Helm upgrade failed: cannot patch "certificates.cert-manager.io" with kind CustomResourceDefinition: "" is invalid: patch: ...

[wallrj]

@JoshVanL reported a failure in Helm upgrade from 1.1.0 to 1.2.0-alpha.2 fails with the following error:

helm upgrade   cert-manager jetstack/cert-manager   --namespace cert-manager   --version v1.2.0-alpha.2 --set installCRDs=true                                   Error: UPGRADE FAILED: cannot patch "certificates.cert-manager.io" with kind CustomResourceDefinition:  "" is invalid: patch: Invalid value:
...
cannot convert int64 to float64

@wallrj reproduced the error with Helm version 3.5.1 and 3.5.2

helm install   cert-manager jetstack/cert-manager   --namespace cert-manager   --version v1.1.0 --set installCRDs=true --create-namespace

helm upgrade   cert-manager jetstack/cert-manager   --namespace cert-manager   --version v1.2.0-alpha.0 --set installCRDs=true

/milestone v1.2
/kind bug

[jetstack-bot]

@wallrj: The provided milestone is not valid for this repository. Milestones in this repository: [Next, v1.2]

Use /milestone clear to clear the milestone.

In response to this:

@JoshVanL reported a failure in Helm upgrade from 1.1.0 to 1.2.0-alpha.2 fails with the following error:

helm upgrade   cert-manager jetstack/cert-manager   --namespace cert-manager   --version v1.2.0-alpha.2 --set installCRDs=true                                   Error: UPGRADE FAILED: cannot patch "certificates.cert-manager.io" with kind CustomResourceDefinition:  "" is invalid: patch: Invalid value:
...
cannot convert int64 to float64

@wallrj reproduced the error with Helm version 3.5.1 and 3.5.2

helm install   cert-manager jetstack/cert-manager   --namespace cert-manager   --version v1.1.0 --set installCRDs=true --create-namespace

helm upgrade   cert-manager jetstack/cert-manager   --namespace cert-manager   --version v1.2.0-alpha.0 --set installCRDs=true

/milestone 1.2
/kind bug

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[wallrj]

/milestone v1.2

[irbekrm]

/assign

[irbekrm]

Some related chat on Slack here

I observed the same issue when upgrading v1.0.4 -> v1.1.0 so perhaps this issue is not related to v1.2.0.alpha at all?

With Helm v3.5.2 and Kubernetes 1.19:

Running helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.0.4 --create-namespace --set installCRDs=true
then helm upgrade cert-manager jetstack/cert-manager --namespace cert-manager --version v1.1.0 --set installCRDs=true
results in

Error: UPGRADE FAILED: cannot patch "certificates.cert-manager.io" with kind CustomResourceDefinition:  "" 
...
ap[acceptedNames:map[kind: plural:] conditions:[] storedVersions:[]]]": cannot convert int64 to float64

Similar issues:

• Helm - CRD error: cannot convert int64 to float64 zalando/postgres-operator#760
• Installing a CRD with Validation containing maximum, minimum and/or multipleOf fails with Helm v2.14.0 helm/helm#5806

[irbekrm]

It looks like the issue is conversion of minimum and maximum field values (here, here, here and here) in the Certificate CRD as described in this helm issue. I don't fully understand yet why this issue appears only when we run helm upgrade and not helm install.
I have manually tested that when I have a cert-manager v1.1.0 installed with helm and a local cert-manager helm chart built from v1.2.0alpha that I try to upgrade to:

• If I remove the minimum, maximum fields, `upgrade succeeds
• If I set the minimum, maximum field values to something like 0.0, 8192.0 upgrade still fails with the same error
• If I set it the values to something like 0.5, 8192.5 upgrade succeeds
• Changing field type integer -> number has no effect (fails)

I think that perhaps we could remove the minimum and maximum fields from the Helm chart. They seem to suggest that allowed values for private key size are in range (0, 8192) which is incorrect and we have admission webhook that performs cert.spec.privateKey.size field validation.

[wallrj]

According to @derekbit in longhorn/longhorn#3631 (comment) the root cause of this problem may have been solved in kubernetes/kubernetes#93250 :

• 'cannot convert int64 to float64' with runtime.DefaultUnstructuredConverter.FromUnstructured on CustomResourceDefinitions with integer minimum, maximum, and/or multipleOf values kubernetes/kubernetes#87675
• Handle int -> float conversion in FromUnstructured kubernetes/kubernetes#93250

Therefore this warning comment in cert-manager can probably be removed:

cert-manager/pkg/apis/certmanager/v1/types_certificate.go

Lines 25 to 35 in b01a834

	// NOTE: Be mindful of adding OpenAPI validation- see https://github.com/cert-manager/cert-manager/issues/3644
	// +genclient
	// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
	// +kubebuilder:storageversion
	// A Certificate resource should be created to ensure an up to date and signed
	// X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
	//
	// The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
	type Certificate struct {