expose bundles CRD as release artifact

[qrkourier]

Please add CI step to expose CRDs as a release artifact. This is an example of the convenience I'm after from the cert-manager project: https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml

As a workaround, it's still possible to fetch the CRDs directly if you know the release tag, e.g., https://raw.githubusercontent.com/cert-manager/trust-manager/v0.5.0/deploy/crds/trust.cert-manager.io_bundles.yaml

[qrkourier]

This doesn't work with newer releases because the CRD manifest was moved or deleted. I found the template for rendering the CRD manifest, but that doesn't help with this situation where I'm distributing something that has Bundle resources, so the Bundle custom resource must be declared before I can install the thing that creates resources of that type.

Can we make a rendering of the CRDs available as a release artifact to that other projects that use Trust Manager can conveniently install them before installing their own chart with pass-through values to TM as a subchart with CRDs disabled?

The only alternative I can think of, short of rendering Helm templates to a GitOps flow to be mutated with custom logic or Kustomization prior to deployment, is to install the TM chart w/ CRDs enabled first, then install the chart that uses Bundle resources. The main drawback of this approach is that it deprives the deployer of the opportunity to pass-through Helm values from the umbrella chart to TM as a subchart.

🪡 #281

[cert-manager-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
/lifecycle stale

[qrkourier]

/remove-lifecycle stale

Newer trust-manager releases do not have a separate manifest of CRDs that can be consumed by deployers who will depend on trust-manager's CRDs, forcing breaking changes to umbrella charts that consume trust-manager.

This pain could be alleviated by uploading a rendering of the manifest of CRDs to each trust-manager GH release with a predictable name like trust-manager.crds.yaml.

The deployers could fetch the CRDs from the predictable URL via GitHub's "latest" release redirector, or pin any release tag by URL path, to satisfy their deployment's dependencies without breaking changes to the umbrella chart's values schema.