correct way to know when cert-manager is actually, fully ready?

[ericb-summit]

I'm trying to determine when cert manager is actually, really, positively, 100%, cross-my-heart-and-hope-to-die, completely ready to process cert requests.

This is important as part of ephemeral deployments, because otherwise doing things like requesting certs (via the CRD) blows up with this gem:

Error from server: error when creating "STDIN": conversion webhook for cert-manager.io/v1alpha2, Kind=Certificate failed: Post "https://dev-cert-manager-webhook.dev-cert-manager.svc:443/convert?timeout=30s": x509: certificate signed by unknown authority

So far I have attempted to

• wait for "healthy" from argo-cd (we deploy with argo)
• wait for cert-manager deployment to complete. or cainjector. or the webhook.
• wait for the cert-manager-webhook-ca secret to exist

Nothing seems to accurately reflect whether or not the startup is complete, including and especially the injection of the webhook CA.

Now I'm doing:

kubectl wait --for=condition=complete --timeout=120s job.batch/cert-manager-startupapicheck

And this "works", but only at install time. If I run this later, I get:

Error from server (NotFound): jobs.batch "cert-manager-startupapicheck" not found

Which is still technically a failure and doesn't tell me if it ran to completion whenever it did run. Is there a better way?

[ericb-summit]

From here: https://cert-manager.io/docs/concepts/webhook/#known-problems-and-solutions

For these reasons, after installing cert-manager and when performing post-installation cert-manager API operations, you will need to check for temporary API configuration errors and retry.

Sounds like the expected handling of this is to just retry.