apisix-ingress-controller: webhook configuration supports no annotations, blocking cert-manager cainjector
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure
Research direction
Start by locating the apisix-ingress-controller chart template that renders the ValidatingWebhookConfiguration and the values for webhook.certificate. Render the chart with webhook.annotations unset and with cert-manager.io/inject-ca-from configured; done means the default output remains byte-identical and configured annotations appear on the webhook.
Written by the indexing model from the issue text.
Description
The ValidatingWebhookConfiguration in the apisix-ingress-controller chart renders with no annotations and no way to add any. With webhook.certificate.provided=true, operators supplying the serving certificate from a cert-manager Certificate must hand-copy the CA into webhook.certificate.caBundle — and re-copy it whenever the CA rotates, or the API server silently stops trusting the webhook (with the default failurePolicy: Ignore, admission validation is skipped without any visible failure).
The ecosystem-standard fix is cert-manager's cainjector: annotate the webhook configuration with cert-manager.io/inject-ca-from: <namespace>/<certificate> and the caBundle is maintained automatically, rotation included. That needs only an annotations knob on the webhook template.
Proposed fix in #1004 — adds webhook.annotations (default {}); unset output is byte-identical to today.
- Dominant language
- Go Template
- Stars
- 289
- Forks
- 284
- Avg merge
- 4d 22h
- Merged PRs (30d)
- 2
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/apisix-helm-chart
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
apache/apisix-helm-chart#1005 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
apache/apisix-helm-chart#995 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
apache/apisix-helm-chart#988 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
apache/apisix-helm-chart#986 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
apache/apisix-helm-chart#985 ·
All issues in apache/apisix-helm-chart
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
repo:raw-data
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
hotosm/raw-data-api#316 · 1 comment ·
-
agentic-workflows cascade-suspected
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
willow
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
openedx/openedx-authz#460 ·