Upgrade JetStack Cert-Manager to v0.15.2

[bmelbourne]

What type of PR is this?
/kind feature

What this PR does / why we need it:

This PR upgrades the deployment of JetStack Cert-Manager to v0.15.2.

Which issue(s) this PR fixes:
Fixes #5946

Special notes for your reviewer:
For additional information, refer to roles\kubernetes-apps\ingress_controller\cert_manager\README.md.

Does this PR introduce a user-facing change?:

Action required: Refer to roles\kubernetes-apps\ingress_controller\cert_manager\README.md prior to upgrading JetStack Cert-Manager in your exisitng Kubernetes cluster.

[k8s-ci-robot]

Hi @bmelbourne. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[bmelbourne]

There's appear to be underlying issue with k8s dns/service resolution when deployed on CentOS7 only.

TASK [kubernetes-apps/ingress_controller/cert_manager : Cert Manager | Apply ClusterIssuer manifest] ***
fatal: [k8s-1]: FAILED! => {"changed": false, "msg": "error running kubectl (/usr/local/bin/kubectl apply --force --filename=/etc/kubernetes/addons/cert_manager/clusterissuer-cert-manager.yml) command (rc=1), out='', err='Error from server (InternalError): error when creating \"/etc/kubernetes/addons/cert_manager/clusterissuer-cert-manager.yml\": Internal error occurred: failed calling webhook \"webhook.cert-manager.io\": Post https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=30s: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)\n'"}

If I install busybox and lookup the service dns for cert-manager-webhook.cert-manager.svc, it fails for CentOS7 whereas for Ubuntu 18.04 it passes.

CentOS 7

$ k run busybox --image=busybox:1.28 --command -- sleep 3600
$ POD_NAME=$(k get pods -l run=busybox -o jsonpath="{.items[0].metadata.name}")
$ k exec -ti $POD_NAME -- nslookup kubernetes.default.svc
Server:         169.254.25.10
Address:        169.254.25.10:53

** server can't find kubernetes.default.svc: NXDOMAIN

*** Can't find kubernetes.default.svc: No answer

command terminated with exit code 1

$ k exec -ti $POD_NAME -- nslookup cert-manager-webhook.cert-manager.svc
Server:         169.254.25.10
Address:        169.254.25.10:53

** server can't find cert-manager-webhook.cert-manager.svc: NXDOMAIN

*** Can't find cert-manager-webhook.cert-manager.svc: No answer

command terminated with exit code 1

Ubuntu 18.04

$ k exec -ti $POD_NAME -- nslookup kubernetes.default.svc
Server:    169.254.25.10
Address 1: 169.254.25.10

Name:      kubernetes.default.svc
Address 1: 10.233.0.1 kubernetes.default.svc.cluster.local

$ k exec -ti $POD_NAME -- nslookup cert-manager-webhook.cert-manager.svc
Server:    169.254.25.10
Address 1: 169.254.25.10

Name:      cert-manager-webhook.cert-manager.svc
Address 1: 10.233.62.186 cert-manager-webhook.cert-manager.svc.cluster.local

Does anyone know if there is an outstanding issue with CentOS7, Flannel CNI and K8s DNS?

[bmelbourne]

/assign @woopstar

[floryut]

/ok-to-test

[floryut]

@bmelbourne Could you try another CI test then ? if it doesn't work only on Centos7 we could warn users and still roll this out.

[bmelbourne]

@bmelbourne Could you try another CI test then ? if it doesn't work only on Centos7 we could warn users and still roll this out.

@floryut I've merged in the latest master commits yesterday and the issue appears to be have been resolved. Looking through the commit history, the only likely possible fix is the K8s upgrade to v1.18.6, otherwise nothing else stands out.

All CI tests are now passing which is great news to move this PR forward.

[floryut]

@bmelbourne Could you try another CI test then ? if it doesn't work only on Centos7 we could warn users and still roll this out.

@floryut I've merged in the latest master commits yesterday and the issue appears to be have been resolved. Looking through the commit history, the only likely possible fix is the K8s upgrade to v1.18.6, otherwise nothing else stands out.

All CI tests are now passing which is great news to move this PR forward.

That great work man, I'm very pleased if we can ship this in master, will try to take a look at all changes.
WDYT @Miouge1 ?

This would require a big note in release note (as written in the PR) but I think we need to move away from a 2y/o version

[Miouge1]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bmelbourne, Miouge1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Miouge1]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

@bmelbourne: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[floryut]

Ok let's roll and fix issues in other PR if need be, we need to move forward with this :)
Good job @bmelbourne
/lgtm

[bmelbourne]

Ok let's roll and fix issues in other PR if need be, we need to move forward with this :)
Good job @bmelbourne
/lgtm

@floryut As this was my first PR in Kubespray, thanks for your patience on this one.
Hopefully, the community will find the latest Cert Manager version useful, particularly the auto-renewal feature.