How to use cert-manager for helper secrets

[MPV]

It would be nice being able to use cert-manager (instead of self-signed CA certs) for the helper secrets.

Would you be up for adding explicit support or docs for this?

[MPV]

For example, here's how the Cilium chart supports configuring this:

• https://github.com/cilium/cilium/blob/cf2f0f392891dea783e46e536f23287fdb0909c9/install/kubernetes/cilium/values.yaml#L1312-L1335

And here's how ARC has this configurable:

• feat: use helm genCA to generate a certificate for the mutating web hook actions/actions-runner-controller#1780

[MPV]

Because as it is now, using the genCA function has the certs changing every time helm rerenders the templates (and in our case we have our CI/CD rerendering and hydrating the manifests as part of our pipeline, which thus comes into an infinite loop caused by this).

More context on the issue and approaches around genCA:

• helm upgrade chart repeat exec genCA function helm/helm#10731 (comment)

[MPV]

I think I've found the way to do this now, using these values:

secrets:
  helper_certificate: "some-secret"
  helper_token: "another-secret"

...and making sure their values are set outside the chart, for example using cert-manager for the helper_certificate.