Skip to content

Change ACMEHTTP01IngressPathTypeExact feature to beta#7813

Merged
cert-manager-prow[bot] merged 1 commit intocert-manager:masterfrom
wallrj:acmehttp01ingresspathtypeexact-should-be-beta
Jun 17, 2025
Merged

Change ACMEHTTP01IngressPathTypeExact feature to beta#7813
cert-manager-prow[bot] merged 1 commit intocert-manager:masterfrom
wallrj:acmehttp01ingresspathtypeexact-should-be-beta

Conversation

@wallrj
Copy link
Copy Markdown
Member

@wallrj wallrj commented Jun 17, 2025 •
edited
Loading

This new featuregate was supposed to be introduced at maturity level Beta, exactly like the DefaultPrivateKeyRotationPolicyAlways feature. Instead it has been set to GA.

The consequence of setting it to GA, is that when you disable it, you get a warning in the cert-manager logs:

$ kubectl  -n cert-manager logs deployments/cert-manager --follow
W0617 15:42:25.514056       1 feature_gate.go:354] Setting GA feature gate ACMEHTTP01IngressPathTypeExact=false. It will be removed in a future release.

I overlooked this when reviewing #7795

/kind cleanup

NONE

Testing

I re-enabled the ingress-nginx strict-validate-path option:

_bin/tools/helm upgrade                                                                  --install                                                                  --wait                                                                  --version 4.12.3                                                                  --namespace ingress-nginx                                                                  --create-namespace                                                                  --set controller.image.tag=v1.12.3                                                                  --set controller.image.registry=registry.k8s.io                                                                  --set controller.image.digest=                                                                  --set controller.image.pullPolicy=Never                                                                  --set controller.service.clusterIP=10.0.0.15                                                                  --set controller.service.type=ClusterIP                                                                  --set controller.config.no-tls-redirect-locations=                                                                  --set-string controller.config.strict-validate-path-type=true                                                                  --set admissionWebhooks.enabled=true                                                                  --set controller.admissionWebhooks.enabled=true                                                                  --set controller.watchIngressWithoutClass=true                                                                  ingress-nginx ingress-nginx/ingress-nginx

Reconfigured cert-manager with the feature gates disabled:

make e2e-setup FEATURE_GATES=AllAlpha=false,AllBeta=false

And observed a subset of the Ingress E2E tests pass:

$ make e2e GINKGO_FOCUS='ACME HTTP01 Issuer \(Ingress\)'
...
[Conformance] Certificates with External Account Binding with issuer type ACME HTTP01 Issuer (Ingress) should issue an ECDSA, defaulted certificate for a single distinct DNS Name
/home/richard/projects/cert-manager/cert-manager/test/e2e/suite/conformance/certificates/suite.go:133
  STEP: Creating a kubernetes client @ 06/17/25 17:50:36.417
  STEP: Creating an API extensions client @ 06/17/25 17:50:36.417
  STEP: Creating a cert manager client @ 06/17/25 17:50:36.417
  STEP: Creating a controller-runtime client @ 06/17/25 17:50:36.417
  STEP: Creating a gateway-api client @ 06/17/25 17:50:36.417
  STEP: Building a namespace api object @ 06/17/25 17:50:36.417
  STEP: Using the namespace e2e-tests-certificates-rmbkv @ 06/17/25 17:50:36.42
  STEP: Building a ResourceQuota api object @ 06/17/25 17:50:36.42
  STEP: Creating an issuer resource @ 06/17/25 17:50:36.425
  STEP: Creating an ACME HTTP01 Ingress Issuer @ 06/17/25 17:50:36.429
  STEP: Waiting for acme HTTP01 Ingress Issuer to be Ready @ 06/17/25 17:50:36.433
  Jun 17 17:50:36.437: INFO: Expected Issuer acme-issuer-http01-kptsb condition Ready=True but it has: []
  Jun 17 17:50:36.938: INFO: Expected Issuer acme-issuer-http01-kptsb condition Ready=True but it has: [] (took 0s)
  STEP: Creating a Certificate @ 06/17/25 17:50:36.938
I0617 17:50:36.946539  475038 warning_handler.go:64] "spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`." logger="cert-manager"
  STEP: Waiting for the Certificate to be issued... @ 06/17/25 17:50:36.946
  Jun 17 17:50:36.951: INFO: Expected Certificate e2e-conformance-vthvrt6w4z condition Ready=True (generation >= 1) but it has: []
  Jun 17 17:50:41.951: INFO: Expected Certificate e2e-conformance-vthvrt6w4z condition Ready=True (generation >= 1) but it has: [{Issuing True 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1} {Ready False 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1}]
  Jun 17 17:50:48.456: INFO: Expected Certificate e2e-conformance-vthvrt6w4z condition Ready=True (generation >= 1) but it has: [{Issuing True 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1} {Ready False 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1}]
  Jun 17 17:50:58.721: INFO: Expected Certificate e2e-conformance-vthvrt6w4z condition Ready=True (generation >= 1) but it has: [{Issuing True 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1} {Ready False 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1}]
  Jun 17 17:51:03.719: INFO: Expected Certificate e2e-conformance-vthvrt6w4z condition Ready=True (generation >= 1) but it has: [{Issuing True 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1} {Ready False 2025-06-17 17:50:36 +0100 BST DoesNotExist Issuing certificate as Secret does not exist 1}] (took 24s)
  STEP: Validating the issued Certificate... @ 06/17/25 17:51:03.719
  STEP: Cleaning up the issuer resource @ 06/17/25 17:51:03.722
  STEP: Deleting test namespace @ 06/17/25 17:51:03.725
• [24.544 seconds]

@wallrj-cyberark
Change ACMEHTTP01IngressPathTypeExact feature to beta
3aa67dd 
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
@cert-manager-prow cert-manager-prow bot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jun 17, 2025
@wallrj wallrj mentioned this pull request Jun 17, 2025
Merged
erikgb
erikgb reviewed Jun 17, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@erikgb erikgb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@cert-manager-prow
Copy link
Copy Markdown
Contributor

cert-manager-prow bot commented Jun 17, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jun 17, 2025
@cert-manager-prow cert-manager-prow bot merged commit c0c7c42 into cert-manager:master Jun 17, 2025
6 checks passed
@wallrj
Copy link
Copy Markdown
Member Author

wallrj commented Jun 17, 2025

/cherry-pick release-1.18

@wallrj wallrj deleted the acmehttp01ingresspathtypeexact-should-be-beta branch June 17, 2025 16:58
@cert-manager-bot
Copy link
Copy Markdown
Contributor

cert-manager-bot commented Jun 17, 2025

@wallrj: new pull request created: #7814

Details

In response to this:

/cherry-pick release-1.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@cert-manager-bot cert-manager-bot mentioned this pull request Jun 17, 2025
Merged
@maelvls maelvls mentioned this pull request Sep 19, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@erikgb erikgb erikgb left review comments

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@wallrj @cert-manager-bot @erikgb @wallrj-cyberark