diff --git a/pkg/util/cmapichecker/BUILD.bazel b/pkg/util/cmapichecker/BUILD.bazel index 0b4ce65d6..34405fa15 100644 --- a/pkg/util/cmapichecker/BUILD.bazel +++ b/pkg/util/cmapichecker/BUILD.bazel @@ -6,7 +6,7 @@ go_library( importpath = "github.com/jetstack/cert-manager/pkg/util/cmapichecker", visibility = ["//visibility:public"], deps = [ - "//pkg/apis/certmanager/v1alpha2:go_default_library", + "//pkg/apis/certmanager/v1:go_default_library", "//pkg/apis/meta/v1:go_default_library", "@com_github_pkg_errors//:go_default_library", "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", @@ -35,7 +35,7 @@ go_test( srcs = ["cmapichecker_test.go"], embed = [":go_default_library"], deps = [ - "//pkg/apis/certmanager/v1alpha2:go_default_library", + "//pkg/apis/certmanager/v1:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_sigs_controller_runtime//pkg/client:go_default_library", "@io_k8s_sigs_controller_runtime//pkg/client/fake:go_default_library", diff --git a/pkg/util/cmapichecker/cmapichecker.go b/pkg/util/cmapichecker/cmapichecker.go index e9dbd6477..dbb396421 100644 --- a/pkg/util/cmapichecker/cmapichecker.go +++ b/pkg/util/cmapichecker/cmapichecker.go @@ -27,11 +27,7 @@ import ( "k8s.io/client-go/rest" "sigs.k8s.io/controller-runtime/pkg/client" - // Use v1alpha2 API to ensure that the API server has also connected to the - // cert-manager conversion webhook. - // TODO(wallrj): Only change this when the old deprecated APIs are removed, - // at which point the conversion webhook may be removed anyway. - cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1" ) @@ -81,11 +77,13 @@ func New(restcfg *rest.Config, scheme *runtime.Scheme, namespace string) (Interf }, nil } -// Check attempts to perform a dry-run create of a cert-manager *v1alpha2* +// Check attempts to perform a dry-run create of a cert-manager // Certificate resource in order to verify that CRDs are installed and all the // required webhooks are reachable by the K8S API server. -// We use v1alpha2 API to ensure that the API server has also connected to the -// cert-manager conversion webhook. +// Originally we used the v1alpha2 API to ensure that the API server has also +// connected to the cert-manager conversion webhook, but since cert-manager 1.6 +// we have disabled the serving of non-v1 CRD versions, so it is no longer +// possible to test the reachability of the conversion webhook. func (o *cmapiChecker) Check(ctx context.Context) error { cert := &cmapi.Certificate{ ObjectMeta: metav1.ObjectMeta{ @@ -135,13 +133,10 @@ func (e *ApiCheckError) Unwrap() error { // - error finding the scope of the object: failed to get restmapping: no matches for kind "Certificate" in group "cert-manager.io" // ErrWebhookServiceFailure: // - Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": service "cert-manager-webhook" not found -// - conversion webhook for cert-manager.io/v1alpha2, Kind=Certificate failed: Post "https://cert-manager-webhook.cert-manager.svc:443/convert?timeout=30s": service "cert-manager-webhook" not found // ErrWebhookDeploymentFailure: // - Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": dial tcp 10.96.38.90:443: connect: connection refused -// - conversion webhook for cert-manager.io/v1alpha2, Kind=Certificate failed: Post "https://cert-manager-webhook.cert-manager.svc:443/convert?timeout=30s": dial tcp 10.96.38.90:443: connect: connection refused // ErrWebhookCertificateFailure: // - Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": x509: certificate signed by unknown authority (possibly because of "x509: ECDSA verification failure" while trying to verify candidate authority certificate "cert-manager-webhook-ca") -// - conversion webhook for cert-manager.io/v1alpha2, Kind=Certificate failed: Post "https://cert-manager-webhook.cert-manager.svc:443/convert?timeout=30s": x509: certificate signed by unknown authority func translateToSimpleError(err error) error { s := err.Error() diff --git a/pkg/util/cmapichecker/cmapichecker_test.go b/pkg/util/cmapichecker/cmapichecker_test.go index cd8f5638e..0cc3c0d4b 100644 --- a/pkg/util/cmapichecker/cmapichecker_test.go +++ b/pkg/util/cmapichecker/cmapichecker_test.go @@ -26,7 +26,7 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/fake" - cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" ) type fakeErrorClient struct {