feat(m28+m29+m30): ACME ARI, email digest, and Helm chart

M28: ACME Renewal Information (RFC 9702) — CA-directed renewal timing
with cert ID computation, directory endpoint discovery, graceful
degradation for non-ARI CAs. 19 tests.

M29: Email notifier wiring + scheduled certificate digest — SMTP
connector bridged to service layer via NotifierAdapter, DigestService
with HTML email template, 7th scheduler loop (24h), digest preview/send
API endpoints and GUI card. 21 tests.

M30: Production-ready Helm chart — server Deployment, PostgreSQL
StatefulSet, agent DaemonSet, ConfigMaps, Secrets, Ingress, security
contexts, health probes, example values for dev/prod/ACME scenarios.

Also: OpenAPI spec updates, MCP tool additions, CI helm-lint job,
documentation updates across 5 doc files and README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/helm/certctl/templates/NOTES.txt

@@ -0,0 +1,68 @@
+1. Get the certctl Server URL by running:
+{{- if .Values.ingress.enabled }}
+  https://{{ index .Values.ingress.hosts 0 "host" }}
+{{- else if contains "NodePort" .Values.server.service.type }}
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "certctl.fullname" . }}-server)
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.server.service.type }}
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "certctl.fullname" . }}-server --template "{.status.loadBalancer.ingress[0].ip}")
+  echo http://$SERVICE_IP:{{ .Values.server.service.port }}
+{{- else }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "certctl.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=server" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+2. Get the default API key:
+  kubectl get secret --namespace {{ .Release.Namespace }} {{ include "certctl.fullname" . }}-server -o jsonpath="{.data.api-key}" | base64 --decode; echo
+
+3. Get PostgreSQL connection details:
+  Host: {{ include "certctl.fullname" . }}-postgres.{{ .Release.Namespace }}.svc.cluster.local
+  Port: 5432
+  Database: {{ .Values.postgresql.auth.database }}
+  Username: {{ .Values.postgresql.auth.username }}
+  Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "certctl.fullname" . }}-postgres -o jsonpath="{.data.password}" | base64 --decode)
+
+4. Check deployment status:
+  kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
+
+5. View server logs:
+  kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "certctl.name" . }},app.kubernetes.io/component=server -f
+
+{{- if .Values.agent.enabled }}
+
+6. View agent logs:
+  kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "certctl.name" . }},app.kubernetes.io/component=agent -f
+
+{{- end }}
+
+IMPORTANT NOTES FOR PRODUCTION:
+
+1. Update the API key for security:
+   kubectl patch secret {{ include "certctl.fullname" . }}-server -n {{ .Release.Namespace }} \
+     -p '{"data":{"api-key":"'$(echo -n "YOUR_NEW_API_KEY" | base64)'"}}'
+
+2. Update PostgreSQL password:
+   kubectl patch secret {{ include "certctl.fullname" . }}-postgres -n {{ .Release.Namespace }} \
+     -p '{"data":{"password":"'$(echo -n "YOUR_NEW_PASSWORD" | base64)'"}}'
+
+3. Configure certificate issuers (ACME, step-ca, etc.) via values.yaml:
+   helm upgrade {{ .Release.Name }} certctl/certctl \
+     --set server.issuer.acme.enabled=true \
+     --set server.issuer.acme.directoryURL=https://acme-v02.api.letsencrypt.org/directory \
+     --set server.issuer.acme.email=admin@example.com
+
+4. For production with persistent databases and backups:
+   - Use an external PostgreSQL managed service (AWS RDS, Cloud SQL, etc.)
+   - Set postgresql.enabled=false and configure CERTCTL_DATABASE_URL in values
+
+5. Enable HTTPS/TLS using an Ingress with certificate management:
+   - Configure cert-manager for automatic TLS certificate renewal
+   - Update ingress values with your domain and certificate issuer
+
+6. Review security contexts and network policies:
+   - All containers run as non-root
+   - Implement network policies to restrict traffic between components
+   - Consider pod security policies or security standards for your cluster

deploy/helm/certctl/templates/_helpers.tpl

@@ -0,0 +1,125 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "certctl.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "certctl.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "certctl.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "certctl.labels" -}}
+helm.sh/chart: {{ include "certctl.chart" . }}
+{{ include "certctl.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels for the main service (server, agent, postgres)
+*/}}
+{{- define "certctl.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "certctl.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Server selector labels
+*/}}
+{{- define "certctl.serverSelectorLabels" -}}
+{{ include "certctl.selectorLabels" . }}
+app.kubernetes.io/component: server
+{{- end }}
+
+{{/*
+Agent selector labels
+*/}}
+{{- define "certctl.agentSelectorLabels" -}}
+{{ include "certctl.selectorLabels" . }}
+app.kubernetes.io/component: agent
+{{- end }}
+
+{{/*
+PostgreSQL selector labels
+*/}}
+{{- define "certctl.postgresSelectorLabels" -}}
+{{ include "certctl.selectorLabels" . }}
+app.kubernetes.io/component: postgres
+{{- end }}
+
+{{/*
+Service account name
+*/}}
+{{- define "certctl.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "certctl.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Server image
+*/}}
+{{- define "certctl.serverImage" -}}
+{{- $image := .Values.server.image }}
+{{- printf "%s:%s" $image.repository (coalesce $image.tag .Chart.AppVersion) }}
+{{- end }}
+
+{{/*
+Agent image
+*/}}
+{{- define "certctl.agentImage" -}}
+{{- $image := .Values.agent.image }}
+{{- printf "%s:%s" $image.repository (coalesce $image.tag .Chart.AppVersion) }}
+{{- end }}
+
+{{/*
+PostgreSQL image
+*/}}
+{{- define "certctl.postgresImage" -}}
+{{- $image := .Values.postgresql.image }}
+{{- printf "%s:%s" $image.repository $image.tag }}
+{{- end }}
+
+{{/*
+Database connection string
+*/}}
+{{- define "certctl.databaseURL" -}}
+postgres://{{ .Values.postgresql.auth.username }}:$(POSTGRES_PASSWORD)@{{ include "certctl.fullname" . }}-postgres:5432/{{ .Values.postgresql.auth.database }}?sslmode=disable
+{{- end }}
+
+{{/*
+Server URL (for agents)
+*/}}
+{{- define "certctl.serverURL" -}}
+http://{{ include "certctl.fullname" . }}-server:{{ .Values.server.service.port }}
+{{- end }}

deploy/helm/certctl/templates/agent-configmap.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.agent.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "certctl.fullname" . }}-agent
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent
+data:
+  {{- if .Values.agent.discoveryDirs }}
+  discovery-dirs: {{ .Values.agent.discoveryDirs | quote }}
+  {{- end }}
+{{- end }}

deploy/helm/certctl/templates/agent-daemonset.yaml

@@ -0,0 +1,162 @@
+{{- if .Values.agent.enabled }}
+{{- if eq .Values.agent.kind "DaemonSet" }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "certctl.fullname" . }}-agent
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent
+spec:
+  selector:
+    matchLabels:
+      {{- include "certctl.agentSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.agentSelectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "certctl.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: agent
+          image: {{ include "certctl.agentImage" . }}
+          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
+          env:
+            - name: CERTCTL_SERVER_URL
+              value: {{ include "certctl.serverURL" . }}
+            - name: CERTCTL_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: api-key
+            - name: CERTCTL_AGENT_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: CERTCTL_KEY_DIR
+              value: {{ .Values.agent.keyDir }}
+            {{- if .Values.agent.discoveryDirs }}
+            - name: CERTCTL_DISCOVERY_DIRS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-agent
+                  key: discovery-dirs
+            {{- end }}
+            {{- with .Values.agent.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.agent.resources | nindent 12 }}
+          volumeMounts:
+            - name: agent-keys
+              mountPath: {{ .Values.agent.keyDir }}
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: agent-keys
+          emptyDir:
+            sizeLimit: 1Gi
+        - name: tmp
+          emptyDir: {}
+{{- else if eq .Values.agent.kind "Deployment" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "certctl.fullname" . }}-agent
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: agent
+spec:
+  replicas: {{ .Values.agent.replicas }}
+  selector:
+    matchLabels:
+      {{- include "certctl.agentSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.agentSelectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "certctl.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: agent
+          image: {{ include "certctl.agentImage" . }}
+          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
+          env:
+            - name: CERTCTL_SERVER_URL
+              value: {{ include "certctl.serverURL" . }}
+            - name: CERTCTL_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: api-key
+            - name: CERTCTL_AGENT_NAME
+              {{- if .Values.agent.name }}
+              value: {{ .Values.agent.name | quote }}
+              {{- else }}
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+              {{- end }}
+            - name: CERTCTL_KEY_DIR
+              value: {{ .Values.agent.keyDir }}
+            {{- if .Values.agent.discoveryDirs }}
+            - name: CERTCTL_DISCOVERY_DIRS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-agent
+                  key: discovery-dirs
+            {{- end }}
+            {{- with .Values.agent.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.agent.resources | nindent 12 }}
+          volumeMounts:
+            - name: agent-keys
+              mountPath: {{ .Values.agent.keyDir }}
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: agent-keys
+          emptyDir:
+            sizeLimit: 1Gi
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- end }}

deploy/helm/certctl/templates/ingress.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "certctl.fullname" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "certctl.fullname" . }}-server
+                port:
+                  number: {{ $.Values.server.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

deploy/helm/certctl/templates/postgres-secret.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "certctl.fullname" . }}-postgres
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+type: Opaque
+stringData:
+  {{- if not .Values.postgresql.auth.password }}
+  {{- fail "postgresql.auth.password is required" }}
+  {{- end }}
+  password: {{ .Values.postgresql.auth.password | quote }}
+  username: {{ .Values.postgresql.auth.username | quote }}
+  database: {{ .Values.postgresql.auth.database | quote }}

deploy/helm/certctl/templates/postgres-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.postgresql.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "certctl.fullname" . }}-postgres
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  clusterIP: None
+  ports:
+    - port: {{ .Values.postgresql.service.port }}
+      targetPort: postgres
+      protocol: TCP
+      name: postgres
+  selector:
+    {{- include "certctl.postgresSelectorLabels" . | nindent 4 }}
+{{- end }}

deploy/helm/certctl/templates/postgres-statefulset.yaml

@@ -0,0 +1,79 @@
+{{- if .Values.postgresql.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "certctl.fullname" . }}-postgres
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  serviceName: {{ include "certctl.fullname" . }}-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "certctl.postgresSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.postgresSelectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.postgresql.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: postgres
+          image: {{ include "certctl.postgresImage" . }}
+          imagePullPolicy: {{ .Values.postgresql.image.pullPolicy }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: database
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: password
+            - name: POSTGRES_INITDB_ARGS
+              value: "--encoding=UTF8"
+          livenessProbe:
+            {{- toYaml .Values.postgresql.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.postgresql.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.postgresql.resources | nindent 12 }}
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+              subPath: postgres
+            - name: postgres-init
+              mountPath: /docker-entrypoint-initdb.d
+      volumes:
+        - name: postgres-init
+          emptyDir: {}
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        {{- if .Values.postgresql.storage.storageClass }}
+        storageClassName: {{ .Values.postgresql.storage.storageClass }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.postgresql.storage.size }}
+{{- end }}

deploy/helm/certctl/templates/server-configmap.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+data:
+  log-level: {{ .Values.server.logging.level | quote }}
+  auth-type: {{ .Values.server.auth.type | quote }}
+  keygen-mode: {{ .Values.server.keygen.mode | quote }}
+  rate-limit-rps: {{ .Values.server.rateLimiting.rps | quote }}
+  rate-limit-burst: {{ .Values.server.rateLimiting.burst | quote }}
+  {{- if .Values.server.cors.origins }}
+  cors-origins: {{ .Values.server.cors.origins | quote }}
+  {{- end }}
+  {{- if .Values.server.networkScan.enabled }}
+  network-scan-interval: {{ .Values.server.networkScan.interval | quote }}
+  {{- end }}
+  {{- if .Values.server.est.enabled }}
+  est-issuer-id: {{ .Values.server.est.issuerID | quote }}
+  {{- if .Values.server.est.profileID }}
+  est-profile-id: {{ .Values.server.est.profileID | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.server.smtp.enabled }}
+  smtp-host: {{ .Values.server.smtp.host | quote }}
+  smtp-port: {{ .Values.server.smtp.port | quote }}
+  smtp-username: {{ .Values.server.smtp.username | quote }}
+  smtp-from-address: {{ .Values.server.smtp.fromAddress | quote }}
+  {{- end }}
+  {{- if .Values.server.issuer.acme.enabled }}
+  acme-directory-url: {{ .Values.server.issuer.acme.directoryURL | quote }}
+  acme-email: {{ .Values.server.issuer.acme.email | quote }}
+  acme-challenge-type: {{ .Values.server.issuer.acme.challengeType | quote }}
+  {{- end }}

deploy/helm/certctl/templates/server-deployment.yaml

@@ -0,0 +1,196 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+spec:
+  {{- if ne .Values.server.replicas 1 }}
+  replicas: {{ .Values.server.replicas }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "certctl.serverSelectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "certctl.serverSelectorLabels" . | nindent 8 }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/server-configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/server-secret.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: {{ include "certctl.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.server.securityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: server
+          image: {{ include "certctl.serverImage" . }}
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.server.port }}
+              protocol: TCP
+          env:
+            - name: CERTCTL_SERVER_HOST
+              value: "0.0.0.0"
+            - name: CERTCTL_SERVER_PORT
+              value: "{{ .Values.server.port }}"
+            - name: CERTCTL_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: database-url
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-postgres
+                  key: password
+            - name: CERTCTL_LOG_LEVEL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: log-level
+            - name: CERTCTL_LOG_FORMAT
+              value: "json"
+            - name: CERTCTL_AUTH_TYPE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: auth-type
+            {{- if eq .Values.server.auth.type "api-key" }}
+            - name: CERTCTL_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: api-key
+            {{- end }}
+            - name: CERTCTL_KEYGEN_MODE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: keygen-mode
+            - name: CERTCTL_RATE_LIMIT_RPS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: rate-limit-rps
+            - name: CERTCTL_RATE_LIMIT_BURST
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: rate-limit-burst
+            {{- if .Values.server.cors.origins }}
+            - name: CERTCTL_CORS_ORIGINS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: cors-origins
+            {{- end }}
+            {{- if .Values.server.networkScan.enabled }}
+            - name: CERTCTL_NETWORK_SCAN_ENABLED
+              value: "true"
+            - name: CERTCTL_NETWORK_SCAN_INTERVAL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: network-scan-interval
+            {{- end }}
+            {{- if .Values.server.est.enabled }}
+            - name: CERTCTL_EST_ENABLED
+              value: "true"
+            - name: CERTCTL_EST_ISSUER_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: est-issuer-id
+            {{- if .Values.server.est.profileID }}
+            - name: CERTCTL_EST_PROFILE_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: est-profile-id
+            {{- end }}
+            {{- end }}
+            {{- if .Values.server.smtp.enabled }}
+            - name: CERTCTL_SMTP_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-host
+            - name: CERTCTL_SMTP_PORT
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-port
+            - name: CERTCTL_SMTP_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-username
+            - name: CERTCTL_SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-password
+            - name: CERTCTL_SMTP_FROM_ADDRESS
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: smtp-from-address
+            {{- end }}
+            {{- if .Values.server.issuer.acme.enabled }}
+            - name: CERTCTL_ACME_DIRECTORY_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: acme-directory-url
+            - name: CERTCTL_ACME_EMAIL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: acme-email
+            - name: CERTCTL_ACME_CHALLENGE_TYPE
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "certctl.fullname" . }}-server
+                  key: acme-challenge-type
+            {{- end }}
+            {{- with .Values.server.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          livenessProbe:
+            {{- toYaml .Values.server.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.server.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.server.resources | nindent 12 }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            {{- if .Values.server.volumeMounts }}
+            {{- toYaml .Values.server.volumeMounts | nindent 12 }}
+            {{- end }}
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        {{- if .Values.server.volumes }}
+        {{- toYaml .Values.server.volumes | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeAffinity }}
+      affinity:
+        nodeAffinity:
+          {{- toYaml . | nindent 10 }}
+      {{- else if .Values.podAntiAffinity }}
+      affinity:
+        podAntiAffinity:
+          {{- toYaml . | nindent 10 }}
+      {{- else if .Values.podAffinity }}
+      affinity:
+        podAffinity:
+          {{- toYaml . | nindent 10 }}
+      {{- end }}

deploy/helm/certctl/templates/server-secret.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+type: Opaque
+stringData:
+  database-url: postgres://{{ .Values.postgresql.auth.username }}:$(POSTGRES_PASSWORD)@{{ include "certctl.fullname" . }}-postgres:5432/{{ .Values.postgresql.auth.database }}?sslmode=disable
+  {{- if eq .Values.server.auth.type "api-key" }}
+  {{- if not .Values.server.auth.apiKey }}
+  {{- fail "server.auth.apiKey is required when server.auth.type is 'api-key'" }}
+  {{- end }}
+  api-key: {{ .Values.server.auth.apiKey | quote }}
+  {{- end }}
+  {{- if .Values.server.smtp.enabled }}
+  smtp-password: {{ .Values.server.smtp.password | quote }}
+  {{- end }}

deploy/helm/certctl/templates/server-service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "certctl.fullname" . }}-server
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+  {{- with .Values.server.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.server.service.type }}
+  ports:
+    - port: {{ .Values.server.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "certctl.serverSelectorLabels" . | nindent 4 }}

deploy/helm/certctl/templates/serviceaccount.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "certctl.serviceAccountName" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- if .Values.rbac.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "certctl.fullname" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "certctl.fullname" . }}
+  labels:
+    {{- include "certctl.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "certctl.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "certctl.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}