Skip to content

chore: changes to jetstack-agent chart to use new Agent image #677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wallrj merged 5 commits into from
Jul 22, 2025
Merged

chore: changes to jetstack-agent chart to use new Agent image #677

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4367b44
chore: changes to jetstack-agent chart to use new Agent image
SgtCoDFish Jul 21, 2025
c2033a3
Fix the invalid API group rule for clusterrole jetstack-agent-openshi…
wallrj-cyberark Jul 22, 2025
96cd2c0
Update Docker image repo in helm unittest
wallrj-cyberark Jul 22, 2025
6478d30
Update jetstack-secure Chart.yaml according to the release process do…
wallrj-cyberark Jul 22, 2025
d3a6b7d
Bump the chart version to 0.5.0
wallrj-cyberark Jul 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions deploy/charts/jetstack-agent/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ apiVersion: v2
name: jetstack-agent
description: TLS Protect for Kubernetes Agent
type: application
version: 0.4.0
appVersion: "v0.1.43"
version: 0.5.0
appVersion: "v1.6.0"
home: https://github.com/jetstack/jetstack-secure
maintainers:
- name: JSCP and CRE Team
Expand Down
28 changes: 22 additions & 6 deletions deploy/charts/jetstack-agent/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,30 @@ spec:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- if eq .Values.authentication.type "token" }}
env:
- name: API_TOKEN
valueFrom:
secretKeyRef:
name: {{ default "agent-credentials" .Values.authentication.secretName }}
key: {{ default "apitoken" .Values.authentication.secretKey }}
{{- if eq .Values.authentication.type "token" }}
- name: API_TOKEN
valueFrom:
secretKeyRef:
name: {{ default "agent-credentials" .Values.authentication.secretName }}
key: {{ default "apitoken" .Values.authentication.secretKey }}
{{- end }}
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_UID
valueFrom:
fieldRef:
fieldPath: metadata.uid
- name: POD_NODE
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{{- if not (empty .Values.command) }}
command:
{{- range .Values.command }}
Expand Down
2 changes: 1 addition & 1 deletion deploy/charts/jetstack-agent/templates/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,7 +200,7 @@ metadata:
labels:
{{- include "jetstack-agent.labels" . | nindent 4 }}
rules:
- apiGroups: ["*.openshift.io"]
- apiGroups: ["route.openshift.io"]
Copy link
Copy Markdown
Contributor

@wallrj wallrj Jul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fixes the permissions error mentioned in the PR description.
It is a a bug that was already fixed in the venafi-kubernetes-agent chart, here:

After running the test script, the logs now look like this:

$ TLSPK_ORG=staff-busy-sanderson ./hack/install_local_jetstack_secure_chart.sh
...
$ kubectl logs -n jetstack-secure $(kubectl get pod -n jetstack-secure -l app.kubernetes.io/instance=jetstack-agent -o jsonpath='{.items[0].metadata.name}')
I0722 14:51:16.358377       1 run.go:58] "Starting" logger="Run" version="v1.6.0" commit="32d8a81e90a0811e45ebfe5283004b1ce5ddb7c8"
I0722 14:51:16.359438       1 run.go:116] "Healthz endpoints enabled" logger="Run.APIServer" addr=":8081" path="/healthz"
I0722 14:51:16.359472       1 run.go:120] "Readyz endpoints enabled" logger="Run.APIServer" addr=":8081" path="/readyz"
I0722 14:51:21.524524       1 run.go:233] "Skipping datagatherers for CRDs that can't be found in Kubernetes" logger="Run" datagatherers=["k8s/googlecasissuers","k8s/googlecasclusterissuers","k8s/awspcaissuer","k8s/awspcaclusterissuers","k8s/gateways","k8s/virtualservices","k8s/routes","k8s/venaficlusterissuers","k8s/venafiissuers"]
I0722 14:51:23.131141       1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData"

resources:
- routes
verbs: ["get", "list", "watch"]
Expand Down
2 changes: 1 addition & 1 deletion deploy/charts/jetstack-agent/tests/deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ tests:
# Check is latest is set as tag that it uses that tag
- equal:
path: spec.template.spec.containers[0].image
value: quay.io/jetstack/preflight:latest
value: registry.venafi.cloud/venafi-agent/venafi-agent:latest

# Check naming works with nameOverride
- it: Deployment name is set when nameOverride is used
Expand Down
4 changes: 2 additions & 2 deletions deploy/charts/jetstack-agent/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ replicaCount: 1

image:
# -- Default to Open Source image repository
repository: quay.io/jetstack/preflight
repository: "registry.venafi.cloud/venafi-agent/venafi-agent"
# -- Defaults to only pull if not already present
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion
tag: "v0.1.43"
tag: "v1.6.0"

# -- Specify image pull credentials if using a prviate registry
imagePullSecrets: []
Expand Down
29 changes: 29 additions & 0 deletions hack/install_local_jetstack_secure_chart.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
#!/usr/bin/env bash

set -eu -o pipefail

# This script is provided to quickly install the Jetstack Secure Helm chart from the local checkout
# into a Kind cluster, for testing changes to the legacy chart with Jetstack Secure.
#
# This script should be invoked from the root of the repository, e.g.:
# ./hack/install_local_jetstack_secure_chart.sh

TLSPK_ORG="${TLSPK_ORG:-jetstack}"
TLSPK_CLUSTER_NAME="jss_test_$(date +"%Y%m%d_%H%M")"

helm install cert-manager oci://quay.io/jetstack/charts/cert-manager:v1.18.2 \
--set crds.enabled=true \
--namespace cert-manager \
--create-namespace \
--set 'extraArgs={--dns01-recursive-nameservers-only,--dns01-recursive-nameservers=https://1.1.1.1/dns-query}'

kubectl create namespace jetstack-secure || :

# Get credentials from: https://platform.jetstack.io/org/jetstack/manage/service_accounts
# Save them as JSON a file named credentials.json
kubectl create secret generic agent-credentials --namespace jetstack-secure --from-file=credentials.json || :

helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
./deploy/charts/jetstack-agent \
--set config.organisation="${TLSPK_ORG}" \
--set config.cluster="${TLSPK_CLUSTER_NAME}"