feat(step-certificates): add podAnnotations pass-through - #273
Closed
mitchell-privett-delinea wants to merge 1 commit into
Closed
feat(step-certificates): add podAnnotations pass-through#273mitchell-privett-delinea wants to merge 1 commit into
mitchell-privett-delinea wants to merge 1 commit into
Conversation
Mirrors the existing podExtraLabels pattern. Enables users to attach arbitrary annotations to the CA pod template, needed for controllers like Stakater Reloader that trigger rollouts based on annotation-scoped watches of external ConfigMaps or Secrets. The annotations key is now emitted when either inject.enabled=true or podAnnotations is non-empty. Prior default of no annotations key when inject.enabled=false is preserved when podAnnotations is empty (default).
github-actions
Bot
added
the
needs triage
Author
|
Closing — was opened in error. Belongs as an internal change against our mirrored chart, not upstream. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
podAnnotationsvalues field on thestep-certificateschart, mirroring the existingpodExtraLabelspattern. Rendered onto the CA pod template'smetadata.annotations.Why
Enables users to attach arbitrary annotations to the CA pod template. Concrete use case: Stakater Reloader (and similar controllers) rely on workload-scoped annotations to trigger rollouts when referenced ConfigMaps or Secrets change. In deployments where the CA's config/cert material is delivered from an external ConfigMap (e.g., managed by Terraform or an external secrets operator rather than the chart's
inject.*block), users currently have no way to opt the StatefulSet into that reload behavior via values.Behavior
podAnnotations: {}— no change to rendered output for existing users.spec.template.metadata.annotations, alongside the existingchecksum/configandchecksum/secretentries wheninject.enabled=true.annotations:key is now emitted when eitherinject.enabled=trueorpodAnnotationsis non-empty. Previous default of "no annotations key wheninject.enabled=false" is preserved whenpodAnnotationsis empty.Testing
Verified locally with
helm template:annotations:key (matches prior behavior).--set podAnnotations.foo=bar:foo: barrenders underspec.template.metadata.annotations.--set inject.enabled=true --set podAnnotations.reloader\.stakater\.com/reload=step-ca-certs: both thechecksum/config+checksum/secretentries and the user annotation render together.