feat: native CRD support for ExternalSecrets, cert-manager, and Istio resources

[richwalkup]

Summary

Adds 12 new top-level keys to the common library chart that provide native support for popular CRDs. These replace the need for rawResources with a cleaner flat spec: syntax — no double spec: nesting, and apiVersion/kind/metadata are handled automatically by the chart.

New Top-Level Keys

External Secrets Operator

Key	Kind	apiVersion
externalSecrets	ExternalSecret	external-secrets.io/v1

cert-manager

Key	Kind	apiVersion
certificates	Certificate	cert-manager.io/v1
certificateIssuers	Issuer	cert-manager.io/v1
certificateClusterIssuers	ClusterIssuer	cert-manager.io/v1

Istio

Key	Kind	apiVersion
istioVirtualServices	VirtualService	networking.istio.io/v1
istioGateways	Gateway	networking.istio.io/v1
istioAuthorizationPolicies	AuthorizationPolicy	security.istio.io/v1
istioDestinationRules	DestinationRule	networking.istio.io/v1
istioServiceEntries	ServiceEntry	networking.istio.io/v1
istioPeerAuthentications	PeerAuthentication	security.istio.io/v1
istioRequestAuthentications	RequestAuthentication	security.istio.io/v1
istioSidecars	Sidecar	networking.istio.io/v1

Conversion Example

Before (rawResources):

rawResources:
  secret:
    apiVersion: external-secrets.io/v1
    kind: ExternalSecret
    spec:
      spec:
        refreshInterval: 1h
        secretStoreRef:
          kind: ClusterSecretStore
          name: onepassword
        target:
          name: "{{ .Release.Name }}-secret"

After (native CRD):

externalSecrets:
  secret:
    spec:
      refreshInterval: 1h
      secretStoreRef:
        kind: ClusterSecretStore
        name: onepassword
      target:
        name: "{{ .Release.Name }}-secret"

Breaking Changes

None. This PR is purely additive:

• Only 2 existing files modified (_generate.tpl and values.yaml) — all other changes are new files
• All 12 new keys default to {} — existing charts produce zero additional output
• rawResources is completely untouched and continues to work as before
• Native CRD keys are opt-in; migration can happen incrementally

When to Keep Using rawResources

• Resources that use helm.sh/hook annotations (e.g. ArgoCD sync hooks) — native CRD keys do not support hook annotations
• CRD types not listed above

Implementation

Each CRD type follows the library's standard 4-file pattern:

• lib/<type>/_enabled_<types>.tpl — filter enabled resources
• lib/<type>/_getByIdentifier.tpl — lookup by identifier
• render/_<types>.tpl — loop and render
• classes/_<type>.tpl — blueprint with apiVersion/kind/metadata/spec

All templates use the shared valuesToObject and determineResourceNameFromValues helpers, so naming, labels, and annotations follow the same conventions as every other chart resource.

Documentation

• Common Library > Generated Resources > CRD Resources — reference page for all 12 supported CRDs
• App Template > How To > Native CRD Resources — usage guide with examples for each type and a rawResources migration walkthrough
• App Template > Examples > Service with ExternalSecret & Istio — full production example combining ExternalSecret, Istio Gateway/VirtualService/AuthorizationPolicy, cert-manager Certificate, and NetworkPolicy

Testing

Validated by rendering converted values for 5 real argocd apps (adm-service-ingestion, hello-world, e2e-cron, apollo-e2e) using helm template with the test-chart. All native CRD outputs produce identical spec content compared to their rawResources equivalents.

[nickv2002]

I spoke with Rich, and we decided not to implement this at this time.
The gains in terms of number of lines saved are marginal (see example), but it adds a whole bunch of chart complexity.
We may come back to this later when we want more custom CRD support in the charts.