cert_manager: Fix Apply ClusterIssuer manifest task failed by removing deprecated ClusterIssuer

[rtsp]

What type of PR is this?
/kind bug

What this PR does / why we need it:

Task kubernetes-apps/ingress_controller/cert_manager : Cert Manager | Apply ClusterIssuer manifest failed when deploying kubespray with cert-manager add-ons enabled for K8s v1.22.

This failure caused by applying ClusterIssuer with a hard-coded TLS secret from these manifests.

1. clusterissuer-cert-manager.yml.j2
2. secret-cert-manager.yml.j2

I'm not sure about the purpose of these 2 files. It's included in 9cc70e9 from #6414 since cert-manager v0.15 and it seems to be deprecated now because it does not exist in later version of cert-manager anymore.

After removing these 2 manifests and its related tasks. Everying is working good again (at least on my cluster).

Which issue(s) this PR fixes:

Fixes #8059

Special notes for your reviewer:

I've tested this patch on my cluster (Debian 11, K8s v1.22, containerd, All add-ons enabled)

• ab4356a master - Failed as in cert-manager jobs are failing with unknown root CA error #8059
• 20065ad this patch - Test Passed!

Does this PR introduce a user-facing change?:

Fix cert_manager ClusterIssuer manifest by removing deprecated ClusterIssuer

[k8s-ci-robot]

Hi @rtsp. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[floryut]

/ok-to-test
Nice thanks, I think we need to update cert-manager anyway because the version we have is a bit old

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: floryut, rtsp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [floryut]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rtsp]

/ok-to-test Nice thanks, I think we need to update cert-manager anyway because the version we have is a bit old

Agreed. I'm looking on how to automate conversion of 33k-lines cert-manager manifests 😂.

[cristicalin]

Agreed. I'm looking on how to automate conversion of 33k-lines cert-manager manifests 😂.

@rtsp for now I have a more manual approach to this by just giving up on the split, I was working on a PR this morning but it's in a rough shape still. I'll wait for this PR to merge before submitting the update for 1.5.4.

[cristicalin]

Also it's worthwhile mentioning that for the cert-manager to become actually useful a deployer would need to create a cluster issuer as a first thing after deployment, this means this PR needs an update in https://github.com/kubernetes-sigs/kubespray/blob/master/docs/cert_manager.md?plain=1#L14-L36

[rtsp]

Also it's worthwhile mentioning that for the cert-manager to become actually useful a deployer would need to create a cluster issuer as a first thing after deployment, this means this PR needs an update in https://github.com/kubernetes-sigs/kubespray/blob/master/docs/cert_manager.md?plain=1#L14-L36

Look like this document also need a major revise. I think, for most topics, we can provide links from our docs to upstream cert-manager 0.15 docs to make sure users get completed and updated document.

IMO, we should at least hightlight these topics as I got a lot of question from my users here.

Ingress

1. https://cert-manager.io/v1.5-docs/usage/ingress/
2. https://cert-manager.io/v1.5-docs/tutorials/acme/ingress/#step-3-assign-a-dns-name (Skip to Step 3)

ACME

1. https://cert-manager.io/v1.5-docs/configuration/acme/
2. https://cert-manager.io/v1.5-docs/tutorials/acme/http-validation/
   • https://cert-manager.io/v1.5-docs/configuration/acme/http01/
3. https://cert-manager.io/v1.5-docs/tutorials/acme/dns-validation/
   • https://cert-manager.io/v1.5-docs/configuration/acme/dns01/
4. https://cert-manager.io/v1.5-docs/faq/acme/

[floryut]

/cc @champtar @oomichi

[oomichi]

/lgtm