update cert-manager to 0.15.1, do not let Helm manage CRDs anymore (#…

…5552)

api/hack/ci/ci-setup-kubermatic-in-kind.sh

@@ -396,7 +396,7 @@ function check_all_deployments_ready() {
 # to have the CRDs installed so we can at least create a Certificate resource.
 TEST_NAME="Deploy cert-manager CRDs"
 echodate "Deploying cert-manager CRDs"
-retry 5 kubectl apply -f config/cert-manager/templates/crd.yaml
+retry 5 kubectl apply -f config/cert-manager/crd/
 
 if [[ "${KUBERMATIC_USE_OPERATOR}" = "false" ]]; then
   TEST_NAME="Deploy Kubermatic"

api/hack/deploy.sh

@@ -148,7 +148,7 @@ case "${DEPLOY_STACK}" in
   kubermatic)
     initTiller
 
-    echodate "Deploying the CRD's..."
+    echodate "Deploying the Kubermatic CRDs..."
     retry 5 kubectl apply -f ./config/kubermatic/crd/
 
     # PULL_BASE_REF is the name of the current branch in case of a post-submit
@@ -161,9 +161,13 @@ case "${DEPLOY_STACK}" in
     sed -i "s/__KUBERMATIC_TAG__/${GIT_HEAD_HASH}/g" ./config/nodeport-proxy/*.yaml
 
     if [[ "${1}" = "master" ]]; then
+      echodate "Deploying the cert-manager CRDs..."
+      retry 5 kubectl apply -f ./config/cert-manager/crd/
+
       deploy "nginx-ingress-controller" "nginx-ingress-controller" ./config/nginx-ingress-controller/
-      deploy "cert-manager" "cert-manager" ./config/cert-manager/
       deploy "oauth" "oauth" ./config/oauth/
+      deploy "cert-manager" "cert-manager" ./config/cert-manager/
+
       # We might have not configured IAP which results in nothing being deployed. This triggers https://github.com/helm/helm/issues/4295 and marks this as failed
       # We hack around this by grepping for a string that is mandatory in the values file of IAP
       # to determine if its configured, because am empty chart leads to Helm doing weird things

api/hack/update-cert-manager-crds.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 The Kubermatic Kubernetes Platform contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+cd $(dirname $0)/../..
+source api/hack/lib.sh
+
+cd config/cert-manager/
+
+version=$(yq r values.yaml certManager.controller.image.tag)
+source=https://github.com/jetstack/cert-manager/releases/download/$version/cert-manager-legacy.crds.yaml
+
+# do not use "crds/" or else Helm will try to install the
+# CRDs and then never ever touch them again
+file=crd/cert-manager.crds.yaml
+
+echo "# This file has been generated by api/hack/update-cert-manager-crds.sh, do not edit manually." > $file
+echo "" >> $file
+
+set -x
+curl -sLo - $source >> $file
+
+# remove misleading label
+yq delete -i -d'*' $file 'metadata.labels."helm.sh/chart"'

config/cert-manager/Chart.yaml

@@ -14,8 +14,8 @@
 
 apiVersion: v1
 name: cert-manager
-version: 1.1.9
-appVersion: v0.13.0
+version: 1.2.0
+appVersion: v0.15.1
 description: A Helm chart for cert-manager
 keywords:
 - kubermatic