-app cert-manager; do

for component in katib hub kserve-models-web-app cert-manager; do

juliusvonkohout · 2026-06-24T16:06:22Z

@@ -12,6 +12,7 @@ declare -A COMPONENT_SCENARIOS=(
    ["katib"]="standalone cert-manager external-db leader-election openshift standalone-postgres with-kubeflow"
    ["hub"]="base overlay-postgres overlay-db controller-manager controller-rbac controller-default controller-prometheus controller-network-policy ui-base ui-standalone ui-integrated ui-istio istio csi"
    ["kserve-models-web-app"]="base kubeflow"


Suggested change

["kserve-models-web-app"]="base kubeflow"

["kserve-models-web-application"]="base kubeflow"

juliusvonkohout · 2026-06-24T16:06:32Z

 else
    echo "ERROR: Unknown component: $COMPONENT"
-    echo "Supported components: katib, hub, kserve-models-web-app, all"
+    echo "Supported components: katib, hub, kserve-models-web-app, cert-manager, all"


Suggested change

echo "Supported components: katib, hub, kserve-models-web-app, cert-manager, all"

echo "Supported components: katib, hub, kserve-models-web-application, cert-manager, all"

Copilot

Pull request overview

Copilot reviewed 13 out of 15 changed files in this pull request and generated no new comments.

juliusvonkohout · 2026-06-24T16:07:43Z

Suggested change

echo "ERROR: Helm chart directory does not exist: $CHART_DIRECTORY"

juliusvonkohout · 2026-06-24T16:07:55Z

Suggested change

if [ -n "$HELM_VALUES_ARG" ] && [ ! -f "$HELM_VALUES_ARGUMENTS" ]; then

juliusvonkohout · 2026-06-24T16:08:04Z

Suggested change

echo "ERROR: Helm values file does not exist: $HELM_VALUES_ARGUMENTS"

juliusvonkohout · 2026-06-24T16:08:13Z

Suggested change

cd "$ROOT_DIRECTORY"

juliusvonkohout · 2026-06-24T16:08:41Z

Suggested change

cd "$ROOT_DIRECTORY"

if [[ "$COMPONENT" == "kserve-models-web-application" ]]; then

juliusvonkohout · 2026-06-24T16:09:11Z

no, you must use helm 4

juliusvonkohout · 2026-06-24T16:15:50Z

the synchonization script fixes are missing. It must update both kustomize and helm

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

kunal-511 · 2026-06-28T06:54:53Z

the synchonization script fixes are missing. It must update both kustomize and helm

@danish9039 Any updates on this? or will be fixed in follow up pr?

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot AI review requested due to automatic review settings May 18, 2026 15:01

google-oss-prow Bot added the do-not-merge/work-in-progress label May 18, 2026

google-oss-prow Bot requested review from juliusvonkohout and kimwnasptd May 18, 2026 15:01

google-oss-prow Bot added the size/L label May 18, 2026

Copilot started reviewing on behalf of danish9039 May 18, 2026 15:03 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

danish9039 force-pushed the gsoc/cert-manager-wrapper-chart branch 2 times, most recently from 553f9c5 to 6b1d396 Compare May 19, 2026 19:12

This was referenced May 25, 2026

helm: add Istio wrapper chart #3478

Open

helm: add oauth2-proxy wrapper chart #3479

Open

helm: add Dex wrapper chart #3480

Open

danish9039 force-pushed the gsoc/cert-manager-wrapper-chart branch from 8cf2018 to e1f141d Compare May 25, 2026 16:04

danish9039 added 3 commits May 27, 2026 01:07

helm: add cert-manager wrapper chart

fff2465

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

cert-manager: support existing installations

7088454

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: preserve cert-manager overlay labels in comparison

a945009

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 force-pushed the gsoc/cert-manager-wrapper-chart branch from e1f141d to a945009 Compare May 26, 2026 19:38

helm: align cert-manager wrapper with v1.20.2

d926dd7

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 marked this pull request as ready for review June 1, 2026 13:35

google-oss-prow Bot removed the do-not-merge/work-in-progress label Jun 1, 2026

helm: use foundation-owned cert-manager namespace

f9fb01c

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate reviewed Jun 7, 2026

View reviewed changes

helm: clarify cert-manager network policy wording

9e11606

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

dhanishaphadate reviewed Jun 7, 2026

View reviewed changes

helm: document cert-manager install prerequisites

47d50d5

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 requested a review from Copilot June 7, 2026 23:43

test: add jetstack repo setup for cert-manager compare

f0e280a

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

juliusvonkohout requested a review from Copilot June 24, 2026 16:01

Copilot started reviewing on behalf of juliusvonkohout June 24, 2026 16:01 View session

juliusvonkohout reviewed Jun 24, 2026

View reviewed changes

Copilot AI reviewed Jun 24, 2026

View reviewed changes

juliusvonkohout reviewed Jun 24, 2026

View reviewed changes

Comment thread tests/helm_kustomize_compare.sh Outdated

juliusvonkohout Jun 24, 2026

Copy link
Copy Markdown

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

cd "$ROOT_DIRECTORY"

juliusvonkohout reviewed Jun 24, 2026

View reviewed changes

juliusvonkohout mentioned this pull request Jun 26, 2026

Pipeline Helm Charts #3237

Open

3 tasks

danish9039 added 6 commits June 26, 2026 16:16

helm: address cert-manager review comments

5c340ae

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: clean cert-manager compare script naming

c0c923e

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

docs: clean cert-manager helm wording

4a11d95

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

chore: keep local ignores out of gitignore

c090458

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: align hub image tags with kustomize

58a99ad

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: inherit hub component image tags

49a78f8

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 2 commits June 28, 2026 16:24

scripts: sync cert-manager helm chart updates

a514775

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

ci: run helm compare for cert-manager sync changes

0f40751

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow Bot added size/XL and removed size/L labels Jun 28, 2026

Chart type	Chart
Bootstrap Foundation	kubeflow-namespaces
Platform Foundation	kubeflow-platform

	The install is split into base install plus upgrade because `ClusterIssuer` cannot be created until cert-manager CRDs are available.
	The installation is split into base install plus upgrade because `ClusterIssuer` cannot be created until cert-manager CRDs are available.


	SCRIPT_DIRECTORY="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

	for comp in katib hub kserve-models-web-app cert-manager; do
	for component in katib hub kserve-models-web-app cert-manager; do

	["kserve-models-web-app"]="base kubeflow"
	["kserve-models-web-application"]="base kubeflow"

	echo "Supported components: katib, hub, kserve-models-web-app, cert-manager, all"
	echo "Supported components: katib, hub, kserve-models-web-application, cert-manager, all"


	echo "ERROR: Helm chart directory does not exist: $CHART_DIRECTORY"


	if [ -n "$HELM_VALUES_ARG" ] && [ ! -f "$HELM_VALUES_ARGUMENTS" ]; then


	echo "ERROR: Helm values file does not exist: $HELM_VALUES_ARGUMENTS"


	cd "$ROOT_DIRECTORY"
	if [[ "$COMPONENT" == "kserve-models-web-application" ]]; then

Uh oh!

Conversation

danish9039 commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Follow-up

Stacking note

Install shape

Validation

Uh oh!

github-actions Bot commented May 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout commented May 25, 2026

Uh oh!

danish9039 commented May 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danish9039 commented Jun 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout commented Jun 24, 2026

Uh oh!

kunal-511 commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

danish9039 commented May 18, 2026 •

edited

Loading

juliusvonkohout Jun 24, 2026 •

edited

Loading