typekro 0.44.1 → 0.45.0

package/dist/factories/cert-manager/compositions/cert-manager-bootstrap.js

@@ -1,11 +1,11 @@
 import { kubernetesComposition } from '../../../core/composition/imperative.js';
 import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
-import { ensureVersionPrefix } from '../../../utils/string.js';
+import { Cel } from '../../../core/references/cel.js';
 import { helmReleaseConditionSummary } from '../../helm/status.js';
 import { namespace } from '../../kubernetes/core/namespace.js';
 import { certManagerHelmRelease, certManagerHelmRepository } from '../resources/helm.js';
 import { CertManagerBootstrapConfigSchema, CertManagerBootstrapStatusSchema, } from '../types.js';
-import { mapCertManagerConfigToHelmValues } from '../utils/helm-values-mapper.js';
+import { DEFAULT_CERT_MANAGER_NAMESPACE, DEFAULT_CERT_MANAGER_VERSION, mapCertManagerConfigToHelmValues, } from '../utils/helm-values-mapper.js';
 /**
  * Cert-Manager Bootstrap Composition
  *
@@ -30,16 +30,18 @@ import { mapCertManagerConfigToHelmValues } from '../utils/helm-values-mapper.js
  *   name: 'cert-manager',
  *   namespace: 'cert-manager',
  *   version: '1.19.3',
- *   installCRDs: true,
+ *   crds: { enabled: true, keep: true },
+ *   replicaCount: 2,
  *   controller: {
  *     resources: {
  *       requests: { cpu: '100m', memory: '128Mi' },
  *       limits: { cpu: '500m', memory: '512Mi' }
- *     }
+ *     },
+ *     podDisruptionBudget: { enabled: true }
  *   },
  *   webhook: {
- *     enabled: true,
- *     replicaCount: 2
+ *     replicaCount: 2,
+ *     podDisruptionBudget: { enabled: true }
  *   },
  *   prometheus: {
  *     enabled: true,
@@ -55,199 +57,23 @@ export const certManagerBootstrap = kubernetesComposition({
     spec: CertManagerBootstrapConfigSchema,
     status: CertManagerBootstrapStatusSchema,
 }, (spec) => {
-    // TODO: Future Enhancement - Create a full cert-manager composition that includes:
-    // 1. Direct Kubernetes resources (Deployments, Services, etc.) for status references
-    // 2. CRD queries for real-time certificate/issuer counts
-    // 3. Service status references for dynamic endpoint URLs
-    //
-    // For now, this bootstrap composition focuses on Helm-based deployment
-    // Apply default configuration values
-    const fullConfig = {
-        // Basic defaults
-        namespace: spec.namespace || 'cert-manager',
-        version: spec.version || '1.19.3',
-        installCRDs: spec.installCRDs !== undefined ? spec.installCRDs : true, // TypeKro installs CRDs by default
-        replicaCount: spec.replicaCount || 1,
-        // Global defaults
-        global: {
-            leaderElection: {
-                namespace: spec.global?.leaderElection?.namespace || spec.namespace || 'cert-manager',
-            },
-            logLevel: spec.global?.logLevel || 2,
-            podSecurityPolicy: {
-                enabled: spec.global?.podSecurityPolicy?.enabled || false,
-                useAppArmor: spec.global?.podSecurityPolicy?.useAppArmor || true,
-            },
-        },
-        // Strategy defaults
-        strategy: {
-            type: spec.strategy?.type || 'RollingUpdate',
-            rollingUpdate: {
-                maxSurge: spec.strategy?.rollingUpdate?.maxSurge || '25%',
-                maxUnavailable: spec.strategy?.rollingUpdate?.maxUnavailable || '25%',
-            },
-        },
-        // Controller defaults
-        // NOTE: Each field is explicitly handled with a fallback default.
-        // Do NOT spread ...spec.controller at the end — it would overwrite
-        // the carefully-built nested objects (image, resources, serviceAccount).
-        controller: {
-            image: {
-                repository: spec.controller?.image?.repository || 'quay.io/jetstack/cert-manager-controller',
-                tag: spec.controller?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
-                pullPolicy: spec.controller?.image?.pullPolicy || 'IfNotPresent',
-            },
-            resources: {
-                requests: {
-                    cpu: spec.controller?.resources?.requests?.cpu || '10m',
-                    memory: spec.controller?.resources?.requests?.memory || '32Mi',
-                },
-                limits: {
-                    cpu: spec.controller?.resources?.limits?.cpu || '100m',
-                    memory: spec.controller?.resources?.limits?.memory || '128Mi',
-                },
-            },
-            serviceAccount: {
-                create: spec.controller?.serviceAccount?.create !== undefined
-                    ? spec.controller.serviceAccount.create
-                    : true,
-                name: spec.controller?.serviceAccount?.name || '',
-                annotations: spec.controller?.serviceAccount?.annotations || {},
-            },
-            nodeSelector: spec.controller?.nodeSelector || {},
-        },
-        // Webhook defaults
-        // NOTE: cert-manager 1.19+ removed 'enabled', 'mutatingAdmissionWebhooks',
-        // and 'validatingAdmissionWebhooks' from the webhook section.
-        // Webhook is always enabled; admission webhooks are configured via
-        // 'mutatingWebhookConfiguration' and 'validatingWebhookConfiguration'.
-        webhook: {
-            replicaCount: spec.webhook?.replicaCount || 1,
-            image: {
-                repository: spec.webhook?.image?.repository || 'quay.io/jetstack/cert-manager-webhook',
-                tag: spec.webhook?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
-                pullPolicy: spec.webhook?.image?.pullPolicy || 'IfNotPresent',
-            },
-            resources: {
-                requests: {
-                    cpu: spec.webhook?.resources?.requests?.cpu || '10m',
-                    memory: spec.webhook?.resources?.requests?.memory || '32Mi',
-                },
-                limits: {
-                    cpu: spec.webhook?.resources?.limits?.cpu || '100m',
-                    memory: spec.webhook?.resources?.limits?.memory || '128Mi',
-                },
-            },
-            serviceAccount: {
-                create: spec.webhook?.serviceAccount?.create !== undefined
-                    ? spec.webhook.serviceAccount.create
-                    : true,
-                name: spec.webhook?.serviceAccount?.name || '',
-                annotations: spec.webhook?.serviceAccount?.annotations || {},
-            },
-            nodeSelector: spec.webhook?.nodeSelector || {},
-        },
-        // CA Injector defaults
-        cainjector: {
-            enabled: spec.cainjector?.enabled !== undefined ? spec.cainjector.enabled : true,
-            replicaCount: spec.cainjector?.replicaCount || 1,
-            image: {
-                repository: spec.cainjector?.image?.repository || 'quay.io/jetstack/cert-manager-cainjector',
-                tag: spec.cainjector?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
-                pullPolicy: spec.cainjector?.image?.pullPolicy || 'IfNotPresent',
-            },
-            resources: {
-                requests: {
-                    cpu: spec.cainjector?.resources?.requests?.cpu || '10m',
-                    memory: spec.cainjector?.resources?.requests?.memory || '32Mi',
-                },
-                limits: {
-                    cpu: spec.cainjector?.resources?.limits?.cpu || '100m',
-                    memory: spec.cainjector?.resources?.limits?.memory || '128Mi',
-                },
-            },
-            serviceAccount: {
-                create: spec.cainjector?.serviceAccount?.create !== undefined
-                    ? spec.cainjector.serviceAccount.create
-                    : true,
-                name: spec.cainjector?.serviceAccount?.name || '',
-                annotations: spec.cainjector?.serviceAccount?.annotations || {},
-            },
-            nodeSelector: spec.cainjector?.nodeSelector || {},
-        },
-        // ACME solver defaults
-        // NOTE: cert-manager 1.19+ only supports 'image' in acmesolver section.
-        // 'resources' and 'nodeSelector' were removed from the chart schema.
-        acmesolver: {
-            image: {
-                repository: spec.acmesolver?.image?.repository || 'quay.io/jetstack/cert-manager-acmesolver',
-                tag: spec.acmesolver?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
-                pullPolicy: spec.acmesolver?.image?.pullPolicy || 'IfNotPresent',
-            },
-            ...spec.acmesolver,
-        },
-        // Startup API check defaults
-        // IMPORTANT: startupapicheck validates the webhook is working before marking cert-manager as ready
-        // This is ENABLED by default to ensure accurate readiness reporting and prevent
-        // "webhook not found" errors when deploying cert-manager CRDs (Certificate, ClusterIssuer, etc.)
-        // It runs as a post-install Helm hook that verifies the cert-manager API is responding
-        // Set enabled: false to disable if you have custom readiness requirements
-        // Timeout increased to 5m to handle slower environments (configurable via startupapicheck.timeout)
-        startupapicheck: {
-            enabled: spec.startupapicheck?.enabled !== false, // Enabled by default, disable only if explicitly set to false
-            ...(spec.startupapicheck?.enabled !== false && {
-                image: {
-                    repository: spec.startupapicheck?.image?.repository || 'quay.io/jetstack/cert-manager-ctl',
-                    tag: spec.startupapicheck?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
-                    pullPolicy: spec.startupapicheck?.image?.pullPolicy || 'IfNotPresent',
-                },
-                resources: {
-                    requests: {
-                        cpu: spec.startupapicheck?.resources?.requests?.cpu || '10m',
-                        memory: spec.startupapicheck?.resources?.requests?.memory || '32Mi',
-                    },
-                    limits: {
-                        cpu: spec.startupapicheck?.resources?.limits?.cpu || '100m',
-                        memory: spec.startupapicheck?.resources?.limits?.memory || '128Mi',
-                    },
-                },
-                nodeSelector: spec.startupapicheck?.nodeSelector || {},
-                timeout: spec.startupapicheck?.timeout || '5m', // Increased from 1m to handle slower environments
-                backoffLimit: spec.startupapicheck?.backoffLimit || 4,
-            }),
-        },
-        // Prometheus defaults
-        prometheus: {
-            enabled: spec.prometheus?.enabled || false,
-            servicemonitor: {
-                enabled: spec.prometheus?.servicemonitor?.enabled || false,
-                prometheusInstance: spec.prometheus?.servicemonitor?.prometheusInstance || 'default',
-                targetPort: spec.prometheus?.servicemonitor?.targetPort || 9402,
-                path: spec.prometheus?.servicemonitor?.path || '/metrics',
-                interval: spec.prometheus?.servicemonitor?.interval || '60s',
-                scrapeTimeout: spec.prometheus?.servicemonitor?.scrapeTimeout || '30s',
-                honorLabels: spec.prometheus?.servicemonitor?.honorLabels || false,
-            },
-            ...spec.prometheus,
-        },
-        // Note: We do NOT spread ...spec here. Each field above already handles
-        // spec values with proper fallbacks. A final ...spec would overwrite all
-        // carefully-constructed defaults (e.g., spec.controller = { extraArgs: ['--flag'] }
-        // would wipe out all default image/resources/serviceAccount config).
-        // Any additional spec fields not explicitly handled above are passed through
-        // via the nested ...spec.X spreads within each section.
-        name: spec.name || 'cert-manager',
-    };
+    // Every optional spec field is a schema proxy in KRO mode, so defaults are
+    // applied with Cel.default (plain `??` for direct-mode values) and the
+    // values mapper places fields without branching on them. JavaScript `||`
+    // here used to collapse KRO renders to static defaults: replicas stayed at
+    // 1 and the leader-election lease fell back to the chart's kube-system.
+    const installNamespace = Cel.default(spec.namespace, DEFAULT_CERT_MANAGER_NAMESPACE);
+    const version = Cel.default(spec.version, DEFAULT_CERT_MANAGER_VERSION);
     // Map configuration to Helm values
-    const helmValues = mapCertManagerConfigToHelmValues(fullConfig);
+    const helmValues = mapCertManagerConfigToHelmValues(spec);
     // Create namespace for cert-manager (required before HelmRelease)
     const _certManagerNamespace = namespace({
         metadata: {
-            name: spec.namespace || 'cert-manager',
+            name: installNamespace,
             labels: {
                 'app.kubernetes.io/name': 'cert-manager',
                 'app.kubernetes.io/instance': spec.name,
-                'app.kubernetes.io/version': spec.version || '1.19.3',
+                'app.kubernetes.io/version': version,
                 'app.kubernetes.io/managed-by': 'typekro',
             },
         },
@@ -262,8 +88,8 @@ export const certManagerBootstrap = kubernetesComposition({
     // Create HelmRelease for cert-manager deployment
     const _helmRelease = certManagerHelmRelease({
         name: spec.name,
-        namespace: spec.namespace || 'cert-manager',
-        version: spec.version || '1.19.3',
+        namespace: installNamespace,
+        version,
         values: helmValues,
         repositoryName: 'cert-manager-repo', // Match the repository name
         id: 'certManagerHelmRelease',
@@ -276,7 +102,7 @@ export const certManagerBootstrap = kubernetesComposition({
     return {
         ready: releaseStatus.ready,
         phase: releaseStatus.phase,
-        version: spec.version || '1.19.3',
+        version,
         controllerReady: releaseStatus.ready,
         webhookReady: releaseStatus.ready,
         cainjectorReady: releaseStatus.ready,
@@ -288,7 +114,7 @@ export const certManagerBootstrap = kubernetesComposition({
             // when deployed in direct mode. Fix: implement nested CEL resolution in ReferenceResolver
             // before exposing cert-manager direct-mode deployments in production workflows.
             installed: true,
-            version: spec.version || '1.19.3',
+            version,
         },
     };
 });

package/dist/factories/cert-manager/compositions/cert-manager-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"cert-manager-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/cert-manager/compositions/cert-manager-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAEL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAG7B,qBAAqB,CACvB;IACE,IAAI,EAAE,wBAAwB;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,gCAAgC;IACtC,MAAM,EAAE,gCAAgC;CACzC,EACD,CAAC,IAAgC,EAAE,EAAE;IACnC,mFAAmF;IACnF,qFAAqF;IACrF,yDAAyD;IACzD,yDAAyD;IACzD,EAAE;IACF,uEAAuE;IACvE,qCAAqC;IACrC,MAAM,UAAU,GAA+B;QAC7C,iBAAiB;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,cAAc;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,mCAAmC;QAC1G,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;QAEpC,kBAAkB;QAClB,MAAM,EAAE;YACN,cAAc,EAAE;gBACd,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,cAAc;aACtF;YACD,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC;YACpC,iBAAiB,EAAE;gBACjB,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,IAAI,KAAK;gBACzD,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,WAAW,IAAI,IAAI;aACjE;SACF;QAED,oBAAoB;QACpB,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,eAAe;YAC5C,aAAa,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,IAAI,KAAK;gBACzD,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,IAAI,KAAK;aACtE;SACF;QAED,sBAAsB;QACtB,kEAAkE;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,UAAU,EACR,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,0CAA0C;gBAClF,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;gBACjF,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,cAAc;aACjE;YACD,SAAS,EAAE;gBACT,QAAQ,EAAE;oBACR,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,KAAK;oBACvD,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM;iBAC/D;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM;oBACtD,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO;iBAC9D;aACF;YACD,cAAc,EAAE;gBACd,MAAM,EACJ,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,KAAK,SAAS;oBACnD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM;oBACvC,CAAC,CAAC,IAAI;gBACV,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE;gBACjD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,IAAI,EAAE;aAChE;YACD,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE;SAClD;QAED,mBAAmB;QACnB,2EAA2E;QAC3E,8DAA8D;QAC9D,mEAAmE;QACnE,uEAAuE;QACvE,OAAO,EAAE;YACP,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC;YAC7C,KAAK,EAAE;gBACL,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,uCAAuC;gBACtF,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAC9E,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,cAAc;aAC9D;YACD,SAAS,EAAE;gBACT,QAAQ,EAAE;oBACR,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,KAAK;oBACpD,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM;iBAC5D;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM;oBACnD,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO;iBAC3D;aACF;YACD,cAAc,EAAE;gBACd,MAAM,EACJ,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,KAAK,SAAS;oBAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM;oBACpC,CAAC,CAAC,IAAI;gBACV,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,IAAI,EAAE;aAC7D;YACD,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE;SAC/C;QAED,uBAAuB;QACvB,UAAU,EAAE;YACV,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAChF,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,IAAI,CAAC;YAChD,KAAK,EAAE;gBACL,UAAU,EACR,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,0CAA0C;gBAClF,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;gBACjF,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,cAAc;aACjE;YACD,SAAS,EAAE;gBACT,QAAQ,EAAE;oBACR,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,KAAK;oBACvD,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM;iBAC/D;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM;oBACtD,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO;iBAC9D;aACF;YACD,cAAc,EAAE;gBACd,MAAM,EACJ,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,KAAK,SAAS;oBACnD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM;oBACvC,CAAC,CAAC,IAAI;gBACV,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE;gBACjD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,IAAI,EAAE;aAChE;YACD,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE;SAClD;QAED,uBAAuB;QACvB,wEAAwE;QACxE,qEAAqE;QACrE,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,UAAU,EACR,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,0CAA0C;gBAClF,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;gBACjF,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,cAAc;aACjE;YACD,GAAG,IAAI,CAAC,UAAU;SACnB;QAED,6BAA6B;QAC7B,mGAAmG;QACnG,gFAAgF;QAChF,iGAAiG;QACjG,uFAAuF;QACvF,0EAA0E;QAC1E,mGAAmG;QACnG,eAAe,EAAE;YACf,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,KAAK,KAAK,EAAE,8DAA8D;YAChH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,KAAK,KAAK,IAAI;gBAC7C,KAAK,EAAE;oBACL,UAAU,EACR,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,IAAI,mCAAmC;oBAChF,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;oBACtF,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,IAAI,cAAc;iBACtE;gBACD,SAAS,EAAE;oBACT,QAAQ,EAAE;wBACR,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,KAAK;wBAC5D,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM;qBACpE;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM;wBAC3D,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO;qBACnE;iBACF;gBACD,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,IAAI,EAAE;gBACtD,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,IAAI,IAAI,EAAE,kDAAkD;gBAClG,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,IAAI,CAAC;aACtD,CAAC;SACH;QAED,sBAAsB;QACtB,UAAU,EAAE;YACV,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,KAAK;YAC1C,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,IAAI,KAAK;gBAC1D,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,kBAAkB,IAAI,SAAS;gBACpF,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;gBAC/D,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,IAAI,UAAU;gBACzD,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,IAAI,KAAK;gBAC5D,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,IAAI,KAAK;gBACtE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,IAAI,KAAK;aACnE;YACD,GAAG,IAAI,CAAC,UAAU;SACnB;QAED,wEAAwE;QACxE,yEAAyE;QACzE,oFAAoF;QACpF,qEAAqE;QACrE,6EAA6E;QAC7E,wDAAwD;QACxD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,cAAc;KAClC,CAAC;IAEF,mCAAmC;IACnC,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAEhE,kEAAkE;IAClE,MAAM,qBAAqB,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,cAAc;YACtC,MAAM,EAAE;gBACN,wBAAwB,EAAE,cAAc;gBACxC,4BAA4B,EAAE,IAAI,CAAC,IAAI;gBACvC,2BAA2B,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ;gBACrD,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,EAAE,EAAE,sBAAsB;KAC3B,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,eAAe,GAAG,yBAAyB,CAAC;QAChD,IAAI,EAAE,mBAAmB,EAAE,+CAA+C;QAC1E,SAAS,EAAE,sBAAsB,EAAE,mDAAmD;QACtF,EAAE,EAAE,2BAA2B;KAChC,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,cAAc;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ;QACjC,MAAM,EAAE,UAAU;QAClB,cAAc,EAAE,mBAAmB,EAAE,4BAA4B;QACjE,EAAE,EAAE,wBAAwB;KAC7B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,aAAa,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAChE,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ;QACjC,eAAe,EAAE,aAAa,CAAC,KAAK;QACpC,YAAY,EAAE,aAAa,CAAC,KAAK;QACjC,eAAe,EAAE,aAAa,CAAC,KAAK;QACpC,IAAI,EAAE;YACJ,4FAA4F;YAC5F,2FAA2F;YAC3F,uFAAuF;YACvF,yFAAyF;YACzF,0FAA0F;YAC1F,gFAAgF;YAChF,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ;SAClC;KACF,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"cert-manager-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/cert-manager/compositions/cert-manager-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AAEtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAEL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAG7B,qBAAqB,CACvB;IACE,IAAI,EAAE,wBAAwB;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,gCAAgC;IACtC,MAAM,EAAE,gCAAgC;CACzC,EACD,CAAC,IAAgC,EAAE,EAAE;IACnC,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IAExE,mCAAmC;IACnC,MAAM,UAAU,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC;IAE1D,kEAAkE;IAClE,MAAM,qBAAqB,GAAG,SAAS,CAAC;QACtC,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE;gBACN,wBAAwB,EAAE,cAAc;gBACxC,4BAA4B,EAAE,IAAI,CAAC,IAAI;gBACvC,2BAA2B,EAAE,OAAO;gBACpC,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,EAAE,EAAE,sBAAsB;KAC3B,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,eAAe,GAAG,yBAAyB,CAAC;QAChD,IAAI,EAAE,mBAAmB,EAAE,+CAA+C;QAC1E,SAAS,EAAE,sBAAsB,EAAE,mDAAmD;QACtF,EAAE,EAAE,2BAA2B;KAChC,CAAC,CAAC;IAEH,iDAAiD;IACjD,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,gBAAgB;QAC3B,OAAO;QACP,MAAM,EAAE,UAAU;QAClB,cAAc,EAAE,mBAAmB,EAAE,4BAA4B;QACjE,EAAE,EAAE,wBAAwB;KAC7B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,aAAa,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAChE,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,OAAO;QACP,eAAe,EAAE,aAAa,CAAC,KAAK;QACpC,YAAY,EAAE,aAAa,CAAC,KAAK;QACjC,eAAe,EAAE,aAAa,CAAC,KAAK;QACpC,IAAI,EAAE;YACJ,4FAA4F;YAC5F,2FAA2F;YAC3F,uFAAuF;YACvF,yFAAyF;YACzF,0FAA0F;YAC1F,gFAAgF;YAChF,SAAS,EAAE,IAAI;YACf,OAAO;SACR;KACF,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/factories/cert-manager/resources/helm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../../src/factories/cert-manager/resources/helm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAyCrB,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,+BAA+B,GACtC,QAAQ,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAiBpD;AA6CD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAwD9C;AA8BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,GAAG;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CA4DA"}
+{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../../src/factories/cert-manager/resources/helm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAyCrB,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,+BAA+B,GACtC,QAAQ,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAiBpD;AA6CD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAyD9C;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,GAAG;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CA6DA"}

package/dist/factories/cert-manager/resources/helm.js

@@ -6,9 +6,11 @@
  * from src/factories/helm/ and provide cert-manager-specific configuration interfaces
  * while reusing existing readiness evaluators.
  */
+import { withChartValueDefaults } from '../../../core/aspects/values-merge.js';
 import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
 import { isCelExpression, isKubernetesRef } from '../../../utils/type-guards.js';
 import { createHelmRepositoryReadinessEvaluator, } from '../../helm/helm-repository.js';
+import { helmReleaseLifecycle } from '../../helm/lifecycle.js';
 import { createLabeledHelmReleaseEvaluator } from '../../helm/readiness-evaluators.js';
 import { createResource } from '../../shared.js';
 // =============================================================================
@@ -95,9 +97,9 @@ export function certManagerHelmRepository(config) {
  *   namespace: 'cert-manager',
  *   repositoryName: 'cert-manager-repo',
  *   values: {
- *     installCRDs: false,
+ *     crds: { enabled: false },
  *     replicaCount: 2,
- *     webhook: { enabled: true }
+ *     webhook: { replicaCount: 2 }
  *   }
  * });
  * ```
@@ -107,33 +109,27 @@ const certManagerHelmReleaseReadinessEvaluator = createLabeledHelmReleaseEvaluat
 export function certManagerHelmRelease(config) {
     // Create a HelmRelease that properly references the HelmRepository by name
     // We need to use createResource directly to have full control over the sourceRef
-    // CRITICAL: Helm values MUST be static - they cannot contain KubernetesRef objects
-    // from schema proxies because Kro/Flux cannot handle CEL expressions inside spec.values.
-    // The HelmRelease spec.values field is an arbitrary object without a defined schema,
-    // so any KubernetesRef objects will serialize incorrectly (as empty objects or strings).
+    // Values are graph-aware: schema references and CEL expressions in them are
+    // serialized by the core proxy system, so a KRO-mode bootstrap keeps every
+    // per-instance setting. (They used to be stripped here, which rendered KRO
+    // instances with the chart's defaults: 1 replica, a kube-system lease.)
     //
-    // We set these critical values with sensible defaults to ensure cert-manager installs correctly:
-    // 1. installCRDs: true — required for cert-manager to function
-    // 2. startupapicheck.enabled: true — validates webhook readiness before marking ready
-    //
-    // NOTE: config.values may already be the result of mapCertManagerConfigToHelmValues()
-    // from the bootstrap composition (see utils/helm-values-mapper.ts).
-    // We just sanitize the values to remove any proxy references.
-    // The bootstrap composition's startupapicheck settings take precedence via the spread.
-    const baseValues = config.values ? sanitizeHelmValues(config.values) : {};
-    const finalValues = {
-        // Always install CRDs — required for cert-manager to function
-        installCRDs: true,
-        // Enable startupapicheck by default with increased timeout to ensure webhook is ready.
-        // This prevents "webhook not found" errors when deploying cert-manager CRDs.
-        startupapicheck: {
-            enabled: true,
-            timeout: '5m',
-        },
-        // Spread baseValues LAST so caller-provided values (including from the bootstrap
-        // composition) take precedence over our defaults above
-        ...baseValues,
-    };
+    // Defaults sit UNDER the caller's values:
+    // - `crds: { enabled: true, keep: true }` installs the CRDs cert-manager
+    //   needs. It replaces the deprecated `installCRDs: true`; chart v1.17+
+    //   refuses both at once, so it is left out when the caller still sets
+    //   `installCRDs` themselves.
+    // - the startup API check gates readiness on the webhook answering, which
+    //   prevents "webhook not found" errors for resources applied right after.
+    const callerSetsInstallCRDs = typeof config.values === 'object' &&
+        config.values !== null &&
+        !isKubernetesRef(config.values) &&
+        !isCelExpression(config.values) &&
+        Object.hasOwn(config.values, 'installCRDs');
+    const finalValues = withChartValueDefaults({
+        ...(callerSetsInstallCRDs ? {} : { crds: { enabled: true, keep: true } }),
+        startupapicheck: { enabled: true, timeout: '5m' },
+    }, config.values);
     return createResource({
         ...(config.id && { id: config.id }),
         apiVersion: 'helm.toolkit.fluxcd.io/v2',
@@ -155,31 +151,13 @@ export function certManagerHelmRelease(config) {
                     },
                 },
             },
+            // Same bounded-retry defaults as the generic helmRelease: Flux's own
+            // 5m / no-retry default left a slow first install Stalled.
+            ...helmReleaseLifecycle(config),
             values: finalValues,
         },
     }).withReadinessEvaluator(certManagerHelmReleaseReadinessEvaluator);
 }
-/**
- * Sanitizes Helm values by removing any KubernetesRef objects or other non-serializable values.
- * This is necessary because Helm values must be static - they cannot contain CEL expressions
- * or schema proxy references.
- *
- * @param values - The Helm values object to sanitize
- * @returns A sanitized copy of the values with only primitive types, arrays, and plain objects
- */
-function sanitizeHelmValues(values) {
-    return JSON.parse(JSON.stringify(values, (_key, value) => {
-        // Skip KubernetesRef objects — schema proxy references can't be used in Helm values
-        if (isKubernetesRef(value)) {
-            return undefined;
-        }
-        // Skip CelExpression objects — CEL expressions can't be used in Helm values
-        if (isCelExpression(value)) {
-            return undefined;
-        }
-        return value;
-    }));
-}
 // =============================================================================
 // HELM VALUES MAPPING SYSTEM
 // =============================================================================
@@ -203,8 +181,9 @@ function sanitizeHelmValues(values) {
  */
 export function validateCertManagerHelmValues(values) {
     const errors = [];
-    // Note: installCRDs defaults to true for TypeKro comprehensive deployment
-    // This ensures TypeKro can replace kubectl for complete deployments
+    if (values.installCRDs === true && values.crds?.enabled === true) {
+        errors.push('installCRDs and crds.enabled cannot both be true (cert-manager chart v1.17+)');
+    }
     // Validate replica counts
     if (values.replicaCount !== undefined && values.replicaCount < 1) {
         errors.push('replicaCount must be at least 1');

package/dist/factories/cert-manager/resources/helm.js.map

@@ -1 +1 @@
-{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../../../src/factories/cert-manager/resources/helm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,sCAAsC,GAGvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOjD,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,2FAA2F;AAC3F,MAAM,2CAA2C,GAC/C,sCAAsC,CAAC,cAAc,CAAC,CAAC;AAEzD,MAAM,UAAU,yBAAyB,CACvC,MAAuC;IAEvC,kGAAkG;IAClG,yFAAyF;IACzF,OAAO,cAAc,CAA2C;QAC9D,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACnC,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,sBAAsB;SACtD;QACD,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,4BAA4B;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;SAClC;QACD,8DAA8D;KAC/D,CAAC,CAAC,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,wFAAwF;AACxF,MAAM,wCAAwC,GAAG,iCAAiC,CAAC,cAAc,CAAC,CAAC;AAEnG,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,2EAA2E;IAC3E,iFAAiF;IAEjF,mFAAmF;IACnF,yFAAyF;IACzF,qFAAqF;IACrF,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,+DAA+D;IAC/D,sFAAsF;IACtF,EAAE;IACF,sFAAsF;IACtF,oEAAoE;IACpE,8DAA8D;IAC9D,uFAAuF;IACvF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAG;QAClB,8DAA8D;QAC9D,WAAW,EAAE,IAAI;QACjB,uFAAuF;QACvF,6EAA6E;QAC7E,eAAe,EAAE;YACf,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;SACd;QACD,iFAAiF;QACjF,uDAAuD;QACvD,GAAG,UAAU;KACd,CAAC;IAEF,OAAO,cAAc,CAAqC;QACxD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACnC,UAAU,EAAE,2BAA2B;QACvC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,cAAc;SAC9C;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,GAAG;oBAC9B,SAAS,EAAE;wBACT,IAAI,EAAE,gBAAyB;wBAC/B,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,mBAAmB;wBAClD,SAAS,EAAE,sBAAsB,EAAE,gDAAgD;qBACpF;iBACF;aACF;YACD,MAAM,EAAE,WAAW;SACpB;KACF,CAAC,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,MAA+B;IACzD,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrC,oFAAoF;QACpF,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,4EAA4E;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA6B;IAIzE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,0EAA0E;IAC1E,oEAAoE;IAEpE,0BAA0B;IAC1B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IAED,wCAAwC;IACxC,MAAM,iBAAiB,GAAG,CACxB,SAAmF,EACnF,SAAiB,EACjB,EAAE;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,wCAAwC,CAAC,CAAC;gBACpE,CAAC;gBACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,2CAA2C,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACzE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,0CAA0C,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,6CAA6C,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;QACjC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;QACjC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../../../src/factories/cert-manager/resources/helm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,sCAAsC,GAGvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOjD,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,2FAA2F;AAC3F,MAAM,2CAA2C,GAC/C,sCAAsC,CAAC,cAAc,CAAC,CAAC;AAEzD,MAAM,UAAU,yBAAyB,CACvC,MAAuC;IAEvC,kGAAkG;IAClG,yFAAyF;IACzF,OAAO,cAAc,CAA2C;QAC9D,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACnC,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,sBAAsB;SACtD;QACD,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,4BAA4B;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;SAClC;QACD,8DAA8D;KAC/D,CAAC,CAAC,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,wFAAwF;AACxF,MAAM,wCAAwC,GAAG,iCAAiC,CAAC,cAAc,CAAC,CAAC;AAEnG,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,2EAA2E;IAC3E,iFAAiF;IAEjF,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,EAAE;IACF,0CAA0C;IAC1C,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,8BAA8B;IAC9B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,qBAAqB,GACzB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,MAAM,CAAC,MAAM,KAAK,IAAI;QACtB,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/B,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,sBAAsB,CACxC;QACE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACzE,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAClD,EACD,MAAM,CAAC,MAAM,CACe,CAAC;IAE/B,OAAO,cAAc,CAAqC;QACxD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACnC,UAAU,EAAE,2BAA2B;QACvC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,cAAc;SAC9C;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,GAAG;oBAC9B,SAAS,EAAE;wBACT,IAAI,EAAE,gBAAyB;wBAC/B,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,mBAAmB;wBAClD,SAAS,EAAE,sBAAsB,EAAE,gDAAgD;qBACpF;iBACF;aACF;YACD,qEAAqE;YACrE,2DAA2D;YAC3D,GAAG,oBAAoB,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,WAAW;SACpB;KACF,CAAC,CAAC,sBAAsB,CAAC,wCAAwC,CAAC,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA6B;IAIzE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IAED,wCAAwC;IACxC,MAAM,iBAAiB,GAAG,CACxB,SAAmF,EACnF,SAAiB,EACjB,EAAE;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,wCAAwC,CAAC,CAAC;gBACpE,CAAC;gBACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,2CAA2C,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACzE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,0CAA0C,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,6CAA6C,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;QACjC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;QACjC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/factories/cert-manager/types.d.ts

@@ -1,4 +1,5 @@
 import type { TypeKroChartValues } from '../../core/types/common.js';
+import type { HelmReleaseLifecycleOptions } from '../helm/types.js';
 export interface ResourceRequirements {
     limits?: {
         cpu?: string;
@@ -207,6 +208,32 @@ export interface LabelSelector {
     }[];
     matchLabels?: Record<string, string>;
 }
+/** PodDisruptionBudget settings for one cert-manager component. */
+export interface CertManagerPodDisruptionBudget {
+    /** Render the chart's PodDisruptionBudget. The chart defaults to `minAvailable: 1`. */
+    enabled?: boolean;
+    /** An integer (`'1'`) or a percentage (`'50%'`). Set this or `maxUnavailable`, not both. */
+    minAvailable?: string;
+    /** An integer (`'1'`) or a percentage (`'50%'`). Set this or `minAvailable`, not both. */
+    maxUnavailable?: string;
+}
+/** A Kubernetes topology spread constraint, passed to the chart unchanged. */
+export interface TopologySpreadConstraint {
+    maxSkew: number;
+    topologyKey: string;
+    whenUnsatisfiable: 'DoNotSchedule' | 'ScheduleAnyway';
+    /** Select the component's own pods, e.g. `app.kubernetes.io/component: controller`. */
+    labelSelector?: LabelSelector;
+    minDomains?: number;
+    matchLabelKeys?: string[];
+    nodeAffinityPolicy?: 'Honor' | 'Ignore';
+    nodeTaintsPolicy?: 'Honor' | 'Ignore';
+}
+/** Scheduling settings shared by the controller, webhook and cainjector. */
+export interface CertManagerComponentScheduling {
+    podDisruptionBudget?: CertManagerPodDisruptionBudget;
+    topologySpreadConstraints?: TopologySpreadConstraint[];
+}
 export interface CertManagerBootstrapConfig {
     name: string;
     namespace?: string;
@@ -221,7 +248,19 @@ export interface CertManagerBootstrapConfig {
             useAppArmor?: boolean;
         };
     };
+    /**
+     * Install the CRDs with the chart.
+     * @deprecated Use `crds.enabled`. Mapped to `crds.enabled` when that is unset.
+     */
     installCRDs?: boolean;
+    /** Chart CRD handling. @default { enabled: true, keep: true } */
+    crds?: {
+        /** Install the CRDs with the chart. */
+        enabled?: boolean;
+        /** Keep the CRDs (and so every Certificate) when the release is uninstalled. */
+        keep?: boolean;
+    };
+    /** Controller replicas. Above 1, also enable `controller.podDisruptionBudget`. */
     replicaCount?: number;
     strategy?: {
         type?: 'Recreate' | 'RollingUpdate';
@@ -230,7 +269,7 @@ export interface CertManagerBootstrapConfig {
             maxUnavailable?: number | string;
         };
     };
-    controller?: {
+    controller?: CertManagerComponentScheduling & {
         image?: {
             repository?: string;
             tag?: string;
@@ -252,7 +291,7 @@ export interface CertManagerBootstrapConfig {
             annotations?: Record<string, string>;
         };
     };
-    webhook?: {
+    webhook?: CertManagerComponentScheduling & {
         replicaCount?: number;
         image?: {
             repository?: string;
@@ -273,7 +312,7 @@ export interface CertManagerBootstrapConfig {
             annotations?: Record<string, string>;
         };
     };
-    cainjector?: {
+    cainjector?: CertManagerComponentScheduling & {
         enabled?: boolean;
         replicaCount?: number;
         image?: {
@@ -794,7 +833,7 @@ export interface CertManagerHelmRepositoryConfig {
 /**
  * Configuration interface for Cert-Manager HelmRelease
  */
-export interface CertManagerHelmReleaseConfig {
+export interface CertManagerHelmReleaseConfig extends HelmReleaseLifecycleOptions {
     name: string;
     namespace?: string;
     repositoryName?: string;
@@ -807,7 +846,16 @@ export interface CertManagerHelmReleaseConfig {
  * Based on the official cert-manager Helm chart values
  */
 export interface CertManagerHelmValues {
+    /** @deprecated The chart refuses `installCRDs` together with `crds.enabled`. Use `crds`. */
     installCRDs?: boolean;
+    crds?: {
+        enabled?: boolean;
+        keep?: boolean;
+    };
+    /** Controller PodDisruptionBudget (root level in the chart). */
+    podDisruptionBudget?: CertManagerPodDisruptionBudget;
+    /** Controller topology spread constraints (root level in the chart). */
+    topologySpreadConstraints?: TopologySpreadConstraint[];
     global?: {
         leaderElection?: {
             namespace?: string;
@@ -857,7 +905,7 @@ export interface CertManagerHelmValues {
             annotations?: Record<string, string>;
         };
     };
-    webhook?: {
+    webhook?: CertManagerComponentScheduling & {
         replicaCount?: number;
         image?: {
             repository?: string;
@@ -878,7 +926,7 @@ export interface CertManagerHelmValues {
             annotations?: Record<string, string>;
         };
     };
-    cainjector?: {
+    cainjector?: CertManagerComponentScheduling & {
         enabled?: boolean;
         replicaCount?: number;
         image?: {