kubernetes-sigs / kubernetes-sigs/node-readiness-controller
[BUG] ValidatingWebhook is broken for users without cert manager
@Ayush4958 is already working on this.
Since Sep 4, 2026.
- Dominant language
- Go
- Stars
- 164
- Forks
- 75
- Avg merge
- 8d 23h
- Merged PRs (30d)
- 13
Description
What happened?
Currently, the Helm chart webhookvalidation relies entirely on the cert-manager annotation to inject the caBundle
If a user manages their own certificates and deploys the chart with certManager.enabled: false, the caBundle field is completely omitted from the webhook's clientConfig, because the Kubernetes API server mandates a caBundle to verify webhook TLS, the webhook configuration is fundamentally broken for anyone not using cert-manager
Steps to Reproduce
Run a dry-run templating of the webhook without cert manager :-
helm template test-release charts/node-readiness-controller \
--set webhook.enabled=true \
--set validatingWebhook.enabled=true \
--set certManager.enabled=false \
-s templates/validatingwebhookconfiguration.yaml
Observe that the output clientConfig lacks a caBundle field entirely
Expected Behavior
The Helm chart should expose a validatingWebhook.caBundle field in values.yaml and inject it into the clientConfig of the ValidatingWebhookConfiguration template when certManager.enabled is false.
Controller Version / Image Tag
main / chart v0.1.0
Kubernetes Version
Any Kubernetes version 1.25+
Controller Logs
NA
Additional Environment Details
I will open a PR for this fix
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.