> For the complete documentation index, see [llms.txt](https://platform9.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://platform9.com/kb/pmk/how-to/disablingpf9managedcert-manager.md).

# Disabling pf9-managed cert-manager

## Problem

After upgrading the cluster to version 1.28.6, cert-manager is getting installed in the luigi-system namespace is having conflict with the existing custom cert manager in the cert-manager namespace. As a result, the cert-manager pods are going into an error state.

{% tabs %}
{% tab title="Javascript" %}

```javascript
% kubectl get pods -A | grep cert-manager
cert-manager             cert-manager-89b545d6d-zstl8                             1/1     Running            2 (3h4m ago)       9h
cert-manager             cert-manager-cainjector-646bf69b85-xhbxp                 0/1     CrashLoopBackOff   64 (78s ago)       9h
cert-manager             cert-manager-webhook-796478777-qzzfs                     1/1     Running            0                  9h
luigi-system             cert-manager-5dcbbc765c-hpbql                            1/1     Running            2 (5h3m ago)       8h
luigi-system             cert-manager-cainjector-6db486b6b7-d8btt                 1/1     Running            2 (5h3m ago)       8h
luigi-system             cert-manager-webhook-57876b9fd-j4f6l                     1/1     Running            0                  8h
```

{% endtab %}
{% endtabs %}

## Environment

* Platform9 Managed Kubernetes 5.9.4
* Kubernetes version 1.28.6

## Procedure

To completely disable pf9 managed cert-manager and continue using custom cert-manager:

1. Patch the pf9-addon-operator image to the custom private image which doesn't install/uninstall pf9-managed cert-manager.
2. Apply the below script, which will point all the CRB from luigi-system to cert-manager system.

{% tabs %}
{% tab title="Javascript" %}

```javascript
#!/bin/bash

# List of ClusterRoleBindings to update
CRBS=(
  cert-manager-cainjector
  cert-manager-controller-issuers
  cert-manager-controller-clusterissuers
  cert-manager-controller-certificates
  cert-manager-controller-orders
  cert-manager-controller-challenges
  cert-manager-controller-ingress-shim
  cert-manager-controller-approve:cert-manager-io
  cert-manager-controller-certificatesigningrequests
  cert-manager-webhook:subjectaccessreviews
)

# New namespace value
NEW_NAMESPACE="cert-manager"

echo "Updating ClusterRoleBinding subjects to use namespace: $NEW_NAMESPACE"

for crb in "${CRBS[@]}"; do
  echo "Patching $crb..."
  kubectl patch clusterrolebinding "$crb" \
    --type=json \
    -p='[{"op": "replace", "path": "/subjects/0/namespace", "value": "'"$NEW_NAMESPACE"'"}]'
done

echo "All ClusterRoleBindings updated successfully."
```

{% endtab %}
{% endtabs %}

3. Edit the webhooks to point to the cert-manager namespace instead of luigi-system namespace.

{% tabs %}
{% tab title="Javascript" %}

```javascript
kubectl edit ValidatingWebhookConfiguration cert-manager-webhook
kubectl edit MutatingWebhookConfiguration cert-manager-webhook
```

{% endtab %}
{% endtabs %}

And delete all the 3 cert-manager deployments from luigi-system.

{% tabs %}
{% tab title="Javascript" %}

```javascript
kubectl delete deploy cert-manager-webhook -n luigi-system
kubectl delete deploy cert-manager-cainjector -n luigi-system
kubectl delete deploy cert-manager -n luigi-system
```

{% endtab %}
{% endtabs %}

Once this is done all the pf9-managed cert-manager will be completely cleaned and wont be applied again.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://platform9.com/kb/pmk/how-to/disablingpf9managedcert-manager.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.