Allow non-Venafi employee maintainers full release capabilities

[erikgb]

As a relatively new cert-manager maintainer, I have just started cutting releases of our projects. The release process is generally good and well-documented. However, I cannot publish the release Helm chart, as it currently requires access to a private GitHub project that is only available to Venafi employees.

The issue was raised at the bi-weekly development meeting on 28 November 2024, and everyone present agreed that this should be improved.

Short-term alternative proposed: give non-Venafi employee maintainers personal access to the chart release repository. I don't consider this a real fix for the issue. As a graduated CNCF project, all our activity should be transparent and maintainers should be treated equally.

A better solution discussed in the meeting was establishing a new OCI Helm chart registry for cert-manager projects. And for backward compatibility reasons pull-push charts from this new registry to the legacy JetStack chart repository.

/assign @SgtCoDFish

CyberArk tracker: VC-46168

[SgtCoDFish]

Thank you for raising this!

This has been on the backburner just because it hasn't come up until you started doing releases. I'll raise this at Venafi and start the process.

As for implementation, what seems like a good approach to me (as mentioned on the biweekly) would be to implement cert-manager/cert-manager#7132 with the charts repo starting to pull from OCI registries. That could be automated.

[SgtCoDFish]

I've raised this internally now which will start the discussions on this, hopefully leading to us allocating a bit of time for this!

[SgtCoDFish]

An update I forgot to write: we do now have a sync job which syncs OCI charts back to charts.jetstack.io, so in theory non-Venafi maintainers can do full releases. Yet to be tested by a non-Venafi maintainer but we're making good progress on this front!

Thanks to @inteon who did a lot of the integration work for all this!

[erikgb]

Cool, thanks! I can try cutting a release soon.

[erikgb]

I attempted to create an approver-policy release today, and got this message from @inteon.

Small note: for the charts to appear, there is still a PR approval required from a Venafi employee atm.

Hoping we can fully resolve this issue! ❤

[hawksight]

I attempted to create an approver-policy release today, and got this message from @inteon.

Small note: for the charts to appear, there is still a PR approval required from a Venafi employee atm.

Hoping we can fully resolve this issue! ❤

I think I'm aware of this as the charts go to the Jetstack repository which isn't publicly accessible. Is there another issue for moving charts to own cert-manager org. I know we have mentioned it a lot, but unsure if there was anything written down.

[erikgb]

Now that OCI has become the new official Helm chart installation, can we change the release procedure so that the OCI chart is published by the release build? I think this is done for all our projects except cert-manager, where the OCI chart must be published manually by someone after the HTTPS Helm chart PR is merged in the closed repo. Is this possible to change?

When this is done, I propose to update the "how to perform a release" documentation across our org in a way that allows the GH release to be published as soon as the OCI Helm chart is available and tested. And leave the work in the closed repo for the maintainers (CyberArk employees) with access to it. I think it's worse to delay the GH release than to delay the HTTPS Helm chart publishing.

Note: I am halting all my work on releases until this is improved. 😉 CC: @inteon