feat: auto detect presence of cert-manager CRDs

Author: theSuess

charts/opentelemetry-operator/templates/_helpers.tpl

@@ -119,7 +119,7 @@ a cert is loaded from an existing secret or is provided via `.Values`
 {{- $caCertEnc := "" }}
 {{- $certCrtEnc := "" }}
 {{- $certKeyEnc := "" }}
-{{- if .Values.admissionWebhooks.autoGenerateCert.enabled }}
+{{- if or (eq .Values.admissionWebhooks.certificateSource "helm-generated") (eq .Values.admissionWebhooks.certificateSource "prefer-cert-manager") }}
 {{- $prevSecret := (lookup "v1" "Secret" (include "opentelemetry-operator.namespace" .) (default (printf "%s-controller-manager-service-cert" (include "opentelemetry-operator.fullname" .)) .Values.admissionWebhooks.secretName )) }}
 {{- if and (not .Values.admissionWebhooks.autoGenerateCert.recreate) $prevSecret }}
 {{- $certCrtEnc = index $prevSecret "data" "tls.crt" }}
@@ -140,7 +140,10 @@ a cert is loaded from an existing secret or is provided via `.Values`
 {{- $certKeyEnc = b64enc $cert.Key }}
 {{- $caCertEnc = b64enc $ca.Cert }}
 {{- end }}
-{{- else }}
+{{- else if eq .Values.admissionWebhooks.certificateSource "self-signed" }}
+{{- if or (or (eq .Values.admissionWebhooks.certFile "") (eq .Values.admissionWebhooks.keyFile "")) (eq .Values.admissionWebhooks.caFile "")}}
+{{ fail "certFile, keyFile and caFile must be set when using self-signed as certificateSource" }}
+{{- end }}
 {{- $certCrtEnc = .Files.Get .Values.admissionWebhooks.certFile | b64enc }}
 {{- $certKeyEnc = .Files.Get .Values.admissionWebhooks.keyFile | b64enc }}
 {{- $caCertEnc = .Files.Get .Values.admissionWebhooks.caFile | b64enc }}

charts/opentelemetry-operator/templates/admission-webhooks/operator-webhook-with-cert-manager.yaml

@@ -1,4 +1,5 @@
-{{- if and (.Values.admissionWebhooks.create) (.Values.admissionWebhooks.certManager.enabled) }}
+{{- if .Capabilities.APIVersions.Has "cert-manager.io/v1" -}}
+{{- if or (eq .Values.admissionWebhooks.certificateSource "cert-manager") (eq .Values.admissionWebhooks.certificateSource "prefer-cert-manager") }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
@@ -235,3 +236,8 @@ webhooks:
     sideEffects: None
     timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
 {{- end }}
+{{- else -}}
+{{ if eq .Values.admissionWebhooks.certificateSource "cert-manager" }}
+{{ fail "certificateSource is set to cert-manager but cert manager APIs are not available" }}
+{{- end }}
+{{- end }}

charts/opentelemetry-operator/templates/admission-webhooks/operator-webhook.yaml

@@ -1,4 +1,4 @@
-{{- if and (.Values.admissionWebhooks.create) (not .Values.admissionWebhooks.certManager.enabled) }}
+{{- if or (ne .Values.admissionWebhooks.certificateSource "cert-manager") (and (eq .Values.admissionWebhooks.certificateSource "prefer-cert-manager") (not (.Capabilities.APIVersions.Has "cert-manager.io/v1"))) }}
 {{- $cert := fromYaml (include "opentelemetry-operator.WebhookCert" .) }}
 {{- $caCertEnc := $cert.ca }}
 {{- $certCrtEnc := $cert.crt }}

charts/opentelemetry-operator/templates/certmanager.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.admissionWebhooks.create .Values.admissionWebhooks.certManager.enabled }}
+{{- if and .Values.admissionWebhooks.create .Values.admissionWebhooks.certManager.enabled (.Capabilities.APIVersions.Has "cert-manager.io/v1") }}
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:

charts/opentelemetry-operator/values.schema.json

@@ -1558,6 +1558,7 @@
         "timeoutSeconds",
         "namespaceSelector",
         "objectSelector",
+        "certificateSource",
         "certManager",
         "autoGenerateCert",
         "certFile",
@@ -1661,12 +1662,21 @@
             {}
           ]
         },
+        "certificateSource": {
+          "type": "string",
+          "default": {},
+          "title": "The certificateSource Schema",
+          "required": [],
+          "properties": {},
+          "examples": [
+            {}
+          ]
+        },
         "certManager": {
           "type": "object",
           "default": {},
           "title": "The certManager Schema",
           "required": [
-            "enabled",
             "issuerRef",
             "certificateAnnotations",
             "issuerAnnotations"
@@ -1744,7 +1754,6 @@
           "default": {},
           "title": "The autoGenerateCert Schema",
           "required": [
-            "enabled",
             "recreate"
           ],
           "additionalProperties": false,

charts/opentelemetry-operator/values.yaml

@@ -291,11 +291,16 @@ admissionWebhooks:
   namespaceSelector: {}
   objectSelector: {}
 
+  ## Choose the certificate approach to take
+  ## - prefer-cert-manager (default): Uses cert manager if available, falls back to generated certificates
+  ## - cert-manager: Use cert-manager to generate certificates
+  ## - helm-generated: Generate certificates with helm
+  ## - self-signed: Provide your own certificate
+  certificateSource: 'prefer-cert-manager'
+
   ## https://github.com/open-telemetry/opentelemetry-helm-charts/blob/main/charts/opentelemetry-operator/README.md#tls-certificate-requirement
   ## TLS Certificate Option 1: Use certManager to generate self-signed certificate.
-  ## certManager must be enabled. If enabled, always takes precedence over options 2 and 3.
   certManager:
-    enabled: true
     ## Provide the issuer kind and name to do the cert auth job.
     ## By default, OpenTelemetry Operator will use self-signer issuer.
     issuerRef: {}
@@ -312,17 +317,14 @@ admissionWebhooks:
     renewBefore: ""
 
   ## TLS Certificate Option 2: Use Helm to automatically generate self-signed certificate.
-  ## certManager must be disabled and autoGenerateCert must be enabled.
-  ## If true and certManager.enabled is false, Helm will automatically create a self-signed cert and secret for you.
   autoGenerateCert:
-    enabled: true
     # If set to true, new webhook key/certificate is generated on helm upgrade.
     recreate: true
     # Cert period time in days. The default is 365 days.
     certPeriodDays: 365
 
   ## TLS Certificate Option 3: Use your own self-signed certificate.
-  ## certManager and autoGenerateCert must be disabled and certFile, keyFile, and caFile must be set.
+  ## certFile, keyFile, and caFile must be set.
   ## The chart reads the contents of the file paths with the helm .Files.Get function.
   ## Refer to this doc https://helm.sh/docs/chart_template_guide/accessing_files/ to understand
   ## limitations of file paths accessible to the chart.