Cert-manager: Error registering controllers: no matches for kind "Certificate" in version "cert-manager.io/v1alpha2

[cmoulliard]

Describe the bug

The cert-manager-cainjector pod reports the following error when it is started

I1129 14:12:25.476834       1 start.go:82] starting ca-injector v0.12.0 (revision 0e384f5d0)
  | I1129 14:12:26.085526       1 controller.go:121] cert-manager/controller-runtime/controller "level"=0 "msg"="Starting EventSource"  "controller"="mutatingwebhookconfiguration" "source"={"Type":{"metadata":{"creationTimestamp":null}}}
... 
I1129 14:12:26.095504       1 controller.go:121] cert-manager/controller-runtime/controller "level"=0 "msg"="Starting EventSource"  "controller"="customresourcedefinition" "source"={"Type":{"metadata":{"creationTimestamp":null}}}
I1129 14:12:26.095597       1 leaderelection.go:241] attempting to acquire leader lease  kube-system/cert-manager-cainjector-leader-election-core...
E1129 14:12:28.182666       1 source.go:88] cert-manager/controller-runtime/source "msg"="if kind is a CRD, it should be installed before calling Start" "error"="no matches for kind \"Certificate\" in version \"cert-manager.io/v1alpha2\""  "kind"={"Group":"cert-manager.io","Kind":"Certificate"}
F1129 14:12:28.182734       1 start.go:123] error registering controllers: no matches for kind "Certificate" in version "cert-manager.io/v1alpha2"

Steps to reproduce the bug:

• oc login -u system:admin
• oc new-project cert-manager
• oc apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.12.0/cert-manager-openshift.yaml

Anything else we need to know?:
The 3 CRDs of the cert manager have not been installed as some errors are reported

https://gist.githubusercontent.com/cmoulliard/fcc024ead0853ff992448f4123214d84/raw/26f58919d807acd86c77369897ff39a4cbf62a10/gistfile1.txt

Environment details::

• Kubernetes & openshift version

oc v3.11.0+0cbc58b
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://88.99.185.118:8443
kubernetes v1.11.0+d4cacc0

• cert-manager version : v0.12.0
• Install method : static manifests

/kind bug

[munnerz]

The minimum supported Kubernetes version in cert-manager is v1.12, and from your output it appears you are attempting to deploy to OpenShift built with Kubernetes 1.11.

I'm not too familiar with OpenShift's release process or versioning, but you'll need to upgrade to a compatible version in order to continue using cert-manager.

It's worth noting that Kubernetes 1.11 is officially EoL now, and no new security patches will be provided for it.

[cmoulliard]

It's worth noting that Kubernetes 1.11 is officially EoL now, and no new security patches will be provided for it.

Can you then add a warning within the doc to mention that installation will fail for ocp 3.11 and that a new version of ocp4 should be then used ?

[munnerz]

2609 has added support for OpenShift 3.11 back to cert-manager. It will be included as part of the upcoming v0.14 release :)

[amgads]

had the issue with 1.15 -- it works in 1.16
any help or suggestion?

kubectl apply -f /root/ssl-cert.yaml

error: unable to recognize "/etc/rook/object-ssl-cert.yaml": no matches for kind "Certificate" in version "cert-manager.io/v1alpha2"

kubectl version

Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.4", GitCommit:"67d2fcf276fcd9cf743ad4be9a9ef5828adc082f", GitTreeState:"clean", BuildDate:"2019-09-18T14:51:13Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.4", GitCommit:"67d2fcf276fcd9cf743ad4be9a9ef5828adc082f", GitTreeState:"clean", BuildDate:"2019-09-18T14:41:55Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}

[amgads]

I found the issue,

in 1.15 -- apiVersion: certmanager.k8s.io/v1alpha1 works

[amgads]

In 1.16 -- it's apiVersion: cert-manager.io/v1alpha2

apiVersion: certmanager.k8s.io/v1alpha1 doesn't work in 1.16

[munnerz]

@amgads the issue you're seeing is not related to what Kubernetes version you are running, rather, it sounds like in your 1.15 cluster you have CRDs installed from a pre-0.11 version of cert-manager. Please make sure to upgrade your installation. More information on how to do this can be found here: https://cert-manager.io/docs/installation/upgrading/

Hope that helps!