chore: changes to jetstack-agent chart to use new Agent image

[SgtCoDFish]

The old preflight image is not maintained or built any more. This PR changes the old chart on the legacy-jetstack-secure branch to use the new Agent image by default.

The env var changes for POD_NAMESPACE and POD_NAME are required to prevent errors due to changes in the Agent image.

POD_UID and POD_NODE are included because it seems harmless.

Still required: this will prints errors since the new agent image will look for OpenShift routes:

I0721 13:16:41.243219 1 dynamic.go:283] "datagatherer informer has failed and is backing off" groupVersionResource="route.openshift.io/v1, Resource=routes" reason="failed to list route.openshift.io/v1, Resource=routes: routes.route.openshift.io is forbidden: User "system:serviceaccount:jetstack-secure:jetstack-agent" cannot list resource "routes" in API group "route.openshift.io" at the cluster scope"

We might need to expand the permissions in the legacy chart, or else prevent this check being made by the agent.

[wallrj]

This fixes the permissions error mentioned in the PR description.
It is a a bug that was already fixed in the venafi-kubernetes-agent chart, here:

• [VC-33564] Fix the invalid API group rule for clusterrole venafi-kubernetes-agent-openshift-reader #620

After running the test script, the logs now look like this:

$ TLSPK_ORG=staff-busy-sanderson ./hack/install_local_jetstack_secure_chart.sh ... $ kubectl logs -n jetstack-secure $(kubectl get pod -n jetstack-secure -l app.kubernetes.io/instance=jetstack-agent -o jsonpath='{.items[0].metadata.name}') I0722 14:51:16.358377 1 run.go:58] "Starting" logger="Run" version="v1.6.0" commit="32d8a81e90a0811e45ebfe5283004b1ce5ddb7c8" I0722 14:51:16.359438 1 run.go:116] "Healthz endpoints enabled" logger="Run.APIServer" addr=":8081" path="/healthz" I0722 14:51:16.359472 1 run.go:120] "Readyz endpoints enabled" logger="Run.APIServer" addr=":8081" path="/readyz" I0722 14:51:21.524524 1 run.go:233] "Skipping datagatherers for CRDs that can't be found in Kubernetes" logger="Run" datagatherers=["k8s/googlecasissuers","k8s/googlecasclusterissuers","k8s/awspcaissuer","k8s/awspcaclusterissuers","k8s/gateways","k8s/virtualservices","k8s/routes","k8s/venaficlusterissuers","k8s/venafiissuers"] I0722 14:51:23.131141 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData"

[wallrj]

I pushed a commit to fix the logged error about openshift routes permissions.
And I tested the chart using the supplied script, applied some test resources and observed some data being sent to the jetstack-secure backend.

apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: test spec: acme: profile: unknown server: https://acme-staging-v02.api.letsencrypt.org/directory privateKeySecretRef: name: test-issuer-key solvers: - dns01: rfc2136: nameserver: 10.0.0.16 --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: www spec: dnsNames: - www-1.jetstack-richard.jetstacker.net secretName: www issuerRef: kind: Issuer name: test

$ kubectl get cert-manager -A NAMESPACE NAME STATE AGE default order.acme.cert-manager.io/www-1-1312294548 errored 4m13s NAMESPACE NAME APPROVED DENIED READY ISSUER REQUESTER AGE default certificaterequest.cert-manager.io/www-1 True False test system:serviceaccount:cert-manager:cert-manager 4m14s NAMESPACE NAME READY SECRET AGE default certificate.cert-manager.io/www False www 4m14s NAMESPACE NAME READY AGE default issuer.cert-manager.io/test True 4m14s 

$ kubectl logs -n jetstack-secure $(kubectl get pod -n jetstack-sec ure -l app.kubernetes.io/instance=jetstack-agent -o jsonpath='{.items[0].metadata.name}') I0722 14:55:33.499726 1 run.go:58] "Starting" logger="Run" version="v1.6.0" commit="32d8a81e90a0811e45ebfe5283004b1ce5ddb7c8" I0722 14:55:33.500821 1 run.go:116] "Healthz endpoints enabled" logger="Run.APIServer" addr=":8081" path="/healthz" I0722 14:55:33.500859 1 run.go:120] "Readyz endpoints enabled" logger="Run.APIServer" addr=":8081" path="/readyz" I0722 14:55:38.758814 1 run.go:233] "Skipping datagatherers for CRDs that can't be found in Kubernetes" logger="Run" datagatherers=["k8s/googlecasissuers","k8s/googlecasclusterissuers","k8s/awspcaissuer","k8s/awspcaclusterissuers","k8s/gateways","k8s/virtualservices","k8s/venaficlusterissuers","k8s/venafiissuers"] I0722 14:55:40.272679 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData" I0722 14:56:46.253445 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData" I0722 14:57:52.368513 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData" I0722 14:58:58.395934 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData" I0722 15:00:04.439407 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData" I0722 15:01:10.812473 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData" I0722 15:02:16.839412 1 run.go:449] "Data sent successfully" logger="Run.gatherAndOutputData.postData"

/approve
/lgtm

[wallrj]

Ah, I notice that there are a couple of manual steps to perform before we can release this updated chart.

jetstack-secure/README.md

Lines 198 to 216 in bd8ce9e

	The process is as follows:
	1. Create a branch.
	2. Increment version numbers.
	1. Increment the `version` value in [Chart.yaml](deploy/charts/jetstack-agent/Chart.yaml).
	DO NOT use a `v` prefix.
	The `v` prefix [breaks Helm OCI operations](https://github.com/helm/helm/issues/11107).
	2. Increment the `appVersion` value in [Chart.yaml](deploy/charts/jetstack-agent/Chart.yaml).
	Use a `v` prefix, to match the Docker image tag.
	3. Increment the `image.tag` value in [values.yaml](deploy/charts/jetstack-agent/values.yaml).
	Use a `v` prefix, to match the Docker image tag.
	4. Update the Helm unit test snapshots:
	```sh
	helm unittest ./deploy/charts/jetstack-agent --update-snapshot
	```
	3. Create a pull request and wait for it to be approved.
	4. Merge the branch
	5. Manually trigger the Helm Chart workflow:
	[release_js-agent_chart.yaml](https://github.com/jetstack/enterprise-builds/actions/workflows/release_js-agent_chart.yaml).

[wallrj]

Tested the release process by pushing a new tag and triggering the release workflow in enterprise-builds repo:

• https://github.com/jetstack/jetstack-secure/releases/tag/chart-v0.5.0-alpha.0
• https://github.com/jetstack/enterprise-builds/actions/runs/16448986086

helm upgrade jetstack-agent \ oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent \ --version 0.5.0-alpha.0 \ --install \ --create-namespace \ --namespace jetstack-secure \ --set config.organisation="${TLSPK_ORG}" \ --set config.cluster="${TLSPK_CLUSTER_NAME}" 

$ helm get metadata -n jetstack-secure jetstack-agent NAME: jetstack-agent CHART: jetstack-agent VERSION: 0.5.0-alpha.0 APP_VERSION: v1.6.0 ANNOTATIONS: DEPENDENCIES: NAMESPACE: jetstack-secure REVISION: 2 STATUS: deployed DEPLOYED_AT: 2025-07-22T16:42:27+01:00