Open jkossis opened 8 months ago
It looks like Cert Manager is unhappy with the svc suffix ... I can't see how this has worked previously.
More specifically, it is unhappy because it was asked to create a "public" certificate using ACME, but we try to create the certificate internally, without a valid top-level domain.
But we don't need a public certificate at all. We only need a certificate to validate the internal service names (hence the .svc
suffix). Usually, users create some kind of internal issuer, usually using the SelfSigned
or CA
type and use that to provision these internal certificates.
I don't really see the reason one would want a public certificate for this internal component. If the snapshot-controller was reachable from outside the cluster, something has already gone very wrong.
@WanzenBug, I appreciate you providing some more info on this. Admittedly, this would be very useful info to include in the portion of the readme that pertains to using cert-manager. Right now, this is all that is there:
A [cert-manager.io](https://cert-manager.io/) issuer able to create a certificate for the webhook service.
To use this method, create an override file like:
webhook:
tls:
certManagerIssuerRef:
name: internal-issuer
kind: ClusterIssuer
To apply the override, use --values <override-file>.
For sure. Patches welcome :smiley:
When using the webhook's
certManagerIssuerRef
configuration, the following error occurs while generating the certificate:It looks like Cert Manager is unhappy with the
svc
suffix ... I can't see how this has worked previously.