CM-830: Integrate trust-manager with cert-manager-operator #1914

chiragkyal · 2025-12-23T19:59:24Z

Extend cert-manager-operator to deploy and manage trust-manager as an operand, providing a solution for trust bundle distribution on OpenShift.

openshift-ci · 2025-12-23T19:59:36Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign trilokgeer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

enhancements/cert-manager/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2025-12-23T20:02:44Z

@chiragkyal: This pull request references CM-830 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Extend cert-manager-operator to deploy and manage trust-manager
as an operand, providing a solution for trust bundle distribution
on OpenShift.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-12-23T20:04:05Z

@chiragkyal: This pull request references CM-830 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Extend cert-manager-operator to deploy and manage trust-manager as an operand, providing a solution for trust bundle distribution on OpenShift.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

chiragkyal · 2025-12-23T20:19:25Z

/cc @bharath-b-rh @lunarwhite

bharath-b-rh

LGTM mostly. I will need a second read.

enhancements/cert-manager/trust-manager-controller.md

bharath-b-rh · 2025-12-24T10:54:58Z

enhancements/cert-manager/trust-manager-controller.md

+
+	// status is the most recently observed status of the TrustManager.
+	// +kubebuilder:validation:Optional
+	// +optional


Please have all optional fields as pointer types, to explicitly interpret non-configured values.

I think, as per this(https://github.com/openshift/enhancements/blob/master/dev-guide/api-conventions.md#optional-fields-should-not-be-pointers-in-custom-resource-based-apis), we should not use pointers for optional fields.

enhancements/cert-manager/trust-manager-controller.md

bharath-b-rh · 2025-12-24T11:02:14Z

enhancements/cert-manager/trust-manager-controller.md

+  - `trust-manager-controller` based on the configuration in `trustmanagers.operator.openshift.io` CR, installs `trust-manager` 
+    in the `cert-manager` namespace.
+  - If `defaultCAPackage.enabled` is true:
+    1. Controller creates a ConfigMap with annotation `config.openshift.io/inject-trusted-cabundle: true`


I would suggest having the configmap created irrespective of whether defaultCAPackage is enabled and instead depend on the featuregate to create it. i.e. if feature enabled create the configmap and have it ready.

instead depend on the featuregate to create it. i.e. if feature enabled create the configmap and have it ready.

Once we will promote to GA, does it mean that irrespective of whether defaultCAPackage is enabled or disabled, both the configmaps will always be created, and we will only add/remove the volumeMounts in the deployment based on the flag. Is my understanding correct?

This enhancement describes extending cert-manager-operator to deploy and manage trust-manager as an operand. Signed-off-by: chiragkyal <ckyal@redhat.com>

chiragkyal · 2026-01-02T08:38:28Z

enhancements/cert-manager/trust-manager-controller.md

+	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:Optional
+	// +optional
+	TrustNamespace string `json:"trustNamespace,omitempty"`


Should we make TrustNamespace an immutable field? Otherwise, changing the TrustNamespace on a running cluster is a destructive action. The operand would lose access to its current data source.

Signed-off-by: chiragkyal <ckyal@redhat.com>

openshift-ci · 2026-01-03T13:46:48Z

@chiragkyal: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

lunarwhite

It looks fairly good to me 👍. I'm very glad to see that the upstream planned Bundle API changes/deprecations are mentioned in this EP. As we move toward GA (future), we might need to adjust our custom APIs based on the stabilized upstream CRD APIs accordingly.

lunarwhite · 2026-01-06T11:05:00Z

enhancements/cert-manager/trust-manager-controller.md

+  - Different log levels and formats
+  - Custom trust namespace
+  - Secret targets policy (Disabled/All/Specific)
+  - DefaultCAPackage policy (Enabled/Disabled)


Suggested change

- Different log levels and formats

- Custom trust namespace

- Secret targets policy (Disabled/All/Specific)

- DefaultCAPackage policy (Enabled/Disabled)

- Custom trust namespace

- Secret targets policy (Disabled/All/Specific)

- DefaultCAPackage policy (Enabled/Disabled)

- FilterExpiredCertificates policy (Enabled/Disabled)

- Common configurations: log levels and formats, resources, node selector, tolerations and affinity

lunarwhite · 2026-01-06T11:13:16Z

enhancements/cert-manager/trust-manager-controller.md

+## Upgrade / Downgrade Strategy
+
+On upgrade:
+- cert-manager-operator will have functionality to enable trust-manager and based on the administrator configuration, 
+  trust-manager will be deployed and available for usage.


Should we explicitly mention that directly upgrading from a TP version to a GA version is not supported? Users are expected to perform a fresh installation rather than migrating from a TP to GA considering there might be significant API changes.

lunarwhite · 2026-01-06T11:17:36Z

enhancements/cert-manager/trust-manager-controller.md

+  oc get Certificates,Issuers,ClusterRoles,ClusterRoleBindings,Deployments,Roles,RoleBindings,Services,ServiceAccounts,ValidatingWebhookConfigurations,ConfigMaps -l "trustmanager.openshift.operator.io/managed-by=trust-manager-controller" -n cert-manager
+
+  # If trust namespace is different from cert-manager, also check for Role/RoleBinding there
+  # oc get Roles,RoleBindings -l "trustmanager.openshift.operator.io/managed-by=trust-manager-controller" -n <trust-namespace>


I don't see trustmanager.openshift.operator.io/managed-by=trust-manager-controller is mentioned somewhere else. Perhaps you want to mention app.kubernetes.io/name=cert-manager-trust-manager or app.kubernetes.io/instance=cert-manager-trust-manager?

lunarwhite · 2026-01-06T11:25:24Z

enhancements/cert-manager/trust-manager-controller.md

+* `app: cert-manager-trust-manager`
+* `app.kubernetes.io/name: cert-manager-trust-manager`
+* `app.kubernetes.io/instance: cert-manager-trust-manager`
+* `app.kubernetes.io/version: "v0.20.2"`


Just bringing this up because I noticed the latest tag is now v0.20.3 (released a few weeks ago). Maybe we could build on top of that in actual implementation. I understand that when this EP was being drafted, perhaps v0.20.3 hadn't been released yet, and it doesn't hurt to reference v0.20.2 for the proposal.

lunarwhite · 2026-01-06T11:27:56Z

enhancements/cert-manager/trust-manager-controller.md

+### Workflow Description
+


nitpick: It'd be great if we could add a mermaid diagram to help illustrate the end-end workflow.

mytreya-rh · 2026-01-08T05:50:03Z

We need to flesh out the defaultca package implementation to avoid/alleviate the cases where the source ConfigMap is not populated in time for the operator to create the operand deployment, and the rollout of operand if the source ConfigMap changes. But this was discussed and we agreed to defer to it during implementation to try out the options.
w.r.t cluster privileges needed for the operator: We are still waiting on https://redhat-internal.slack.com/archives/C3VS0LV41/p1759755909042599 and thus we will need to take it up later

/lgtm
/hold for @bharath-b-rh and @lunarwhite on design and test aspects
cc: @TrilokGeer

openshift-ci bot requested review from TrilokGeer and mytreya-rh December 23, 2025 19:59

chiragkyal changed the title ~~Add proposal for trust-manager integration in cert-manager-operator~~ Integrate trust-manager with cert-manager-operator Dec 23, 2025

chiragkyal changed the title ~~Integrate trust-manager with cert-manager-operator~~ CM-830: Integrate trust-manager with cert-manager-operator Dec 23, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 23, 2025

chiragkyal force-pushed the trust-manager branch from 5728ef0 to fcc188e Compare December 23, 2025 20:09

openshift-ci bot requested review from bharath-b-rh and lunarwhite December 23, 2025 20:19

chiragkyal force-pushed the trust-manager branch from fcc188e to 624ef6b Compare December 24, 2025 05:12

bharath-b-rh reviewed Dec 24, 2025

View reviewed changes

Add proposal for trust-manager integration in cert-manager-operator

76a2381

This enhancement describes extending cert-manager-operator to deploy and manage trust-manager as an operand. Signed-off-by: chiragkyal <ckyal@redhat.com>

chiragkyal force-pushed the trust-manager branch from 624ef6b to 76a2381 Compare December 24, 2025 18:30

chiragkyal commented Jan 2, 2026

View reviewed changes

chiragkyal force-pushed the trust-manager branch 3 times, most recently from f43588f to c31d38c Compare January 2, 2026 14:41

Address review comments

b7c9665

Signed-off-by: chiragkyal <ckyal@redhat.com>

chiragkyal force-pushed the trust-manager branch from c31d38c to b7c9665 Compare January 3, 2026 13:36

lunarwhite reviewed Jan 6, 2026

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 8, 2026

openshift-ci bot assigned mytreya-rh Jan 8, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 8, 2026

CM-830: Integrate trust-manager with cert-manager-operator #1914

Are you sure you want to change the base?

CM-830: Integrate trust-manager with cert-manager-operator #1914

Conversation

chiragkyal commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Dec 23, 2025

Uh oh!

openshift-ci-robot commented Dec 23, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Dec 23, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chiragkyal commented Dec 23, 2025

Uh oh!

bharath-b-rh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chiragkyal Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jan 3, 2026

Uh oh!

lunarwhite left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mytreya-rh commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

chiragkyal commented Dec 23, 2025 •

edited

Loading

openshift-ci-robot commented Dec 23, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Dec 23, 2025 •

edited by openshift-ci bot

Loading

chiragkyal Jan 2, 2026 •

edited

Loading