feat(charts): document every value, expose runner apiTokenSource, fix metrics TLS name - #117
Closed
ryanmcafee wants to merge 1 commit into
Closed
ryanmcafee wants to merge 1 commit into
ryanmcafee wants to merge 1 commit into
Conversation
… metrics TLS name Operator chart (1.3.5): declare nameOverride, controllerManager.pod.labels and crd.keep, which templates already read but values.yaml never listed; fix the ServiceMonitor serverName, which pointed at a Service that does not exist so TLS scraping failed whenever prometheus and cert-manager were both enabled; document all values, the manager environment variables and the ServiceAccount annotation, Secrets Manager and metrics setups in the README; add a test that fails when a template reads an undeclared value. Runner chart (1.1.0): expose apiTokenSource so the runner can read its API token from AWS Secrets Manager or a named Kubernetes Secret, which the CRD already supported; refuse to render with a placeholder accountID or apiToken instead of registering a runner with a literal "<api-token>"; rewrite the README, whose example used values that do not exist and whose upgrade and uninstall commands acted on the operator release, and state that the runner has no ServiceAccount of its own so job pod identity is configured on the operator chart; add render tests. Co-Authored-By: Ryan McAfee - Bot <ryan.mcafee+bot@jupiterone.com>
ryanmcafee
deleted the
feat/chart-service-account-annotations-and-docs
branch
September 16, 2026 21:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit of both charts against their templates and the operator CRDs. Based on
origin/main; independent of #116.Operator chart 1.3.4 -> 1.3.5.
nameOverride,controllerManager.pod.labelsandcrd.keepwere read by templates but absent fromvalues.yaml; now declared. ServiceMonitorserverNamenamed...-controller-manager-metrics-service, a Service that does not exist, so TLS scraping failed withprometheus.enable+certmanager.enable; now matches the metrics Service and the cert-managerdnsNames. README parameters table covered 4 values; now all of them plus the manager env vars, ServiceAccount annotations (IRSA), Secrets Manager and metrics examples. New test fails if a template reads an undeclared value.Runner chart 1.0.3 -> 1.1.0. CRD supports
apiTokenSource(Kubernetes Secret or AWS Secrets Manager) but the chart only exposed the deprecatedsecretAPITokenName; now exposed with validation. Rendering with a placeholderaccountID/apiTokennow fails instead of registering a runner with a literal<api-token>. README rewritten: example used non-existentcollectorID/authToken, upgrade/uninstall acted on the operator release; adds a parameters table, external-Secret and Secrets Manager examples, and states the runner has no ServiceAccount -- job pod identity is operator-chart config.helm lintclean; 48 render assertions pass across three test scripts. #116 (integration ServiceAccount annotations) will need a rebase onto this forvalues.yaml/README.https://jupiterone.atlassian.net/browse/TD-9103