Merge pull request #26 from linuxfoundation/jme/LFXV2-202

add heimdall certificates bundle

Author: jordane

charts/lfx-platform/Chart.lock

@@ -26,8 +26,11 @@ dependencies:
 - name: fga-operator
   repository: https://3schwartz.github.io/fga-operator/
   version: 1.0.0
+- name: cert-manager
+  repository: https://charts.jetstack.io
+  version: v1.18.2
 - name: trust-manager
   repository: https://charts.jetstack.io
   version: v0.18.0
-digest: sha256:61536bbfab1eafca462f82f4612470de2d1fab9f44bfd8e8ff3d5cfc4d770bc3
-generated: "2025-08-06T09:08:39.763963-07:00"
+digest: sha256:39213eb59f4710c62bea63fa3545c34e1b84e0f48353757d813ed727537f41e8
+generated: "2025-08-06T10:15:28.22001-07:00"

charts/lfx-platform/Chart.yaml

@@ -5,7 +5,7 @@ apiVersion: v2
 name: lfx-platform
 description: LFX Platform v2 Helm chart
 type: application
-version: 0.1.8
+version: 0.1.9
 icon: https://github.com/linuxfoundation/lfx-v2-helm/raw/main/img/lfx-logo-color.svg
 dependencies:
   - name: traefik
@@ -44,7 +44,11 @@ dependencies:
     repository: https://3schwartz.github.io/fga-operator/
     version: ~1.0.0
     condition: fga-operator.enabled
+  - name: cert-manager
+    repository: https://charts.jetstack.io
+    version: ~1.18.2
+    condition: cert-manager.enabled
   - name: trust-manager
     repository: https://charts.jetstack.io
     version: ~0.18.0
-    condition: trust-manager-enabled
+    condition: trustManagerEnabled

charts/lfx-platform/templates/heimdall/cert-bundle.yaml

@@ -0,0 +1,16 @@
+# Copyright The Linux Foundation and each contributor to LFX.
+# SPDX-License-Identifier: MIT
+---
+{{- if and .Values.lfx.generateHeimdallBundle.enabled (and .Values.heimdall.enabled .Values.trustManagerEnabled) -}}
+apiVersion: trust.cert-manager.io/v1alpha1
+kind: Bundle
+metadata:
+  name: {{ .Values.lfx.generateHeimdallBundle.name }}
+spec:
+  sources:
+  - useDefaultCAs: true
+  target:
+    configMap:
+      key: "{{ .Values.lfx.generateHeimdallBundle.configKey }}"
+
+{{- end }}

charts/lfx-platform/values.yaml

@@ -11,6 +11,11 @@ lfx:
     registry: linuxfoundation
     pullPolicy: IfNotPresent
 
+  generateHeimdallBundle:
+    enabled: false
+    name: heimdall-trust-bundle
+    configKey: ca-certificates.crt
+
 fga-operator:
   enabled: true
   # Non-chart value
@@ -394,7 +399,11 @@ nack:
       url: nats://lfx-platform-nats:4222
     additionalArgs: [--control-loop]
 
-trust-manager-enabled: false
+cert-manager:
+  enabled: false
+  crds:
+    enabled: true
+trustManagerEnabled: false
 trust-manager:
   crds:
     enabled: true