Skip to content

Add Venafi NGTS e2e job and credentials preset#1177

Merged
cert-manager-prow[bot] merged 1 commit into
cert-manager:masterfrom
FelixPhipps:NGTS-e2e-tests
May 19, 2026
Merged

Add Venafi NGTS e2e job and credentials preset#1177
cert-manager-prow[bot] merged 1 commit into
cert-manager:masterfrom
FelixPhipps:NGTS-e2e-tests

Conversation

@FelixPhipps
Copy link
Copy Markdown

@FelixPhipps FelixPhipps commented May 18, 2026 •
edited
Loading

cert-manager/cert-manager has added support for a new Venafi issuer backend called NGTS (Palo Alto Networks Next Generation Trust Services), which uses OAuth 2.0 Client Credentials. The e2e tests are already written and merged in cert-manager (test/e2e/suite/issuers/venafi/ngts/ and test/e2e/suite/conformance/certificates/venafingts/) and skip automatically when the required env vars are absent.

This PR wires up the Prow configuration so the tests can be triggered and run.

@cert-manager-prow cert-manager-prow Bot added dco-signoff: no Indicates that at least one commit in this pull request is missing the DCO sign-off message. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 18, 2026
@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented May 18, 2026

Hi @FelixPhipps. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@cert-manager-prow cert-manager-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 18, 2026
@claude
Add Venafi NGTS e2e job and credentials preset
6fa9b85 
cert-manager/cert-manager has added support for a new Venafi issuer
backend called NGTS (Palo Alto Networks Next Generation Trust Services),
which uses OAuth 2.0 Client Credentials. The e2e tests are already
written and merged in cert-manager, and skip automatically when the
required env vars are absent.

This PR:
- Adds preset-venafi-ngts-credentials to map the venafi-ngts Kubernetes
  secret to the five env vars the tests expect (VENAFI_NGTS_ZONE,
  VENAFI_NGTS_TOKEN_ENDPOINT, VENAFI_NGTS_TSG_ID, VENAFI_NGTS_CLIENT_ID,
  VENAFI_NGTS_CLIENT_SECRET)
- Adds preset-ginkgo-focus-venafi-ngts to set GINKGO_FOCUS="Venafi NGTS"
- Adds the pull-cert-manager-*-e2e-v1-*-issuers-venafi-ngts presubmit
  job for master, release-1.19, and release-1.20, mirroring the
  existing venafi-cloud job structure exactly

Note: the venafi-ngts Kubernetes secret does not exist in the cluster
yet. A cluster admin needs to create it before the tests will exercise
anything — until then the tests will skip gracefully.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: felix.phipps <felix.phipps@cyberark.com>
@cert-manager-prow cert-manager-prow Bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. and removed dco-signoff: no Indicates that at least one commit in this pull request is missing the DCO sign-off message. labels May 18, 2026
@maelvls
Copy link
Copy Markdown
Member

maelvls commented May 19, 2026 •
edited
Loading

I've applied the following to the cluster gke_cert-manager-tests-trusted_europe-west1-b_prow-trusted gke_cert-manager-tests-untrusted_europe-west1-b_prow-untrusted:

apiVersion: v1
kind: Secret
metadata:
  name: venafi-ngts
  namespace: test-pods
stringData:
  zone: "Default"
  token-endpoint: "https://auth.apps.paloaltonetworks.com/oauth2/access_token"
  tsg-id: "tsg_id:1271410543"
  client-id: "Felix-test-2@1271410543.iam.panserviceaccount.com"
  client-secret: REDACTED
$ kubectl get secret -n test-pods
NAME                 TYPE     DATA   AGE
cloudflare-api-key   Opaque   3      2y33d
gcs-credentials      Opaque   1      2y33d
venafi-cloud         Opaque   2      2y33d
venafi-ngts          Opaque   5      23m
venafi-tpp           Opaque   4      2y33d

@cert-manager-prow cert-manager-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 19, 2026
@maelvls
Copy link
Copy Markdown
Member

maelvls commented May 19, 2026

/ok-to-test
/approve
/lgtm

@cert-manager-prow cert-manager-prow Bot added ok-to-test lgtm Indicates that a PR is ready to be merged. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 19, 2026
@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented May 19, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow Bot merged commit 0d482f8 into cert-manager:master May 19, 2026
6 checks passed
@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow Bot commented May 19, 2026

@FelixPhipps: Updated the job-config configmap in namespace default at cluster default using the following files:

  • key cert-manager-master.yaml using file config/jobs/cert-manager/cert-manager/master/cert-manager-master.yaml
  • key cert-manager-release-1.19.yaml using file config/jobs/cert-manager/cert-manager/release-1.19/cert-manager-release-1.19.yaml
  • key cert-manager-release-1.20.yaml using file config/jobs/cert-manager/cert-manager/release-1.20/cert-manager-release-1.20.yaml
  • key config.yaml using file config/jobs/cert-manager/config.yaml
Details

In response to this:

cert-manager/cert-manager has added support for a new Venafi issuer backend called NGTS (Palo Alto Networks Next Generation Trust Services), which uses OAuth 2.0 Client Credentials. The e2e tests are already written and merged in cert-manager (test/e2e/suite/issuers/venafi/ngts/ and test/e2e/suite/conformance/certificates/venafingts/) and skip automatically when the required env vars are absent.

This PR wires up the Prow configuration so the tests can be triggered and run.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@wallrj-cyberark wallrj-cyberark mentioned this pull request Jun 3, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maelvls maelvls maelvls approved these changes

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. lgtm Indicates that a PR is ready to be merged. ok-to-test size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@FelixPhipps @maelvls