Upgrading Cert-Manager

Rancher is compatible with the API version cert-manager.io/v1 and was last tested with cert-manager version v1.13.1.

Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:

  1. Let’s Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.

  2. Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field. This change has no exact deadline.

  3. Cert-manager is deprecating v1alpha1 API and replacing its API group

To address these changes, this guide will do two things:

  1. Document the procedure for upgrading cert-manager

  2. Explain the cert-manager API changes and link to cert-manager’s official documentation for migrating your data

If you are upgrading cert-manager to the latest version from a version older than 1.5, follow the steps via the method Upgrade cert-manager from Versions 1.5 and Below. Note that you do not need to reinstall Rancher to perform this upgrade.

cert-manager Upgrade Methods

The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running kubectl get pods --all-namespaces and checking which namespace the cert-manager-* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.

In order to upgrade cert-manager, follow these instructions:

Upgrade cert-manager Using SUSE Application Collection

Click to expand

The cert-manager chart can be upgraded in-place using the Helm upgrade workflow to a specific version listed in the SUSE Application Collection, below is an example command:

helm upgrade <cert-manager-release-version> oci://dp.apps.rancher.io/charts/cert-manager \
  --set global.imagePullSecrets={application-collection}

To reuse the existing values and only upgrade the chart version:

helm upgrade <cert-manager-release-version> oci://dp.apps.rancher.io/charts/cert-manager \
  --reuse-values

Upgrade cert-manager from Versions 1.5 and Below

Click to expand

Previously, in order to upgrade cert-manager from an older version, an uninstall and reinstall of Rancher was recommended. Using the method below, you may upgrade cert-manager without those additional steps in order to better preserve your production environment:

  1. Install cmctl, the cert-manager CLI tool, using the installation guide.

  2. Ensure that any cert-manager custom resources that may have been stored in etcd at a deprecated API version get migrated to v1:

     cmctl upgrade migrate-api-version

    Refer to the API version migration docs for more information. Please also see the docs to upgrade from 1.5 to 1.6 and the docs to upgrade from 1.6. to 1.7 if needed.

  3. Upgrade cert-manager to v1.7.1 with a normal helm upgrade. You may go directly from version 1.5 to 1.7 if desired.

  4. Follow the Helm tutorial to update the API version of a release manifest. The chart release name is release_name=rancher and the release namespace is release_namespace=cattle-system.

  5. In the decoded file, search for cert-manager.io/v1beta1 and replace it with cert-manager.io/v1.

  6. Upgrade Rancher normally with helm upgrade.

Verify the Deployment

Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods:

kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m

Cert-Manager API change and data migration

Rancher now supports cert-manager versions 1.6.2 and 1.7.1. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. To read more, see the cert-manager docs. For instructions on upgrading cert-manager from version 1.5 to 1.6, see the upstream cert-manager documentation here. For instructions on upgrading cert-manager from version 1.6 to 1.7, see the upstream cert-manager documentation here.

Cert-manager has deprecated the use of the certificate.spec.acme.solvers field and will drop support for it completely in an upcoming release.

Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format.

Details about the change and migration instructions can be found in the cert-manager v0.7 to v0.8 upgrade instructions.

The v0.11 release marks the removal of the v1alpha1 API that was used in previous versions of cert-manager, as well as our API group changing to be cert-manager.io instead of certmanager.k8s.io.

We have also removed support for the old configuration format that was deprecated in the v0.8 release. This means you must transition to using the new solvers style configuration format for your ACME issuers before upgrading to v0.11. For more information, see the upgrading to v0.8 guide.

Details about the change and migration instructions can be found in the cert-manager v0.10 to v0.11 upgrade instructions.

More info about cert-manager upgrade information.