From 5cf3e3a80ade9d156b60e0691f2c198c3de004ee Mon Sep 17 00:00:00 2001
From: bennotieno <benn.otieno@aleph-alpha.com>
Date: Thu, 13 Aug 2026 12:35:08 +0200
Subject: [PATCH] Fix(chart): use ca.crt CA path for cluster-gateway when
 cert-manager is enabled (#7193)

* Fix(chart): use ca.crt CA path for cluster-gateway when cert-manager is enabled

- also adds support for backward compatibility

Signed-off-by: Benn Otieno <benn.otieno@aleph-alpha.com>

* Fix(chart): decouple cluster-gateway TLS volume from admissionWebhooks.enabled

Signed-off-by: Benn Otieno <benn.otieno@aleph-alpha.com>

---------

Signed-off-by: Benn Otieno <benn.otieno@aleph-alpha.com>
---
 .../templates/kubevela-controller.yaml        | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/charts/vela-core/templates/kubevela-controller.yaml b/charts/vela-core/templates/kubevela-controller.yaml
index 2eda64d95..b5529e2b0 100644
--- a/charts/vela-core/templates/kubevela-controller.yaml
+++ b/charts/vela-core/templates/kubevela-controller.yaml
@@ -282,10 +282,14 @@ spec:
             {{ if .Values.multicluster.clusterGateway.direct }}
             - "--cluster-gateway-url={{ .Release.Name }}-cluster-gateway-service:9443"
             {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }}
+            {{ if .Values.multicluster.clusterGateway.secureTLS.certManager.enabled }}
+            - "--cluster-gateway-ca-file=/cluster-gateway-tls-cert/ca.crt"
+            {{ else }}
             - "--cluster-gateway-ca-file=/cluster-gateway-tls-cert/ca"
             {{ end }}
             {{ end }}
             {{ end }}
+            {{ end }}
             {{ if .Values.multicluster.metrics.enabled }}
             - "--enable-cluster-metrics"
             {{ end }}
@@ -353,6 +357,8 @@ spec:
           {{- end }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}
+          {{- $needAdmissionTLS := .Values.admissionWebhooks.enabled }}
+          {{- $needClusterGatewayTLS := and .Values.multicluster.enabled .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
           {{ if .Values.admissionWebhooks.enabled }}
           ports:
             - containerPort: {{ .Values.webhookService.port }}
@@ -379,23 +385,29 @@ spec:
             timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
             failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
             successThreshold: {{ .Values.livenessProbe.successThreshold }}
+          {{ end }}
+          {{ if or $needAdmissionTLS $needClusterGatewayTLS }}
           volumeMounts:
+            {{ if $needAdmissionTLS }}
             - mountPath: {{ .Values.admissionWebhooks.certificate.mountPath }}
               name: tls-cert-vol
               readOnly: true
-          {{ if and .Values.multicluster.enabled .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
+            {{ end }}
+            {{ if $needClusterGatewayTLS }}
             - mountPath: /cluster-gateway-tls-cert
               name: tls-cert-vol-cg
               readOnly: true
+            {{ end }}
           {{ end }}
-          {{ end }}
-      {{ if .Values.admissionWebhooks.enabled }}
+      {{ if or $needAdmissionTLS $needClusterGatewayTLS }}
       volumes:
+        {{ if $needAdmissionTLS }}
         - name: tls-cert-vol
           secret:
             defaultMode: 420
             secretName: {{ template "kubevela.fullname" . }}-admission
-      {{ if and .Values.multicluster.enabled .Values.multicluster.clusterGateway.secureTLS.enabled .Values.multicluster.clusterGateway.direct }}
+        {{ end }}
+        {{ if $needClusterGatewayTLS }}
         - name: tls-cert-vol-cg
           secret:
             defaultMode: 420