From ad442ebbfe7a1e63a2e53c1d64dc7cfa76768cde Mon Sep 17 00:00:00 2001 From: Kirill Ilin Date: Thu, 26 Mar 2026 09:38:40 +0500 Subject: [PATCH] fix(gateway-api): fix cert-manager-issuers after rebase and document child tenant limitation The rebase on main reverted cert-manager-issuers to the old inline format. Restore the helper-based template with gateway solver support. Add comment documenting that Gateway API ACME HTTP-01 only works for the root tenant and system services. Child tenants with gateway: true should use dns01 solver or namespace-scoped Issuers. Assisted-By: Claude AI Signed-off-by: Kirill Ilin --- .../templates/cluster-issuers.yaml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml index e35f73e8..9209662a 100644 --- a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml +++ b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml @@ -24,7 +24,14 @@ solvers: {{/* Dual parentRef: acme-challenge accepts system namespaces (Selector), http-redirect accepts the gateway's own namespace (Same). Each challenge HTTPRoute will have one accepted and one rejected parent — this is - expected, cert-manager handles partial acceptance correctly. */}} + expected, cert-manager handles partial acceptance correctly. + + Limitation: Gateway API ACME HTTP-01 only works for the root tenant + and system services. Child tenants with gateway: true have their own + Gateways but the ClusterIssuer always references the root tenant's + Gateways. Child tenant challenges will be rejected by both (no system + label, different namespace). Child tenants should use dns01 solver or + namespace-scoped Issuers. */}} {{- if and (eq $gatewayAPI "true") (ne $gateway "") }} - http01: gatewayHTTPRoute: @@ -64,13 +71,13 @@ spec: privateKeySecretRef: name: letsencrypt-stage server: https://acme-staging-v02.api.letsencrypt.org/directory -{{ include "cert-manager-issuers.solvers" (list $solver $ingressEnabled $gatewayAPI $gateway) | indent 4 }} +{{ include "cert-manager-issuers.solvers" (list $solver $ingressEnabled $gatewayAPI $gateway) | indent 4 }} ---- +--- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: selfsigned-cluster-issuer -spec: +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-cluster-issuer +spec: selfSigned: {}