webhook controller has a lot of messages error messages about missing cacert pem key

[sarathkumarpgm]

Hi i'm getting the cert missing issue in while installing sigstore/policy-controller, pods are not getting up due to this ca-cert.pem key missing issue.

installation command(disabled tuf to ignore tuf related issues).:
helm install policy-controller -n cosign-system sigstore/policy-controller --set webhook.extraArgs.disable-tuf=true

Error:

{
    "level": "error",
    "ts": "2025-03-17T10:24:43.777+0530",
    "logger": "policy-controller.policy.sigstore.dev",
    "caller": "controller/controller.go:566",
    "msg": "Reconcile error",
    "commit": "4a12093-dirty",
    "knative.dev/traceid": "6f1047a2-7636-4593-afba-34ee7774a663",
    "knative.dev/key": "policy.sigstore.dev",
    "duration": 0.000008288,
    "error": "secret \"webhook-certs\" is missing \"ca-cert.pem\" key",
    "stacktrace": "knative.dev/pkg/controller.(*Impl).handleErr\n\tknative.dev/pkg@v0.0.0-20230612155445-74c4be5e935e/controller/controller.go:566\nknative.dev/pkg/controller.(*Impl).processNextWorkItem\n\tknative.dev/pkg@v0.0.0-20230612155445-74c4be5e935e/controller/controller.go:543\nknative.dev/pkg/controller.(*Impl).RunContext.func3\n\tknative.dev/pkg@v0.0.0-20230612155445-74c4be5e935e/controller/controller.go:491"
}

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[dprotaso]

Please reach out to the sigstore folks first - it seems like they're misconfiguring something or the secret is being deleted - if they deemed this a Knative issue then we'll investigate.

For now in our Knative controllers we don't have this issue.