Skip to content

Commit

Permalink
docs: Fix version string to use lowercase 'x'
Browse files Browse the repository at this point in the history
Signed-off-by: Peter Fiddes <[email protected]>
  • Loading branch information
hawksight committed Jan 10, 2024
1 parent 72f3d9b commit 2800e9a
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions content/docs/tutorials/certificate-defaults/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ These rules will:
## 2 - Defaulting required fields
> ⚠️ This section requires cert-manager v1.14.X or newer to work properly out of the box.
> ⚠️ This section requires cert-manager v1.14.x or newer to work properly out of the box.
> If using an older version of cert-manager, see the [Appendix](#cert-manager-version-requirement) section for a full explanation.
Now we can set a Kyverno `ClusterPolicy` to apply default values to any of the `Certificate` fields.
Expand Down Expand Up @@ -544,17 +544,17 @@ helm uninstall ingress-nginx -n ingress-nginx

## cert-manager version requirement

Prior to cert-manager version v1.14.X, cert-manager's `MutatingWebhookConfiguration` was triggered by all cert-manager.io resources including `Certificates`.
Prior to cert-manager version v1.14.x, cert-manager's `MutatingWebhookConfiguration` was triggered by all cert-manager.io resources including `Certificates`.
In reality this webhook is only in place to affect `CertificateRequest` resources, but had an unintended consequence that meant Kyverno policies as we had written would not operate as intended.
When a `Certificate` resource is applied to a Kubernetes cluster, mutating webhooks are applied before validating webhooks.
When the existing cert-manager `MutatingWebhookConfiguration` runs it will add the required field with an empty value, such as: `secretName: ""`, if there is no value in a required field.
The consequence of this action is that our Kyverno policies will not apply as an empty value is already present.
Starting with v1.14.X the cert-manager-webhook `MutatingWebhookConfiguration` resource has been scoped to only affect `CertificateRequest` resources.
Starting with v1.14.x the cert-manager-webhook `MutatingWebhookConfiguration` resource has been scoped to only affect `CertificateRequest` resources.
It no longer triggers for `Certificate` resources, which our policies in this tutorial are acting on.
If you are running a cert-manager installation prior to v1.14.X you should first consider upgrading.
If you are running a cert-manager installation prior to v1.14.x you should first consider upgrading.
If upgrading is not feasible right now then you will need to consider one of the following potential fixes for this issue:
1. Rename the 'cert-manager-webhook' mutating and validating webhooks with `z-<existing name>` so that they execute last, after the Kyverno webhooks.
Expand Down

0 comments on commit 2800e9a

Please sign in to comment.