You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Reapply "fix: Race condition in webhook certificate renewal with cert-manager self-signed issuer without a dedicated CA certificate #4019"
This reverts commit 37ba56a.
* remove keep secret flag from helm
The AWS Load Balancer Controller uses admission webhooks to validate and mutate resources. These webhooks require TLS certificates to operate securely. You can use cert-manager to automatically provision and manage these certificates.
4
+
5
+
## Upgrade Notes
6
+
7
+
When upgrading from a previous version, the following scenarios are handled automatically:
8
+
9
+
- If you're using cert-manager with a custom issuer:
10
+
- Set `certManager.issuerRef` to keep using your issuer
11
+
- The new CA hierarchy will not be created
12
+
- Your existing certificate configuration is preserved
13
+
- If you're using cert-manager without a custom issuer:
14
+
- A new CA hierarchy will be created
15
+
- New certificates will be issued using this CA
16
+
- The transition is handled automatically by cert-manager
17
+
18
+
## How it Works
19
+
20
+
When using cert-manager integration, the controller creates a certificate hierarchy that consists of:
21
+
22
+
1. A self-signed issuer used only to create the root CA certificate
23
+
2. A root CA certificate with a 5-year validity period
24
+
3. A CA issuer that uses the root certificate to sign webhook serving certificates
25
+
4. Webhook serving certificates with 1-year validity that are automatically renewed
26
+
27
+
This setup prevents race conditions during certificate renewal by:
28
+
- Using a long-lived (5 years) root CA certificate that remains stable
29
+
- Only renewing the serving certificates while keeping the CA constant
30
+
- Letting cert-manager's CA injector handle caBundle updates in webhook configurations
31
+
32
+
## Configuration
33
+
34
+
To enable cert-manager integration, set `enableCertManager: true` in your Helm values.
35
+
36
+
You can customize the certificate configuration through these values:
37
+
38
+
```yaml
39
+
enableCertManager: true
40
+
41
+
certManager:
42
+
# Webhook serving certificate configuration
43
+
duration: "8760h0m0s"# 1 year (default)
44
+
renewBefore: "720h0m0s"# 30 days (optional)
45
+
revisionHistoryLimit: 10# Optional
46
+
47
+
# Root CA certificate configuration
48
+
rootCert:
49
+
duration: "43800h0m0s"# 5 years (default)
50
+
51
+
# Optional: Use your own issuer instead of the auto-generated one
52
+
# issuerRef:
53
+
# name: my-issuer
54
+
# kind: ClusterIssuer
55
+
```
56
+
57
+
### Using Custom Issuers
58
+
59
+
If you want to use your own cert-manager issuer instead of the auto-generated CA, you can configure it through `certManager.issuerRef`:
60
+
61
+
```yaml
62
+
certManager:
63
+
issuerRef:
64
+
name: my-issuer
65
+
kind: ClusterIssuer # or Issuer
66
+
```
67
+
68
+
When a custom issuer is specified:
69
+
- The controller will not create its own CA certificate chain
70
+
- The specified issuer will be used directly to issue webhook serving certificates
71
+
- You are responsible for ensuring the issuer is properly configured and available
72
+
73
+
### Certificate Renewal
74
+
75
+
1. Root CA Certificate:
76
+
- Valid for 5 years by default
77
+
- Used only for signing webhook certificates
78
+
- Not renewed automatically to maintain stability
79
+
80
+
2. Webhook Serving Certificates:
81
+
- Valid for 1 year by default
82
+
- Renewed automatically 30 days before expiry
83
+
- Updates handled seamlessly by cert-manager
84
+
85
+
### Best Practices
86
+
87
+
1. Use the default certificate hierarchy unless you have specific requirements
88
+
2. If using a custom issuer, ensure it's highly available and properly configured
89
+
3. Monitor certificate resources for renewal status and potential issues
90
+
4. Keep cert-manager up to date to benefit from the latest improvements
0 commit comments