Helm Chart: certmanager requires user specify .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef

[wigust]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

The Helm Chart validation for clustermesh.apiserver.tls.auto.certManagerIssuerRef is broken.

Running helm template --values val.yaml ./. fails on 1.12.4 and origin/master (d8c7d93) because of validation in install/kubernetes/cilium/templates/validate.yaml:

{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") }}
  {{- if not .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef }}
    {{ fail "ClusterMesh TLS certgen method=certmanager requires user specify .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef" }}
  {{- end }}  
{{- end }}

val.yaml:

rollOutCiliumPods: true

cni:
  exclusive: false
  debug:
    enabled: true

prometheus:
  enabled: true

operator:
  rollOutPods: true
  prometheus:
    enabled: true

kubeProxyReplacement: "strict"

k8sServiceHost: "172.16.102.137"
k8sServicePort: "6443"

bpf:
  masquerade: true

bgp:
  enabled: false
  announce:
    loadbalancerIP: true

ipam:
  mode: "kubernetes"

bgpControlPlane:
  enabled: true

ingressController:
  enabled: true

hubble:
  relay:
    rollOutPods: true
    enabled: true
  ui:
    rollOutPods: true
    enabled: true

bandwidthManager:
  enabled: true

cluster:
  name: "cluster2"
  id: 2

clustermesh:
  name: "cluster2"
  config:
    enable: true
  clusters: ["cluster1", "cluster2"]
  useAPIServer: true
  apiserver:
    tls:
      auto:
        method: "certmanager"

Cilium Version

1.12.4

Kernel Version

5.15.78

Kubernetes Version

1.25.4

Sysdump

No response

Relevant log output

helm template --values val.yaml ./.

ClusterMesh TLS certgen method=certmanager requires user specify .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef

Anything else?

According to the default values.yaml documentation string the user does not need to provide clustermesh.apiserver.tls.auto.certManagerIssuerRef in which case it will be generated.

cilium/install/kubernetes/cilium/values.yaml

Lines 929 to 936 in d8c7d93

	# [Example]
	# certManagerIssuerRef:
	# group: cert-manager.io
	# kind: ClusterIssuer
	# name: ca-issuer
	# -- certmanager issuer used when hubble.tls.auto.method=certmanager.
	# If not specified, a CA issuer will be created.
	certManagerIssuerRef: {}

Code of Conduct

• I agree to follow this project's Code of Conduct

[Shunpoco]

I caught the same issue, so I made a PR to fix this problem.
@wigust thank you for your issuing!