From 5140b82a4f32d5eafd151be42ad4aeaf74a4a8ec Mon Sep 17 00:00:00 2001 From: Robin Breathe Date: Thu, 5 Nov 2026 12:10:28 +0100 Subject: [PATCH 1/3] feat(chart): add extraVolumes and extraVolumeMounts Allow mounting extra volumes into the manager pod, e.g. to extend the trusted CAs via SSL_CERT_DIR when running behind a TLS-inspecting firewall. Document the setup in the README and bump the chart to 0.5.0. Co-Authored-By: Claude Sonnet 5.5 --- README.md | 22 +++++++++++++++++++ deploy/charts/github-token-manager/Chart.yaml | 2 +- .../templates/deployment.yaml | 6 +++++ .../charts/github-token-manager/values.yaml | 6 +++++ 4 files changed, 35 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index d84154b..758ec52 100644 --- a/README.md +++ b/README.md @@ -122,6 +122,28 @@ When `validate_key` is enabled, the operator verifies at startup that the config Supported providers: `aws` (KMS), `azure` (Key Vault), `gcp` (Cloud KMS), `vault` (Transit Engine), `file` (embedded) +**Behind a TLS-inspecting proxy:** + +To trust additional CAs (e.g. a firewall's inspection CA) *on top of* the system roots, mount them as PEM files and point `SSL_CERT_DIR` at the directory (Go loads it in addition to the system bundle; don't use `SSL_CERT_FILE`, which replaces it). Proxy settings (`HTTPS_PROXY`/`NO_PROXY`) are honoured too. + +```yaml +# Helm values +manager: + env: + - name: SSL_CERT_DIR + value: /etc/ssl/extra-ca + extraVolumes: + - name: extra-ca + configMap: + name: corp-ca # ConfigMap whose keys are PEM-encoded CA certificates + extraVolumeMounts: + - name: extra-ca + mountPath: /etc/ssl/extra-ca + readOnly: true +``` + +CAs are loaded once at startup; restart the pod after rotating them. + ### Token Resources Create `Token` (namespaced) or `ClusterToken` (cluster-scoped) resources to generate secure `Secret` objects: diff --git a/deploy/charts/github-token-manager/Chart.yaml b/deploy/charts/github-token-manager/Chart.yaml index 06a6a33..c882374 100644 --- a/deploy/charts/github-token-manager/Chart.yaml +++ b/deploy/charts/github-token-manager/Chart.yaml @@ -4,4 +4,4 @@ name: github-token-manager description: A Helm chart for github-token-manager type: application -version: 0.4.0 +version: 0.5.0 diff --git a/deploy/charts/github-token-manager/templates/deployment.yaml b/deploy/charts/github-token-manager/templates/deployment.yaml index 680d73e..055d5d2 100644 --- a/deploy/charts/github-token-manager/templates/deployment.yaml +++ b/deploy/charts/github-token-manager/templates/deployment.yaml @@ -93,6 +93,9 @@ spec: - mountPath: /config name: config readOnly: true + {{- with $manager.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} {{- with $manager.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -113,3 +116,6 @@ spec: defaultMode: 444 optional: true secretName: {{ .Values.config.secretName }} + {{- with $manager.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/deploy/charts/github-token-manager/values.yaml b/deploy/charts/github-token-manager/values.yaml index e012fdb..362dcb4 100644 --- a/deploy/charts/github-token-manager/values.yaml +++ b/deploy/charts/github-token-manager/values.yaml @@ -65,6 +65,8 @@ metrics: ## tolerations: list of tolerations (optional) ## nodeSelector: node selector (optional) ## env: list of additional environment variables to set on the manager container +## extraVolumes: list of additional pod volumes (optional) +## extraVolumeMounts: list of additional manager container volume mounts (optional) ## resources: manager container resource requests and limits ## manager ## repository: image repository @@ -81,6 +83,10 @@ manager: # additional environment variables to set on the controller container # e.g. `[{name: VAULT_ADDR, value: http://vault:8200}]` env: [] + # additional volumes and mounts for the manager pod/container, e.g. to extend + # the trusted CAs: set env SSL_CERT_DIR to the mountPath of a ConfigMap of PEMs + extraVolumes: [] + extraVolumeMounts: [] extraArgs: {} resources: limits: From 122b146e31047c0cba5783b8b0a3aff8d80a96b5 Mon Sep 17 00:00:00 2001 From: Robin Breathe Date: Thu, 5 Nov 2026 13:27:52 +0100 Subject: [PATCH 2/3] docs: mark extra CA ConfigMap optional in proxy example Show optional: true on the CA ConfigMap volume so a missing ConfigMap leaves only the system CAs, and list Go's default CA directories in SSL_CERT_DIR so system trust stays intact regardless of the image's truststore layout. Co-Authored-By: Claude Sonnet 5.5 --- README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 758ec52..b0b1518 100644 --- a/README.md +++ b/README.md @@ -124,25 +124,28 @@ Supported providers: `aws` (KMS), `azure` (Key Vault), `gcp` (Cloud KMS), `vault **Behind a TLS-inspecting proxy:** -To trust additional CAs (e.g. a firewall's inspection CA) *on top of* the system roots, mount them as PEM files and point `SSL_CERT_DIR` at the directory (Go loads it in addition to the system bundle; don't use `SSL_CERT_FILE`, which replaces it). Proxy settings (`HTTPS_PROXY`/`NO_PROXY`) are honoured too. +To trust additional CAs (e.g. a firewall's inspection CA) *on top of* the system roots, mount them as PEM files and add the directory to `SSL_CERT_DIR` (don't use `SSL_CERT_FILE`, which replaces the system bundle). Proxy settings (`HTTPS_PROXY`/`NO_PROXY`) are honoured too. + +`SSL_CERT_DIR` replaces Go's default CA *directory* list (`/etc/ssl/certs`, `/etc/pki/tls/certs`) but not its bundle-file lookup, so list the defaults explicitly: this keeps system trust intact whichever layout the image uses, including custom builds. ```yaml # Helm values manager: env: - name: SSL_CERT_DIR - value: /etc/ssl/extra-ca + value: /etc/ssl/certs:/etc/pki/tls/certs:/etc/ssl/extra-ca extraVolumes: - name: extra-ca configMap: name: corp-ca # ConfigMap whose keys are PEM-encoded CA certificates + optional: true # if absent, the directory is empty and only the system CAs are trusted extraVolumeMounts: - name: extra-ca mountPath: /etc/ssl/extra-ca readOnly: true ``` -CAs are loaded once at startup; restart the pod after rotating them. +CAs are loaded once at startup; restart the pod after creating or rotating the ConfigMap. ### Token Resources From 320e0587179b63ec9317ba9e493a5a074c61bdee Mon Sep 17 00:00:00 2001 From: Robin Breathe Date: Thu, 5 Nov 2026 14:56:17 +0100 Subject: [PATCH 3/3] ci(e2e): fail instead of falling back to Helm v3 setup-helm silently fell back to v3.18.4 when the latest-release lookup failed, but the e2e suite needs Helm v4 (--wait=watcher). Request the latest release and disable the fallback so a failed lookup fails the job visibly. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/e2e.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 36cf06b..c8ecad8 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -32,6 +32,10 @@ jobs: - name: Setup helm uses: azure/setup-helm@v5 + with: + version: latest + # fail instead of silently falling back to Helm v3, which lacks --wait=watcher + latest-fallback: "false" - name: Setup kind uses: helm/kind-action@v1