Upgrade vendored cert-manager and external-dns charts

client-programs/pkg/config/v1alpha1/schemas/EducatesConfig.schema.json

@@ -492,7 +492,7 @@
                       "type": "string"
                     },
                     "operational": {
-                      "description": "OperationalBlock collects the per-Deployment operational knobs of a\nBundled cluster service. In v1alpha1 only BundledContour carries it:\nthe cert-manager / external-dns / kyverno blocks were dropped\n(2026-06-11) because their semantics didn't hold against the\nupstream charts — external-dns 1.21.1 hardcodes replicas to 1 and\nexposes no replica value, Kyverno fanning one count across its four\ncontrollers conflicts with upstream HA guidance (3+ for the\nadmission controller only), and cert-manager never consumed it.\nThey return when per-service shapes are validated against each\nchart's real values surface. Of the knobs below, the reconciler\ncurrently applies replicas; the rest are accepted but not yet\nwired into chart values.",
+                      "description": "OperationalBlock collects the per-Deployment operational knobs of a\nBundled cluster service. In v1alpha1 only BundledContour carries it.\nThe cert-manager, external-dns and kyverno blocks do not, because a\nsingle per-service block does not map onto those charts: external-dns\nis deliberately single-instance (its chart bounds replicaCount to 0 or\n1 as the controller has no leader election), Kyverno runs four\ncontrollers whose upstream HA guidance differs (3+ replicas for the\nadmission controller only), and the cert-manager reconciler installs\nthe chart with its default workload settings. Per-service shapes may\nbe added once validated against each chart's real values surface. Of\nthe knobs below, the reconciler currently applies replicas; the rest\nare accepted but not yet wired into chart values.",
                       "properties": {
                         "nodeSelector": {
                           "additionalProperties": {

client-programs/pkg/deployer/chart/files/crds/config.educates.dev_educatesclusterconfigs.yaml

@@ -584,17 +584,17 @@ spec:
                           operational:
                             description: |-
                               OperationalBlock collects the per-Deployment operational knobs of a
-                              Bundled cluster service. In v1alpha1 only BundledContour carries it:
-                              the cert-manager / external-dns / kyverno blocks were dropped
-                              (2026-06-11) because their semantics didn't hold against the
-                              upstream charts — external-dns 1.21.1 hardcodes replicas to 1 and
-                              exposes no replica value, Kyverno fanning one count across its four
-                              controllers conflicts with upstream HA guidance (3+ for the
-                              admission controller only), and cert-manager never consumed it.
-                              They return when per-service shapes are validated against each
-                              chart's real values surface. Of the knobs below, the reconciler
-                              currently applies replicas; the rest are accepted but not yet
-                              wired into chart values.
+                              Bundled cluster service. In v1alpha1 only BundledContour carries it.
+                              The cert-manager, external-dns and kyverno blocks do not, because a
+                              single per-service block does not map onto those charts: external-dns
+                              is deliberately single-instance (its chart bounds replicaCount to 0 or
+                              1 as the controller has no leader election), Kyverno runs four
+                              controllers whose upstream HA guidance differs (3+ replicas for the
+                              admission controller only), and the cert-manager reconciler installs
+                              the chart with its default workload settings. Per-service shapes may
+                              be added once validated against each chart's real values surface. Of
+                              the knobs below, the reconciler currently applies replicas; the rest
+                              are accepted but not yet wired into chart values.
                             properties:
                               nodeSelector:
                                 additionalProperties:

installer/charts/educates-installer/crds/config.educates.dev_educatesclusterconfigs.yaml

@@ -584,17 +584,17 @@ spec:
                           operational:
                             description: |-
                               OperationalBlock collects the per-Deployment operational knobs of a
-                              Bundled cluster service. In v1alpha1 only BundledContour carries it:
-                              the cert-manager / external-dns / kyverno blocks were dropped
-                              (2026-06-11) because their semantics didn't hold against the
-                              upstream charts — external-dns 1.21.1 hardcodes replicas to 1 and
-                              exposes no replica value, Kyverno fanning one count across its four
-                              controllers conflicts with upstream HA guidance (3+ for the
-                              admission controller only), and cert-manager never consumed it.
-                              They return when per-service shapes are validated against each
-                              chart's real values surface. Of the knobs below, the reconciler
-                              currently applies replicas; the rest are accepted but not yet
-                              wired into chart values.
+                              Bundled cluster service. In v1alpha1 only BundledContour carries it.
+                              The cert-manager, external-dns and kyverno blocks do not, because a
+                              single per-service block does not map onto those charts: external-dns
+                              is deliberately single-instance (its chart bounds replicaCount to 0 or
+                              1 as the controller has no leader election), Kyverno runs four
+                              controllers whose upstream HA guidance differs (3+ replicas for the
+                              admission controller only), and the cert-manager reconciler installs
+                              the chart with its default workload settings. Per-service shapes may
+                              be added once validated against each chart's real values surface. Of
+                              the knobs below, the reconciler currently applies replicas; the rest
+                              are accepted but not yet wired into chart values.
                             properties:
                               nodeSelector:
                                 additionalProperties:

installer/operator/Makefile

@@ -124,9 +124,9 @@ VENDORED_CHARTS_DIR := $(shell pwd)/vendored-charts
 # Order doesn't matter; vendor-charts iterates and verifies each one
 # against ../vendored-charts/SHA256SUMS.
 VENDORED_CHARTS := \
-	cert-manager=v1.20.3=https://charts.jetstack.io/charts/cert-manager-v1.20.3.tgz \
+	cert-manager=v1.21.2=https://charts.jetstack.io/charts/cert-manager-v1.21.2.tgz \
 	contour=0.8.0=https://github.com/projectcontour/helm-charts/releases/download/contour-0.8.0/contour-0.8.0.tgz \
-	external-dns=1.21.1=https://github.com/kubernetes-sigs/external-dns/releases/download/external-dns-helm-chart-1.21.1/external-dns-1.21.1.tgz \
+	external-dns=1.22.0=https://github.com/kubernetes-sigs/external-dns/releases/download/external-dns-helm-chart-1.22.0/external-dns-1.22.0.tgz \
 	kyverno=3.9.1=https://kyverno.github.io/kyverno/kyverno-3.9.1.tgz
 
 .PHONY: vendor-charts

installer/operator/api/config/v1alpha1/educatesclusterconfig_types.go

@@ -221,17 +221,17 @@ type SecretKeyRef struct {
 }
 
 // OperationalBlock collects the per-Deployment operational knobs of a
-// Bundled cluster service. In v1alpha1 only BundledContour carries it:
-// the cert-manager / external-dns / kyverno blocks were dropped
-// (2026-06-11) because their semantics didn't hold against the
-// upstream charts — external-dns 1.21.1 hardcodes replicas to 1 and
-// exposes no replica value, Kyverno fanning one count across its four
-// controllers conflicts with upstream HA guidance (3+ for the
-// admission controller only), and cert-manager never consumed it.
-// They return when per-service shapes are validated against each
-// chart's real values surface. Of the knobs below, the reconciler
-// currently applies replicas; the rest are accepted but not yet
-// wired into chart values.
+// Bundled cluster service. In v1alpha1 only BundledContour carries it.
+// The cert-manager, external-dns and kyverno blocks do not, because a
+// single per-service block does not map onto those charts: external-dns
+// is deliberately single-instance (its chart bounds replicaCount to 0 or
+// 1 as the controller has no leader election), Kyverno runs four
+// controllers whose upstream HA guidance differs (3+ replicas for the
+// admission controller only), and the cert-manager reconciler installs
+// the chart with its default workload settings. Per-service shapes may
+// be added once validated against each chart's real values surface. Of
+// the knobs below, the reconciler currently applies replicas; the rest
+// are accepted but not yet wired into chart values.
 type OperationalBlock struct {
 	// replicas overrides the operator-computed default. The default
 	// varies by infrastructure provider (typically 1 for Kind/Minikube,
@@ -682,9 +682,9 @@ type WorkshopPolicyConfig struct {
 }
 
 // KyvernoConfig groups Kyverno-engine sourcing. Required when any
-// policyEnforcement engine resolves to Kyverno. The former `bundled`
-// sub-block (which only carried an operational override) was removed
-// alongside the operational-block trim — see OperationalBlock.
+// policyEnforcement engine resolves to Kyverno. It carries no per-service
+// operational block; see OperationalBlock for why only BundledContour
+// has one.
 type KyvernoConfig struct {
 	// provider defaults to Bundled.
 	// +kubebuilder:default=Bundled

installer/operator/internal/controller/config/contour.go

@@ -222,8 +222,18 @@ func renderContourValues(obj *configv1alpha1.EducatesClusterConfig) map[string]a
 	// annotation unconditionally is harmless when no external-dns is
 	// installed — the annotation is informational metadata. Trailing
 	// dot is FQDN form (matches the v3 Carvel installer's behavior).
+	// The hostname is set under both annotation prefixes because each
+	// external-dns release reads exactly one of them (its
+	// --annotation-prefix, defaulting to `external-dns.kubernetes.io/`
+	// from 0.22.0 and to `external-dns.alpha.kubernetes.io/` before) and
+	// ignores the other. The new key serves the bundled 0.22.0, the old
+	// key serves a user-run pre-0.22 instance and keeps the record alive
+	// while the bundled release is upgraded. The old key is deprecated
+	// and will be dropped in a later release.
+	wildcardHostname := fmt.Sprintf("*.%s.", obj.Spec.Ingress.Domain)
 	envoyServiceAnnotations := map[string]any{
-		"external-dns.alpha.kubernetes.io/hostname": fmt.Sprintf("*.%s.", obj.Spec.Ingress.Domain),
+		"external-dns.kubernetes.io/hostname":       wildcardHostname,
+		"external-dns.alpha.kubernetes.io/hostname": wildcardHostname,
 	}
 
 	envoyValues := map[string]any{

installer/operator/internal/controller/config/externaldns.go

@@ -172,6 +172,8 @@ func (r *EducatesClusterConfigReconciler) reconcileExternalDNS(ctx context.Conte
 //   - policy: sync. v3's setting for cloud providers; "upsert-only"
 //     leaves stale records on resource deletion, which is wrong
 //     for our lifecycle.
+//     The chart has no default for policy (it is a required value),
+//     so it is always set here.
 //   - registry: txt (chart default).
 //   - serviceAccount.annotations for IRSA / Workload Identity, OR
 //     env vars referencing the user-provided Secret for static
@@ -210,10 +212,9 @@ func renderExternalDNSValues(obj *configv1alpha1.EducatesClusterConfig) map[stri
 	}
 
 	// No replica plumbing: the kubernetes-sigs external-dns chart
-	// hardcodes replicas to 1 in its Deployment template and exposes
-	// no replica value — the controller is deliberately
-	// single-instance (concurrent instances would race on record
-	// writes).
+	// bounds its replicaCount value to 0 or 1 (external-dns has no
+	// leader election, so concurrent instances would race on record
+	// writes) and we leave it at the chart default of 1.
 
 	if obj.Spec.ImageRegistry != nil && obj.Spec.ImageRegistry.Prefix != "" {
 		values["global"] = map[string]any{

installer/operator/internal/crds/files/config.educates.dev_educatesclusterconfigs.yaml

@@ -584,17 +584,17 @@ spec:
                           operational:
                             description: |-
                               OperationalBlock collects the per-Deployment operational knobs of a
-                              Bundled cluster service. In v1alpha1 only BundledContour carries it:
-                              the cert-manager / external-dns / kyverno blocks were dropped
-                              (2026-06-11) because their semantics didn't hold against the
-                              upstream charts — external-dns 1.21.1 hardcodes replicas to 1 and
-                              exposes no replica value, Kyverno fanning one count across its four
-                              controllers conflicts with upstream HA guidance (3+ for the
-                              admission controller only), and cert-manager never consumed it.
-                              They return when per-service shapes are validated against each
-                              chart's real values surface. Of the knobs below, the reconciler
-                              currently applies replicas; the rest are accepted but not yet
-                              wired into chart values.
+                              Bundled cluster service. In v1alpha1 only BundledContour carries it.
+                              The cert-manager, external-dns and kyverno blocks do not, because a
+                              single per-service block does not map onto those charts: external-dns
+                              is deliberately single-instance (its chart bounds replicaCount to 0 or
+                              1 as the controller has no leader election), Kyverno runs four
+                              controllers whose upstream HA guidance differs (3+ replicas for the
+                              admission controller only), and the cert-manager reconciler installs
+                              the chart with its default workload settings. Per-service shapes may
+                              be added once validated against each chart's real values surface. Of
+                              the knobs below, the reconciler currently applies replicas; the rest
+                              are accepted but not yet wired into chart values.
                             properties:
                               nodeSelector:
                                 additionalProperties:

installer/operator/internal/helm/load_test.go

@@ -28,7 +28,7 @@ import (
 // bump, the bump procedure in vendored-charts/README.md was likely
 // skipped.
 func TestLoadArchive_VendoredCertManager(t *testing.T) {
-	path := filepath.Join("..", "..", "vendored-charts", "cert-manager-v1.20.3.tgz")
+	path := filepath.Join("..", "..", "vendored-charts", "cert-manager-v1.21.2.tgz")
 	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatalf("read vendored chart: %v", err)
@@ -42,7 +42,7 @@ func TestLoadArchive_VendoredCertManager(t *testing.T) {
 	if got, want := chrt.Metadata.Name, "cert-manager"; got != want {
 		t.Errorf("chart name = %q, want %q", got, want)
 	}
-	if got, want := chrt.Metadata.AppVersion, "v1.20.3"; got != want {
+	if got, want := chrt.Metadata.AppVersion, "v1.21.2"; got != want {
 		t.Errorf("chart appVersion = %q, want %q", got, want)
 	}
 }

installer/operator/vendored-charts/README.md

@@ -40,9 +40,9 @@ Two kinds of tarballs live here:
 
 | Chart | Chart version | App version | Upstream | Used by |
 |---|---|---|---|---|
-| cert-manager | v1.20.3 | v1.20.3 | https://charts.jetstack.io | EducatesClusterConfig (BundledCertManager) |
+| cert-manager | v1.21.2 | v1.21.2 | https://charts.jetstack.io | EducatesClusterConfig (BundledCertManager) |
 | contour | 0.8.0 | 1.33.7 | https://github.com/projectcontour/helm-charts | EducatesClusterConfig (BundledContour) |
-| external-dns | 1.21.1 | 0.21.0 | https://github.com/kubernetes-sigs/external-dns | EducatesClusterConfig (BundledExternalDNS) |
+| external-dns | 1.22.0 | 0.22.0 | https://github.com/kubernetes-sigs/external-dns | EducatesClusterConfig (BundledExternalDNS) |
 | kyverno | 3.9.1 | v1.19.1 | https://kyverno.github.io/kyverno | EducatesClusterConfig (BundledKyverno) |
 
 ## Upgrading (or adding) an upstream chart

installer/operator/vendored-charts/SHA256SUMS

@@ -1,4 +1,4 @@
-ef5d707f5afbb2c3ce9892f5ff3fca0dec6864db8830a1c454b3d4822c485843  cert-manager-v1.20.3.tgz
+73a56e1728edd6c99f1f31082618c3259d279a76b7ebd3d4bdc5475c2442d34a  cert-manager-v1.21.2.tgz
 30466da52b9fcd15aaa47333f57a34cf1a289fee6f40c6d8a4c8b705deb05b9b  contour-0.8.0.tgz
-5dd033a4b872bf641860695705ee460031d0bc695f114bf8926fee6736814e19  external-dns-1.21.1.tgz
+ec26bba67e02f46a55ac33790ad9d9ded724a163af6f6b4a63ce68f883201f4f  external-dns-1.22.0.tgz
 7b7fe51a431b5b133b0ce7eb9dcb222b6a37fb967c163223cf480054ad14d752  kyverno-3.9.1.tgz

installer/operator/vendored-charts/embed.go

@@ -37,9 +37,9 @@ import (
 // CertManagerVersion mirrors the embedded tarball's appVersion and the
 // vendored-charts/SHA256SUMS entry; bumped only when the tarball is
 // replaced via `make vendor-charts`.
-const CertManagerVersion = "v1.20.3"
+const CertManagerVersion = "v1.21.2"
 
-//go:embed cert-manager-v1.20.3.tgz
+//go:embed cert-manager-v1.21.2.tgz
 var certManagerTarball []byte
 
 // CertManager parses the embedded cert-manager tarball and returns a
@@ -75,19 +75,19 @@ func Contour() (*chart.Chart, error) {
 // (semver of the *chart*, distinct from the external-dns
 // appVersion). Surfaced in
 // status.bundledChartVersions["external-dns"].
-const ExternalDNSChartVersion = "1.21.1"
+const ExternalDNSChartVersion = "1.22.0"
 
 // ExternalDNSAppVersion is the kubernetes-sigs/external-dns binary
 // version the embedded chart installs.
-const ExternalDNSAppVersion = "0.21.0"
+const ExternalDNSAppVersion = "0.22.0"
 
-//go:embed external-dns-1.21.1.tgz
+//go:embed external-dns-1.22.0.tgz
 var externalDNSTarball []byte
 
 // ExternalDNS parses the embedded kubernetes-sigs external-dns
 // chart tarball and returns a chart ready for the Helm SDK.
 // Source: https://github.com/kubernetes-sigs/external-dns
-// (helm-chart-1.21.1 release).
+// (helm-chart-1.22.0 release).
 func ExternalDNS() (*chart.Chart, error) {
 	return helm.LoadArchive(externalDNSTarball)
 }