Cert-manager: Clarify why disable-validation label is added, its effect, and whether it can be removed
As far as I can see from https://docs.cert-manager.io/en/latest/getting-started/install.html the label disabling validation is never actually removed again.
I assume that would mean that validation is never active?
Anyway, the command for removing the label is: kubectl label namespace cert-manager certmanager.k8s.io/disable-validation-
StianOvrevage
All 9 comments
So the intention is to keep it disabled for the namespace that the webhook runs in - keeping the label in place will mean that validation will be performed for all other namespaces.
You should be able to remove it afterwards, as you suggest, however if the webhook's certificate ever expires, or some other situations arises wherein the webhook is unable to run, then cert-manager will be unable to issue a certificate (as the webhook will be unavailable!)
Perhaps we should update our documentation to be a bit clearer here? Your issue is definitely valid, and this could be confusing for people!
/kind documentation
/area deploy
/help
munnerz
on 13 Feb 2019
@munnerz:
This request has been marked as needing help from a contributor.
Please ensure the request meets the requirements listed here.
If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.
In response to this:
So the intention is to keep it disabled for the namespace that the webhook runs in - keeping the label in place will mean that validation will be performed for all other namespaces.
You should be able to remove it afterwards, as you suggest, however if the webhook's certificate ever expires, or some other situations arises wherein the webhook is unable to run, then cert-manager will be unable to issue a certificate (as the webhook will be unavailable!)
Perhaps we should update our documentation to be a bit clearer here? Your issue is definitely valid, and this could be confusing for people!
/kind documentation
/area deploy
/help
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
jetstack-bot
on 13 Feb 2019
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale
retest-bot
on 20 May 2019
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale
retest-bot
on 19 Jun 2019
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close
retest-bot
on 19 Jul 2019
@retest-bot: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with/reopen.
Mark the issue as fresh with/remove-lifecycle rotten.
Send feedback to jetstack.
/close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
jetstack-bot
on 19 Jul 2019
@munnerz
Short question about this: What does it mean to disable validation on a namespace? (or rather, what is validated?)
I'd like to install the cert-manager in kube-system where I would also create an ingress for default tls. If I understood you correctly the cert manager should live in a separate namespace?
Kamshak
on 17 Sep 2019
How to deploy cert-manager in an Air-Gap installation of Rancher 2.x
ChinmoyPadhi
on 11 Aug 2020
Now there is a helm chart install, how does this get applied. It's easily possible to ignore a namespace in the mutatingwebhook so this label is not required. Istio does this https://github.com/istio/istio/blob/master/manifests/charts/istio-control/istio-discovery/templates/mutatingwebhook.yaml#L33-L37
drewwells
on 29 Sep 2020
Related issues
jakubknejzlik
路
3Comments
jbouzekri
路
4Comments
r0bj
路
3Comments
f-f
路
4Comments
jbartus
路
4Comments
Most helpful comment
@munnerz
Short question about this: What does it mean to disable validation on a namespace? (or rather, what is validated?)
I'd like to install the cert-manager in kube-system where I would also create an ingress for default tls. If I understood you correctly the cert manager should live in a separate namespace?