Disabling pf9-managed cert-manager
Problem
After upgrading the cluster to version 1.28.6, cert-manager is getting installed in the luigi-system namespace is having conflict with the existing custom cert manager in the cert-manager namespace. As a result, the cert-manager pods are going into an error state.
% kubectl get pods -A | grep cert-managercert-manager cert-manager-89b545d6d-zstl8 1/1 Running 2 (3h4m ago) 9hcert-manager cert-manager-cainjector-646bf69b85-xhbxp 0/1 CrashLoopBackOff 64 (78s ago) 9hcert-manager cert-manager-webhook-796478777-qzzfs 1/1 Running 0 9hluigi-system cert-manager-5dcbbc765c-hpbql 1/1 Running 2 (5h3m ago) 8hluigi-system cert-manager-cainjector-6db486b6b7-d8btt 1/1 Running 2 (5h3m ago) 8hluigi-system cert-manager-webhook-57876b9fd-j4f6l 1/1 Running 0 8hEnvironment
- Platform9 Managed Kubernetes 5.9.4
- Kubernetes version 1.28.6
Procedure
To completely disable pf9 managed cert-manager and continue using custom cert-manager:
- Patch the pf9-addon-operator image to the custom private image which doesn't install/uninstall pf9-managed cert-manager.<Need to add the repo details here>
- Apply the below script, which will point all the CRB from luigi-system to cert-manager system.
x
# List of ClusterRoleBindings to updateCRBS=( cert-manager-cainjector cert-manager-controller-issuers cert-manager-controller-clusterissuers cert-manager-controller-certificates cert-manager-controller-orders cert-manager-controller-challenges cert-manager-controller-ingress-shim cert-manager-controller-approve:cert-manager-io cert-manager-controller-certificatesigningrequests cert-manager-webhook:subjectaccessreviews)# New namespace valueNEW_NAMESPACE="cert-manager"echo "Updating ClusterRoleBinding subjects to use namespace: $NEW_NAMESPACE"for crb in "${CRBS[@]}"; do echo "Patching $crb..." kubectl patch clusterrolebinding "$crb" \ --type=json \ -p='[{"op": "replace", "path": "/subjects/0/namespace", "value": "'"$NEW_NAMESPACE"'"}]'doneecho "All ClusterRoleBindings updated successfully."- Edit the webhooks to point to the cert-manager namespace instead of luigi-system namespace.
kubectl edit ValidatingWebhookConfiguration cert-manager-webhookkubectl edit MutatingWebhookConfiguration cert-manager-webhookAnd delete all the 3 cert-manager deployments from luigi-system.
kubectl delete deploy cert-manager-webhook -n luigi-systemkubectl delete deploy cert-manager-cainjector -n luigi-systemkubectl delete deploy cert-manager -n luigi-systemOnce this is done all the pf9-managed cert-manager will be completely cleaned and wont be applied again.
Was this page helpful?