From 41d281286142c0970ca0f8d70bd0544e577d013a Mon Sep 17 00:00:00 2001
From: majinghe <42570491+majinghe@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:21:43 +0800
Subject: [PATCH] feat: add support for external/existing certificate issuer
 (#2631)

---
 helm/README.md                                           | 5 +++++
 .../rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml | 3 ++-
 helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml  | 5 +++--
 .../templates/cert-manager-mtls/03-rustfs-issuer.yaml    | 5 +++--
 .../templates/cert-manager-mtls/04-server-cert.yaml      | 9 ++++++++-
 .../templates/cert-manager-mtls/05-client-cert.yaml      | 8 ++++++++
 helm/rustfs/values.yaml                                  | 5 +++++
 7 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/helm/README.md b/helm/README.md
index c4b5ea75d..d73e7a4e8 100644
--- a/helm/README.md
+++ b/helm/README.md
@@ -105,6 +105,11 @@ RustFS helm chart supports **standalone and distributed mode**. For standalone m
 | mtls.enabled | bool | `false` | Enable mtls betweens pods. |
 | mtls.clientCertPath | string | `/opt/tls/client_cert.pem` | The path for client cert. |
 | mtls.clientKeyPath | string | `/opt/tls/client_key.pem` | The path for client key. |
+| mtls.existingIssuerRef.enabled | bool | `false` | Enable to use external/existing certificate issuer.|
+| mtls.existingIssuerRef.name | string | `""` | The name of external/existing certificate issuer. |
+| mtls.existingIssuerRef.kind | string | `""` | The kind of external/existing certificate iss
+uer. `ClusterIssuer` or `Issuer`. |
+| mtls.existingIssuerRef.group | string | `""` | The group of external/existing certificate issuer. |
 | nameOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | pdb.create | bool | `false` | Enable/disable a Pod Disruption Budget creation |
diff --git a/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml b/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml
index 57a158c39..84083edcd 100644
--- a/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml
+++ b/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.mtls.enabled }}
+{{- if and .Values.mtls.enabled (not .Values.mtls.existingIssuerRef.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -6,3 +6,4 @@ metadata:
 spec:
   selfSigned: {}
 {{- end }}
+
diff --git a/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml
index 67d0d57e5..3e5730a32 100644
--- a/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml
+++ b/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.mtls.enabled }}
+{{- if and .Values.mtls.enabled (not .Values.mtls.existingIssuerRef.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -11,4 +11,5 @@ spec:
   issuerRef:
     name: {{ include "rustfs.fullname" . }}-selfsigned-issuer
     kind: ClusterIssuer
-{{- end }}
\ No newline at end of file
+{{- end }}
+
diff --git a/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml b/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml
index cc067b8b0..fdc0bbe3a 100644
--- a/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml
+++ b/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.mtls.enabled }}
+{{- if and .Values.mtls.enabled (not .Values.mtls.existingIssuerRef.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
@@ -7,4 +7,5 @@ metadata:
 spec:
   ca:
     secretName: {{ include "rustfs.fullname" . }}-root-ca-secret
-{{- end }}
\ No newline at end of file
+{{- end }}
+
diff --git a/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml
index 6bbd97799..5ede034fa 100644
--- a/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml
+++ b/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml
@@ -6,9 +6,16 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   secretName: {{ include "rustfs.fullname" . }}-server-tls
+  {{- if .Values.mtls.existingIssuerRef.enabled }}
+  issuerRef:
+    name: {{ .Values.mtls.existingIssuerRef.name }}
+    kind: {{ .Values.mtls.existingIssuerRef.kind }}
+    group: {{ .Values.mtls.existingIssuerRef.group }}
+  {{- else }}
   issuerRef:
     name: {{ include "rustfs.fullname" . }}-ca-issuer
     kind: Issuer
+  {{- end }}
   commonName: {{ include "rustfs.fullname" . }}-cluster
   dnsNames:
     - "*.{{ include "rustfs.fullname" . }}-headless"
@@ -20,4 +27,4 @@ spec:
   {{- end }}
   usages:
     - server auth
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml
index dad4b14ef..0509f2517 100644
--- a/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml
+++ b/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml
@@ -6,10 +6,18 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   secretName: {{ include "rustfs.fullname" . }}-client-tls
+  {{- if .Values.mtls.existingIssuerRef.enabled }}
+  issuerRef:
+    name: {{ .Values.mtls.existingIssuerRef.name }}
+    kind: {{ .Values.mtls.existingIssuerRef.kind }}
+    group: {{ .Values.mtls.existingIssuerRef.group }}
+  {{- else }}
   issuerRef:
     name: {{ include "rustfs.fullname" . }}-ca-issuer
     kind: Issuer
+  {{- end }}
   commonName: {{ include "rustfs.fullname" . }}-cluster
   usages:
     - client auth
 {{- end }}
+
diff --git a/helm/rustfs/values.yaml b/helm/rustfs/values.yaml
index ddda915b4..ce76851c7 100644
--- a/helm/rustfs/values.yaml
+++ b/helm/rustfs/values.yaml
@@ -230,6 +230,11 @@ mtls:
   enabled: false
   clientCertPath: "/opt/tls/client_cert.pem"
   clientKeyPath: "/opt/tls/client_key.pem"
+  existingIssuerRef:
+    enabled: false
+    name: ""
+    kind: ""
+    group: ""
 
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious