cert-manager / sample-external-issuer Goto Github PK

Currently:

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.2.5

So it might just require a newer version of controller-tools which is currently at 0.5.0.
v1 CRDs were introduced in 0.4.0:

• https://github.com/kubernetes-sigs/controller-tools/releases/tag/v0.4.0

Controller Deployment should set runAsNonRoot and the Docker image should set the default user to a non-root user.

In cert-manager/cert-manager#4036 I have to work around this by configuring Kyverno to ignore the sample-external-issuer namespace.

Hello,
we developed a custom issuer from the sample in this repository.

While testing our custom issuer, we encountered a bug which causes spurious reconcile loops in the RetryOnConflict function we use.
For some reason we still don't understand, the certificaterequest annotations changes are not always applied and the following Reconcile loop does not see them, causing a new API request to our backend.
This is a problem, since API requests must only be performed once per certificaterequest.

We posted the issue on the cert-manager issue tracker and we have been advised to enable Server-Side Apply.

Can it be enabled by changing a setting in the operator configuration (kubebuilder or client-go)?
In any case, could you please provide an example?

Thanks!

We should create Kubernetes Events linked to the Sample Issuer and ClusterIssuer resources,
and events linked to the CertificateRequests that the issuer operates on.

This will make it easier for an administrator to understand what the issuer is doing and it will make errors even easier to diagnose, because the warning events will show up in kubectl describe issuer and kubectl describe certificaterequest.

Take a look at what @jakexks did in https://github.com/jetstack/google-cas-issuer/tree/main/.github/workflows and copy / adapt it

The current image was uploaded manually by @wallrj to his own container registry.

It should be published to a cert-manager registry or to Github GCR in this repo.

I have a very short bash and powershell script which I currently use to generate certificates in my kubernetes cluster, they are so small and simple that it seems like if I can just get the sample issuer customized I should be able to add what little code is needed to create a working issuer for my environment which I could then share and support for the community.

Could I get just a little more detail on this step? I see the comment it is specifying '// +kubebuilder:subresource:status' is already in the file its asking me to modify. Is that what I need to add? Has it already been added automatically and the documentation just needs to be updated? Do I need to add in multiple places? Just looking for a little guidence. Please don't just give me a link to https://book.kubebuilder.io/reference/markers/crd.html, I saw the link and have clicked on it, thank you ahead of time. Maybe the answer is I need to go off and learn go for a couple months. If so I let me know and I can move on till I have time. Was hoping I might be able to learn just enough to get things going for now.

api/v1alpha1/{cluster}issuer_types.go: Add Kubebuilder CRD Markers to allow modification of IssuerStatus as a Status Subresource: 
// +kubebuilder:subresource:status

Use the latest version of controller-runtime