Is there any progress on this issue?

To sound dramatic:

My (lab) cluster accessibility is failing hard because cert-manager is not running for longer than 3 months and I'm not able to install or upgrade a more recent version when we stick to using gitops.
On my production clusters manual installation is not possible due to security restrictions, so in the next months I'm going to have a big issue if our production cert-manager fails and needs upgrading ...

I'd love to have a non-manual non-interactive non-hacky way to reinstall cert-manager on my clusters..... I've tried the suggestion in this thread to change some fields in the crd file but all my tries resulted in kubectl failing to apply with an enormous stacktrace...

So i'd tried the manual installation, to see if it would help to save our behind in case something goes very badong on production, which gives some errors as well:

kubectl apply manually without --validate=false gives errors:

error: error validating "00-crds.yaml": error validating data: ValidationError(CustomResourceDefinition.spec): unknown field "preserveUnknownFields" in io.k8s.apiextensions-apiserver.pkg.apis.apiextensions.v1beta1.CustomResourceDefinitionSpec; if you choose to ignore these errors, turn validation off with --validate=false

kubectl apply manually with --validate=false gives errors too:

Error from server (Invalid): error when creating "00-crds.yaml": CustomResourceDefinition.apiextensions.k8s.io "certificaterequests.cert-manager.io" is invalid: spec.conversion.webhookClientConfig: Required value: required when strategy is set to Webhook, but not allowed because the CustomResourceWebhookConversion feature is disabled
Error from server (Invalid): error when creating "00-crds.yaml": CustomResourceDefinition.apiextensions.k8s.io "certificates.cert-manager.io" is invalid: spec.conversion.webhookClientConfig: Required value: required when strategy is set to Webhook, but not allowed because the CustomResourceWebhookConversion feature is disabled
Error from server (Invalid): error when creating "00-crds.yaml": CustomResourceDefinition.apiextensions.k8s.io "challenges.acme.cert-manager.io" is invalid: spec.conversion.webhookClientConfig: Required value: required when strategy is set to Webhook, but not allowed because the CustomResourceWebhookConversion feature is disabled
Error from server (Invalid): error when creating "00-crds.yaml": CustomResourceDefinition.apiextensions.k8s.io "clusterissuers.cert-manager.io" is invalid: spec.conversion.webhookClientConfig: Required value: required when strategy is set to Webhook, but not allowed because the CustomResourceWebhookConversion feature is disabled
Error from server (Invalid): error when creating "00-crds.yaml": CustomResourceDefinition.apiextensions.k8s.io "issuers.cert-manager.io" is invalid: spec.conversion.webhookClientConfig: Required value: required when strategy is set to Webhook, but not allowed because the CustomResourceWebhookConversion feature is disabled
Error from server (Invalid): error when creating "00-crds.yaml": CustomResourceDefinition.apiextensions.k8s.io "orders.acme.cert-manager.io" is invalid: spec.conversion.webhookClientConfig: Required value: required when strategy is set to Webhook, but not allowed because the CustomResourceWebhookConversion feature is disabled

I'm a bit stuck at the moment and my (lab) cluster remains down, (and I try not to think about my production cluster)... I'd love to have a solution that leaves my git repository as the single source of truth for our configuration as it saves us hours during a failover and is required for our security audits....

Is there anything I can do to help speed the search for a solution for this validation issue?
We'd love to keep using cert-manager as it served us well for the last years...

GitOps support #2197

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions