-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
jks keystore in secret is removed when a secret is referenced by multiple certificates #7063
Comments
@TrilokGeer - so in essence, you have 2 What version of cert-manager are you seeing this issue on? |
@TrilokGeer is the issue or the same as the issue I described in #6992 ? |
Yes
1.13, 1.14, 1.15
The certificate has the correct status set while processing by trigger controller. The secret update is not conditioned to check for the status in the issuing controller. Hence, the post-issuance policy chain is updated to ensure the secret is updated with the data generated for the corresponding certificate. |
Hey, thanks for the super detailed ticket. Is that the issue reported in https://issues.redhat.com/browse/CM-339? |
Yes, that is correct. |
/priority important-longterm |
Describe the bug:
A secret name is used in multiple certificates which causes the conflict. The policies address the conflict and update the certificate status accordingly to
However, the secret manager tends to update the secret data when the secret is not owned by the certificate. This results in missing data in secret as per certificate spec. In this case, when there is an existing valid secret generated with jks, secret manager tends to remove and re-generate jks when there is non-jks certificate referring to the same secret is created during the reconciliation.
Expected behaviour:
If the secret annotation does not have the desired certificate name, the secret must not be updated as per the certificate spec.
Steps to reproduce the bug:
Anything else we need to know?:
Environment details::
/kind bug
The text was updated successfully, but these errors were encountered: