Installing the chart creates cert-manager CRDs

[cwrau]

What steps did you take and what happened:
helm install --repo https://kubernetes-sigs.github.io/cluster-api-operator capi-operator cluster-api-operator -n capi-system --create-namespace

What did you expect to happen:
That the operator would get installed, nothing more.

Anything else you would like to add:
I understand that the operator might depend on cert-manager, but then it should just depend on it (which is currently not possible because of cert-manager/cert-manager#6179 (comment)) and otherwise just shouldn't do anything with the cert-manager deployment and just require the user to install it manually. Because now I can't install cert-manager my way, as the CRDs already exist 😅, I'd have to skipCRDs in my gitops system.

I guess this isn't immediately fixable, but then this issue is just to track the problem 😁

Environment:

• Cluster-api-operator version: N/A
• Cluster-api version: N/A
• Minikube/KIND version: N/A
• Kubernetes version: (use kubectl version): N/A
• OS (e.g. from /etc/os-release): N/A
• Helm Chart version: 0.6.0 <- missing from the template

/kind bug
/area helm-chart <- I couldn't find any fitting area

[k8s-ci-robot]

@cwrau: The label(s) area/helm-chart, area/<-, area/i, area/couldn't, area/find, area/any, area/fitting, area/area cannot be applied, because the repository doesn't have them.

In response to this:

What steps did you take and what happened:
helm install --repo https://kubernetes-sigs.github.io/cluster-api-operator capi-operator cluster-api-operator -n capi-system --create-namespace

What did you expect to happen:
That the operator would get installed, nothing more.

Anything else you would like to add:
I understand that the operator might depend on cert-manager, but then it should just depend on it (which is currently not possible because of cert-manager/cert-manager#6179) and otherwise just shouldn't do anything with the cert-manager deployment and just require the user to install it manually. Because now I can't install cert-manager my way, as the CRDs already exist 😅, I'd have to skipCRDs in my gitops system.

Environment:

• Cluster-api-operator version: N/A
• Cluster-api version: N/A
• Minikube/KIND version: N/A
• Kubernetes version: (use kubectl version): N/A
• OS (e.g. from /etc/os-release): N/A
• Helm Chart version: 0.6.0 <- missing from the template

/kind bug
/area helm-chart <- I couldn't find any fitting area

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPI Operator contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[cwrau]

This is still a problem

[jackfrancis]

@cwrau I don't quite understand the problem. Is it that you can't install the official cluster-api-operator helm chart when cert-manager is already installed? Is this the problem?

https://github.com/kubernetes-sigs/cluster-api-operator/blob/main/hack/charts/cluster-api-operator/templates/cert-manager.namespace.yaml

[zioproto]

@jackfrancis the problem for me is that if I install cert-manager with his own chart at version v1.14.2, when I later install the cluster-api-operator chart this one will ovewrite the cert-manager CRDs with the old v1.13.2 version

[jackfrancis]

Can we solve this by ensuring that we are following these best practices?

https://helm.sh/docs/chart_best_practices/dependencies/

[zioproto]

The problem is that the CRDs are forced into the cluster-api-operator helm chart with this script:
https://github.com/kubernetes-sigs/cluster-api-operator/blob/main/hack/inject-cert-manager-helm.sh

What you see in the git repo is not what you get in the tgz file downloaded from the helm repo

[jackfrancis]

If we just skipped the CRDs that are injected by the helm chart scripts, would that solve for this problem? If so, we could wrap the entire crds/cert-manager.crds.yaml file in something like:

{{- if .Values.installCertManagerCRDs -}}
...
{{- end -}}

And then add a installCertManagerCRDs bool to the values.yaml file in hack/charts/cluster-api-operator/values.yaml.

[jackfrancis]

After looking into this for a bit w/ help from @nojnhuh I think this PR delivers a better helm chart dependency solution:

• don’t deliver cert-manager CRDs with cluster-api-operator chart #453

(It will be up to project maintainers to decide whether or not this is a good idea.)

In the meantime you should be able to simply append --skip-crds when you install the existing cluster-api-operator chart to bypass delivery of the v1.13 cert-manager CRDs.

[cwrau]

@cwrau I don't quite understand the problem. Is it that you can't install the official cluster-api-operator helm chart when cert-manager is already installed? Is this the problem?

main/hack/charts/cluster-api-operator/templates/cert-manager.namespace.yaml

---

@jackfrancis the problem for me is that if I install cert-manager with his own chart at version v1.14.2, when I later install the cluster-api-operator chart this one will ovewrite the cert-manager CRDs with the old v1.13.2 version

Yes, that's also my problem 👌

---

After looking into this for a bit w/ help from @nojnhuh I think this PR delivers a better helm chart dependency solution:

• don’t deliver cert-manager CRDs with cluster-api-operator chart #453

That does look good to me 👍

[jackfrancis]

@cwrau @zioproto using --skip-crds during helm install should be a solution for you right now