From 8eba38f75bf63b4ed1c4dbe0c0d186bc819070b1 Mon Sep 17 00:00:00 2001
From: Fritz Mueller <fritzm@slac.stanford.edu>
Date: Wed, 26 Aug 2026 18:41:18 +0000
Subject: [PATCH] Helm chart: add CertManager support

---
 deploy/helm/templates/czar-certificate.yaml | 21 +++++++++++++++++++++
 deploy/helm/templates/czar-issuer.yaml      | 12 ++++++++++++
 deploy/helm/values.yaml                     |  6 ++++++
 3 files changed, 39 insertions(+)
 create mode 100644 deploy/helm/templates/czar-certificate.yaml
 create mode 100644 deploy/helm/templates/czar-issuer.yaml

diff --git a/deploy/helm/templates/czar-certificate.yaml b/deploy/helm/templates/czar-certificate.yaml
new file mode 100644
index 0000000000..646e0bae78
--- /dev/null
+++ b/deploy/helm/templates/czar-certificate.yaml
@@ -0,0 +1,21 @@
+{{- $enabled := (include "qserv.enable" . | fromYaml) -}}
+{{- if and $enabled.czar .Values.certManager.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: czar-cert
+  labels:
+    {{- include "qserv.labels" . | nindent 4 }}
+    app.kubernetes.io/component: czar
+spec:
+  secretName: czar-cert
+  issuerRef:
+    {{- if not (empty .Values.certManager.issuerRef) }}
+    {{- toYaml .Values.certManager.issuerRef | nindent 4 }}
+    {{- else }}
+    name: selfsigned-issuer
+    kind: Issuer
+    {{- end }}
+  dnsNames:
+    {{- toYaml .Values.certManager.dnsNames | nindent 4 }}
+{{- end }}
diff --git a/deploy/helm/templates/czar-issuer.yaml b/deploy/helm/templates/czar-issuer.yaml
new file mode 100644
index 0000000000..0e2d446ae6
--- /dev/null
+++ b/deploy/helm/templates/czar-issuer.yaml
@@ -0,0 +1,12 @@
+{{- $enabled := (include "qserv.enable" . | fromYaml) -}}
+{{- if and $enabled.czar .Values.certManager.enabled (empty .Values.certManager.issuerRef) }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned-issuer
+  labels:
+    {{- include "qserv.labels" . | nindent 4 }}
+    app.kubernetes.io/component: czar
+spec:
+  selfSigned: {}
+{{- end }}
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index e0107fdbfa..b9ee459b1a 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -40,3 +40,9 @@ ingest:
 
 czarExternalService:
   enable: false
+
+certManager:
+  enabled: false
+  # If empty, the chart creates a namespace-scoped self-signed Issuer
+  issuerRef: {}
+  dnsNames: []