vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(platform): migrate ACME HTTP-01 to ingressClassName API

Browse source 
ClusterIssuer solver referenced IngressClass "nginx" which does not
exist on cozystack clusters — real classes are named after tenant
namespaces (e.g. tenant-root). Cert issuance only worked because every
requesting Ingress overrode the ClusterIssuer via the legacy
acme.cert-manager.io/http01-ingress-class annotation.

Switch both sides to the modern cert-manager API (available since
cert-manager 1.12; cozystack ships 1.19.3):

- ClusterIssuer: http01.ingress.ingressClassName, value parameterized
  from _cluster.expose-ingress (default "tenant-root")
- Ingress annotation: http01-ingress-ingressclassname

These must migrate together — mixing ingressClassName (ClusterIssuer)
with the old http01-ingress-class annotation triggers cert-manager's
"fields ingressClassName and class cannot be set at the same time"
validation and breaks issuance.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
(cherry picked from commit 2b6e20cc3f)
This commit is contained in:
Myasnikov Daniil 2026-04-21 17:00:31 +05:00
parent d59a691eb7
commit f7ca9880a4
No known key found for this signature in database
GPG key ID: FA953A439C637F04
10 changed files with 17 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/apps/harbor/templates/ingress.yaml
View file

@ -15,7 +15,7 @@ metadata:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
spec:

2
packages/extra/bootbox/templates/matchbox/ingress.yaml
View file

@ -10,7 +10,7 @@ metadata:
app: bootbox
annotations:
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
{{- if .Values.whitelistHTTP }}

2
packages/extra/seaweedfs/templates/seaweedfs.yaml
View file

@ -243,7 +243,7 @@ spec:
nginx.ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
tls:

2
packages/system/bucket/templates/ingress.yaml
View file

@ -12,7 +12,7 @@ metadata:
nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
spec:

15
packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
View file

@ -1,6 +1,7 @@
{{- $solver := (index .Values._cluster "solver") | default "http01" }}
{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
apiVersion: cert-manager.io/v1
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
@ -17,9 +18,9 @@ spec:
name: cloudflare-api-token-secret
key: api-token
{{- else }}
http01:
ingress:
class: nginx
http01:
ingress:
ingressClassName: {{ $exposeIngress }}
{{- end }}
---
@ -41,9 +42,9 @@ spec:
name: cloudflare-api-token-secret
key: api-token
{{- else }}
http01:
ingress:
class: nginx
http01:
ingress:
ingressClassName: {{ $exposeIngress }}
{{- end }}
---

2
packages/system/dashboard/templates/ingress.yaml
View file

@ -11,7 +11,7 @@ metadata:
annotations:
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
{{- end }}
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/client-max-body-size: 100m

2
packages/system/keycloak/templates/ingress.yaml
View file

@ -11,7 +11,7 @@ metadata:
{{- with .Values.ingress.annotations }}
annotations:
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $exposeIngress }}
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
{{- toYaml . | nindent 4 }}

2
packages/system/monitoring/templates/alerta/alerta.yaml
View file

@ -181,7 +181,7 @@ metadata:
app: alerta
annotations:
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
acme.cert-manager.io/http01-ingress-ingressclassname: {{ $ingress }}
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
spec:

2
packages/system/monitoring/templates/grafana/grafana.yaml
View file

@ -74,7 +74,7 @@ spec:
metadata:
annotations:
{{- if eq $solver "http01" }}
acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
acme.cert-manager.io/http01-ingress-ingressclassname: "{{ $ingress }}"
{{- end }}
cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
spec:

2
packages/system/seaweedfs/values.yaml
View file

@ -111,7 +111,7 @@ seaweedfs:
nginx.ingress.kubernetes.io/client-body-timeout: "3600"
nginx.ingress.kubernetes.io/client-header-timeout: "120"
nginx.ingress.kubernetes.io/service-upstream: "true"
acme.cert-manager.io/http01-ingress-class: tenant-root
acme.cert-manager.io/http01-ingress-ingressclassname: tenant-root
cert-manager.io/cluster-issuer: letsencrypt-prod
tls:
- hosts: