From 9eb0637a0f9e15b7ce96025b9cc8967c2fc3b1e8 Mon Sep 17 00:00:00 2001
From: Steve Thomas <sthomas@artm.quebec>
Date: Mon, 24 Aug 2026 14:18:10 -0400
Subject: [PATCH] feat(step-certificates): add extraObjects and
 podExtraAnnotations

---
 .../examples/extra-objects/values.yaml        | 26 +++++++++++++++++++
 step-certificates/templates/_helpers.tpl      | 11 ++++++++
 step-certificates/templates/ca.yaml           |  5 +++-
 step-certificates/templates/extraobjects.yaml |  4 +++
 step-certificates/values.yaml                 |  6 +++++
 5 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 step-certificates/examples/extra-objects/values.yaml
 create mode 100644 step-certificates/templates/extraobjects.yaml

diff --git a/step-certificates/examples/extra-objects/values.yaml b/step-certificates/examples/extra-objects/values.yaml
new file mode 100644
index 0000000..bd49235
--- /dev/null
+++ b/step-certificates/examples/extra-objects/values.yaml
@@ -0,0 +1,26 @@
+podExtraAnnotations:
+  prometheus.io/path: /metrics
+  prometheus.io/port: "9100"
+  prometheus.io/scrape: "true"
+
+extraObjects:
+  - |
+    apiVersion: monitoring.googleapis.com/v1
+    kind: PodMonitoring
+    metadata:
+      name: {{ .Release.Name }}-podmonitoring
+    spec:
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: {{ include "step-certificates.name" . }}
+      endpoints:
+        - port: 9090
+          path: /metrics
+          interval: 30s
+      targetLabels:
+        metadata:
+          - container
+          - pod
+          - node
+          - top_level_controller_name
+          - top_level_controller_type
diff --git a/step-certificates/templates/_helpers.tpl b/step-certificates/templates/_helpers.tpl
index ef92b93..a3da91f 100644
--- a/step-certificates/templates/_helpers.tpl
+++ b/step-certificates/templates/_helpers.tpl
@@ -66,6 +66,17 @@ Create CA DNS
 {{- end -}}
 {{- end -}}
 
+{{/*
+Renders a complete tree, including values that contains template.
+*/}}
+{{- define "step-certificates.render" -}}
+  {{- if typeIs "string" .value }}
+    {{- tpl .value .context }}
+  {{ else }}
+    {{- tpl (.value | toYaml) .context }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Linked CA variables
 */}}
diff --git a/step-certificates/templates/ca.yaml b/step-certificates/templates/ca.yaml
index 7784410..414f448 100644
--- a/step-certificates/templates/ca.yaml
+++ b/step-certificates/templates/ca.yaml
@@ -23,8 +23,11 @@ spec:
         {{- with .Values.podExtraLabels }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-      {{- if .Values.inject.enabled }}
       annotations:
+        {{- with .Values.podExtraAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- if .Values.inject.enabled }}
         checksum/config: {{ include (print $.Template.BasePath "/configmaps.yaml") . | sha256sum }}
         checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
       {{- end }}
diff --git a/step-certificates/templates/extraobjects.yaml b/step-certificates/templates/extraobjects.yaml
new file mode 100644
index 0000000..5143f7a
--- /dev/null
+++ b/step-certificates/templates/extraobjects.yaml
@@ -0,0 +1,4 @@
+{{- range .Values.extraObjects }}
+---
+{{ include "step-certificates.render" (dict "value" . "context" $) }}
+{{- end }}
diff --git a/step-certificates/values.yaml b/step-certificates/values.yaml
index dde6b45..dea1c9a 100644
--- a/step-certificates/values.yaml
+++ b/step-certificates/values.yaml
@@ -67,6 +67,12 @@ bootstrap:
 # Extra labels
 podExtraLabels: {}
 
+# Extra annotations
+podExtraAnnotations: {}
+
+# Extra objects to deploy
+extraObjects: []
+
 # inject contains values to be injected into config maps and secrets
 inject:
   enabled: false