mirror of
https://github.com/enix/x509-certificate-exporter.git
synced 2026-08-20 12:36:30 +00:00
Thibault VINCENT
b4f3f84086
Complete rewrite of the codebase, the build pipeline, the dev loop, and the release pipeline. For the exporter itself, refer to the updated README and Helm chart documentation to discover the new functionality and assess the impact of the breaking changes on your existing setup. Build & release: - QA/CI pipelines now run through a Dagger Module, wrapped by Taskfile.yml for the developer interface. - Releases run through GoReleaser: cross-compiled binaries × OS/arch, archives, checksums, multi-arch container images (busybox + scratch variants on linux/amd64,arm64,riscv64), pushed to ghcr/quay/docker.io. - Everything is cosign-signed (binaries, images, Helm chart). Image CycloneDX SBOMs are attached as cosign attestations. SLSA-3 provenance is attached to every GitHub Release. - The Helm chart is published as a cosign-signed OCI artifact. - Versioning and changelog are automated by release-please from Conventional Commits. Dev experience: - Local loop driven by Tilt + k3d + Dagger; one command brings up an exporter with seeded fixtures and a Prometheus scraping it. - End-to-end tests run on a throwaway k3d cluster against the real rendered chart. BREAKING CHANGE: the Helm chart is now published exclusively as an OCI artifact at oci://quay.io/enix/charts/x509-certificate-exporter. The legacy Helm repository at https://charts.enix.io is no longer updated; users must switch to the OCI reference (Helm 3.8+ required). Installation: `helm install x509-certificate-exporter oci://quay.io/enix/charts/x509-certificate-exporter --version <vX.Y.Z>`. BREAKING CHANGE: the Helm chart's values schema may diverge from v3 in edge cases despite a best-effort to preserve backwards compatibility. Review your existing values against the updated chart/values.yaml before upgrading. A JSON schema (chart/values.schema.json) is shipped with the chart so `helm install` / `helm upgrade` will reject any values that no longer match the expected shape, surfacing regressions early instead of at runtime. BREAKING CHANGE: Alpine-based container images are no longer published. The release pipeline now ships only the `busybox` and `scratch` variants on linux/amd64,arm64,riscv64. Users pulling `*-alpine` tags must switch to one of the new variants — `busybox` is the closest functional replacement (still has a shell), `scratch` is the minimal distroless option.
74 lines
2.1 KiB
YAML
74 lines
2.1 KiB
YAML
# Helm values shared by the Tilt dev loop and `task test:e2e`. These extend the
|
|
# chart's defaults to cover every fixture in dev/scenarios:
|
|
#
|
|
# - kubernetes.io/tls (PEM in tls.crt) — default behaviour
|
|
# - Opaque PEM with custom data keys
|
|
# - Opaque PKCS#12 (encrypted via passphraseKey + passwordless via
|
|
# tryEmptyPassphrase)
|
|
# - ConfigMaps holding tls.crt
|
|
# - Per-cert error metrics, relative-time metrics
|
|
# - exposeSecretLabels for the rich-DN scenario
|
|
# - excludeNamespaceLabels to verify the negative case
|
|
---
|
|
secretsExporter:
|
|
enabled: true
|
|
|
|
secretTypes:
|
|
# PEM in standard TLS secrets
|
|
- type: kubernetes.io/tls
|
|
key: tls.crt
|
|
# PEM in Opaque secrets (custom data key)
|
|
- type: Opaque
|
|
key: cert.pem
|
|
- type: Opaque
|
|
key: tls.crt
|
|
- type: Opaque
|
|
key: ca.crt
|
|
# Encrypted PKCS#12 — passphrase pulled from a sibling key in the same Secret
|
|
- type: Opaque
|
|
key: keystore.p12
|
|
format: pkcs12
|
|
pkcs12:
|
|
passphraseKey: keystore-passphrase
|
|
# PKCS#12 truststore (multiple CAs, no leaf)
|
|
- type: Opaque
|
|
key: truststore.p12
|
|
format: pkcs12
|
|
pkcs12:
|
|
passphraseKey: keystore-passphrase
|
|
# Passwordless PKCS#12 — tryEmptyPassphrase falls back to ""
|
|
- type: Opaque
|
|
key: keystore-empty.p12
|
|
format: pkcs12
|
|
pkcs12:
|
|
tryEmptyPassphrase: true
|
|
|
|
# Watch ConfigMaps holding a tls.crt key.
|
|
configMapKeys:
|
|
- tls.crt
|
|
|
|
# Skip the negatively-named namespace (proves namespace name exclusion).
|
|
excludeNamespaces:
|
|
- x509ce-excl-name
|
|
|
|
# Skip the negatively-labelled namespace (proves namespace label exclusion).
|
|
excludeNamespaceLabels:
|
|
- x509ce-test/ignore=true
|
|
|
|
# Skip individual Secrets carrying the x509ce-test/ignore=true label
|
|
# (proves secret-level label exclusion is wired server-side).
|
|
excludeLabels:
|
|
- x509ce-test/ignore=true
|
|
|
|
# Surface a few labels from labelled Secrets as Prometheus labels.
|
|
exposeSecretLabels:
|
|
- environment
|
|
- team
|
|
|
|
# Enable both extra metric families so the e2e suite can assert on them.
|
|
exposePerCertificateErrorMetrics: true
|
|
exposeRelativeMetrics: true
|
|
|
|
image:
|
|
pullPolicy: Always
|