Skip to content

Commit ef625db

Browse files
starlightromerostarlightromero
committed
fix(helm): add priorityClassName
1 parent 64e67cc commit ef625db

File tree

5 files changed

+180
-0
lines changed

5 files changed

+180
-0
lines changed

‎.kiro/steering/product.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Product Overview
2+
3+
cert-manager-sync is a Kubernetes operator that enables automatic synchronization of TLS certificates from cert-manager to external certificate stores.
4+
5+
## Purpose
6+
7+
The operator solves the challenge of securely distributing TLS certificates managed by cert-manager to external services like AWS ACM, Cloudflare, HashiCorp Vault, and other certificate stores without manual intervention.
8+
9+
## Key Features
10+
11+
- **Multi-store support**: Syncs to 9+ certificate stores (AWS ACM, Cloudflare, DigitalOcean, GCP, Vault, Heroku, Incapsula, ThreatX, Filepath)
12+
- **Annotation-driven configuration**: Uses Kubernetes annotations on TLS secrets to define sync destinations
13+
- **Exponential backoff**: Implements retry logic with binary exponential backoff for failed syncs
14+
- **Multiple destinations**: Can sync a single certificate to multiple stores simultaneously
15+
- **Prometheus metrics**: Exposes sync status and metrics for monitoring
16+
- **Event recording**: Creates Kubernetes events for sync operations
17+
18+
## Target Users
19+
20+
- DevOps engineers managing Kubernetes clusters with cert-manager
21+
- Platform teams needing to distribute certificates to external services
22+
- Organizations using hybrid cloud architectures requiring certificate synchronization

‎.kiro/steering/structure.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Project Structure
2+
3+
## Directory Layout
4+
5+
```
6+
cert-manager-sync/
7+
├── cmd/cert-manager-sync/ # Application entry point
8+
├── internal/ # Private application code
9+
│ ├── metrics/ # Prometheus metrics implementation
10+
│ └── types/ # Internal type definitions
11+
├── pkg/ # Public library code
12+
│ ├── certmanagersync/ # Core operator logic
13+
│ ├── state/ # Kubernetes client and state management
14+
│ └── tlssecret/ # TLS certificate parsing and configuration
15+
├── stores/ # Certificate store implementations
16+
│ ├── acm/ # AWS Certificate Manager
17+
│ ├── cloudflare/ # Cloudflare certificates
18+
│ ├── digitalocean/ # DigitalOcean certificates
19+
│ ├── filepath/ # File system storage
20+
│ ├── gcpcm/ # Google Cloud Certificate Manager
21+
│ ├── heroku/ # Heroku certificates
22+
│ ├── incapsula/ # Incapsula WAF certificates
23+
│ ├── threatx/ # ThreatX certificates
24+
│ └── vault/ # HashiCorp Vault storage
25+
├── deploy/cert-manager-sync/ # Helm chart for deployment
26+
└── devops/docs/ # Documentation and diagrams
27+
```
28+
29+
## Code Organization Patterns
30+
31+
### Package Responsibilities
32+
33+
- **cmd/**: Application entry points and main functions
34+
- **internal/**: Private code not intended for external use
35+
- **pkg/**: Public APIs that could be imported by other projects
36+
- **stores/**: Pluggable certificate store implementations
37+
38+
### Interface Design
39+
40+
- All certificate stores implement the `RemoteStore` interface
41+
- Each store package contains:
42+
- Main implementation file (e.g., `acm.go`)
43+
- Test file (e.g., `acm_test.go`)
44+
- Configuration parsing and validation
45+
46+
### Naming Conventions
47+
48+
- Package names are lowercase, single words when possible
49+
- Store packages named after the service (e.g., `acm`, `vault`)
50+
- Struct names use PascalCase (e.g., `ACMStore`, `VaultStore`)
51+
- Interface names end with descriptive suffix (e.g., `RemoteStore`)
52+
53+
### Configuration Pattern
54+
55+
- Environment variables for operator-level configuration
56+
- Kubernetes annotations for per-secret configuration
57+
- Annotation keys follow pattern: `cert-manager-sync.lestak.sh/{store}-{setting}`
58+
59+
### Error Handling
60+
61+
- Use structured logging with logrus
62+
- Return errors from functions, handle at appropriate level
63+
- Create Kubernetes events for user-visible operations
64+
- Implement exponential backoff for transient failures
65+
66+
### Testing Structure
67+
68+
- Test files alongside implementation files
69+
- Use table-driven tests where appropriate
70+
- Mock external dependencies for unit tests

‎.kiro/steering/tech.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Technology Stack
2+
3+
## Language & Runtime
4+
5+
- **Go 1.25.1**: Primary programming language
6+
- **Kubernetes client-go**: For Kubernetes API interactions
7+
- **Logrus**: Structured logging library
8+
9+
## Architecture
10+
11+
- **Kubernetes Operator Pattern**: Uses informers and event handlers
12+
- **Interface-based design**: `RemoteStore` interface for pluggable certificate stores
13+
- **Event-driven**: Responds to Kubernetes secret changes via informers
14+
15+
## Key Dependencies
16+
17+
- `k8s.io/client-go`: Kubernetes client library
18+
- `k8s.io/api`: Kubernetes API types
19+
- `github.com/prometheus/client_golang`: Metrics collection
20+
- Cloud provider SDKs: AWS SDK, GCP client libraries, Cloudflare Go client
21+
- `github.com/hashicorp/vault/api`: HashiCorp Vault integration
22+
- `software.sslmate.com/src/go-pkcs12`: PKCS#12 certificate format support
23+
24+
## Build System
25+
26+
- **Make**: Build automation via `Makefile`
27+
- **Docker**: Multi-stage builds with scratch base image
28+
- **Helm**: Kubernetes deployment packaging
29+
30+
## Common Commands
31+
32+
### Development
33+
34+
```bash
35+
# Run tests
36+
make test
37+
38+
# Build binary
39+
go build -o cert-manager-sync cmd/cert-manager-sync/*.go
40+
41+
# Run locally (requires KUBECONFIG)
42+
./cert-manager-sync
43+
```
44+
45+
### Testing
46+
47+
```bash
48+
# Run all tests with verbose output
49+
go test -v ./...
50+
51+
# Run vulnerability check
52+
govulncheck -show verbose ./...
53+
54+
# Test specific package
55+
go test -v ./pkg/certmanagersync
56+
```
57+
58+
### Docker
59+
60+
```bash
61+
# Build container image
62+
docker build -t cert-manager-sync .
63+
64+
# Run container
65+
docker run cert-manager-sync
66+
```
67+
68+
### Deployment
69+
70+
```bash
71+
# Deploy with Helm
72+
helm upgrade --install -n cert-manager cert-manager-sync ./deploy/cert-manager-sync
73+
74+
# Deploy with custom values
75+
helm upgrade --install -n cert-manager cert-manager-sync ./deploy/cert-manager-sync -f custom-values.yaml
76+
```
77+
78+
## Configuration
79+
80+
- Environment variables for operator configuration
81+
- Kubernetes annotations for certificate sync configuration
82+
- Helm values for deployment customization

‎deploy/cert-manager-sync/templates/deployment.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ spec:
2929
{{- toYaml . | nindent 8 }}
3030
{{- end }}
3131
serviceAccountName: {{ include "cert-manager-sync.serviceAccountName" . }}
32+
{{- if .Values.priorityClassName }}
33+
priorityClassName: {{ .Values.priorityClassName }}
34+
{{- end }}
3235
securityContext:
3336
{{- toYaml .Values.podSecurityContext | nindent 8 }}
3437
containers:

‎deploy/cert-manager-sync/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ clusterRole:
4343

4444
podAnnotations: {}
4545

46+
# -- Priority class name for pod scheduling
47+
priorityClassName: ""
48+
4649
podSecurityContext: {}
4750
# fsGroup: 2000
4851

0 commit comments

Comments
 (0)