From 9ba7c602d9fa676cae2b70f2ab15ef7be7f520d6 Mon Sep 17 00:00:00 2001
From: Yuqi Guo <yuqi.guo17@gmail.com>
Date: Tue, 12 May 2026 21:18:34 -0600
Subject: [PATCH] cert-manager: build crd-model-gen image locally in update.sh

The default crd-model-gen image referenced by update.sh lives on
docker.pkg.github.com, which requires GitHub authentication. Anonymous
docker pulls fail with "Access is denied", so contributors who try to
follow the README cannot run update.sh out of the box (reported by
multiple users in the comments on issue 3489).

Detect the missing image at runtime and build it locally from the
Dockerfile shipped in client-java-contrib/, defaulting to
local/crd-model-gen:latest. IMAGE_NAME and IMAGE_TAG can still be set
to point at a prebuilt image.

Also refresh README.md so the dependency snippet and compatibility
table match the current artifact version (27.0.0-SNAPSHOT) and the
v1.13.4 CRD URL already used by update.sh.
---
 client-java-contrib/cert-manager/README.md |  4 ++--
 client-java-contrib/cert-manager/update.sh | 17 +++++++++++++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/client-java-contrib/cert-manager/README.md b/client-java-contrib/cert-manager/README.md
index 42086af1d5..a6abf17a8b 100644
--- a/client-java-contrib/cert-manager/README.md
+++ b/client-java-contrib/cert-manager/README.md
@@ -8,14 +8,14 @@ To use this library, include the following maven dependency
 <dependency>
     <groupId>io.kubernetes</groupId>
     <artifactId>client-java-cert-manager-models</artifactId>
-    <version>0.16.1-SNAPSHOT</version>
+    <version>27.0.0-SNAPSHOT</version>
 </dependency>
 ```
 Please refer to the [CertManagerExample](../../examples/src/main/java/io/kubernetes/client/examples/CertManagerExample.java), which demonstrates how to create a self signed issuer using the model class and Kubernetes Java client generic API.
 ## Compatibility
 Artifact Version|Cert-Manager Release Version|CRD Source
 ----------------|----------------------------|----------
-0.16.1-SNAPSHOT|0.16.1|[Here](https://github.com/jetstack/cert-manager/releases/download/v0.16.1/cert-manager.crds.yaml)
+27.0.0-SNAPSHOT|1.13.4|[Here](https://github.com/jetstack/cert-manager/releases/download/v1.13.4/cert-manager.crds.yaml)
 ## Code Generation
 There is a utility script [update.sh](update.sh) to help with the code generation.
 
diff --git a/client-java-contrib/cert-manager/update.sh b/client-java-contrib/cert-manager/update.sh
index 57d3484b41..dcc4e224a9 100755
--- a/client-java-contrib/cert-manager/update.sh
+++ b/client-java-contrib/cert-manager/update.sh
@@ -16,11 +16,24 @@
 # This script generates the model classes from a released version of cert-manager CRDs
 # under src/main/java/io/cert/manager/models.
 
-DEFAULT_IMAGE_NAME=docker.pkg.github.com/kubernetes-client/java/crd-model-gen
-DEFAULT_IMAGE_TAG=v2.0.0
+# The crd-model-gen image used to be published to docker.pkg.github.com, which
+# requires GitHub authentication and returns "Access is denied" for anonymous
+# pulls (see kubernetes-client/java#3489). Build it locally from the Dockerfile
+# in this repository instead, so the script works out of the box.
+DEFAULT_IMAGE_NAME=local/crd-model-gen
+DEFAULT_IMAGE_TAG=latest
 IMAGE_NAME=${IMAGE_NAME:=$DEFAULT_IMAGE_NAME}
 IMAGE_TAG=${IMAGE_TAG:=$DEFAULT_IMAGE_TAG}
 
+# Build the crd-model-gen image locally if it is not already present, using the
+# Dockerfile shipped in client-java-contrib/.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CONTRIB_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+if ! docker image inspect "${IMAGE_NAME}:${IMAGE_TAG}" >/dev/null 2>&1; then
+  echo "Building ${IMAGE_NAME}:${IMAGE_TAG} from ${CONTRIB_DIR}/Dockerfile ..."
+  docker build -t "${IMAGE_NAME}:${IMAGE_TAG}" "${CONTRIB_DIR}"
+fi
+
 # a crdgen container is run in a way that:
 #   1. it has access to the docker daemon on the host so that it is able to create sibling container on the host
 #   2. it runs on the host network so that it is able to communicate with the KinD cluster it launched on the host