Question: Cert Manager Not Found

[ctriley]

I'm using Argo CD for installation and trying to mostly follow https://github.com/alexandrevilain/temporal-operator-demo-argocd with some tweaks. Namely, I'm using an app-of-apps structure and installing cert manager separately via a helm chart / argo app.

The error I'm getting is that my sync-result displays

The Kubernetes API could not find cert-manager.io/Issuer for requested resource temporal-system/temporal-operator-selfsigned-issuer. Make sure the "Issuer" CRD is installed on the destination cluster.

I installed cert manager with the helm chart:

apiVersion: v2
name: cert-manager
description: A Helm chart with cert-manager as subchart
type: application
version: 0.1.0
appVersion: "0.1.0"
dependencies:
  - name: cert-manager
    version: v1.15.0
    repository: https://charts.jetstack.io
    alias: cert-manager
    condition: cert-manager.enabled

And the argocd app:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cert-manager
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  destination:
    namespace: cert-manager
    server: 'https://kubernetes.default.svc'
  source:
    path: infra/k8s/apps/cert_manager
    repoURL: 'repo'
    targetRevision: HEAD
  project: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
    retry:
      limit: 2
      backoff:
        duration: 5s
        maxDuration: 3m0s
        factor: 2

My temporal operator is:

kustomize.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- https://github.com/alexandrevilain/temporal-operator/releases/download/v0.19.0/temporal-operator.crds.yaml
- https://github.com/alexandrevilain/temporal-operator/releases/download/v0.19.0/temporal-operator.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: temporal-operator
  namespace: argocd
spec:
  project: default
  source:
    repoURL: 'repo'
    targetRevision: HEAD
    path: infra/k8s/apps/temporal_operator
  destination:
    namespace: temporal-system
    server: https://kubernetes.default.svc
  syncPolicy:
    automated: {}
    syncOptions:
    - CreateNamespace=true
    - ServerSideApply=true

Any help or guidance would be appreciated

[alexandrevilain]

Hi @ctriley !

I converted this issue to a discussion, as it's not an issue on the operator side :)

I think that there is an issue with your cert-manager installation, the controller requires a cert-manager issuer to self-sign its webhook certificates.

If the cert-manager is part of the apps-of-apps pattern I think that you may look at Argocd's sync-waves, that will help you install the cert-manager app first then the temporal-operator :)

[ctriley]

This definitely pointed me in the correct direction. Turns out the fix was to add a values.yaml file in the same directory as the Chart.yaml above which set cert-manager to enable crds.

values.yaml

cert-manager:
  namespace: cert-manager
  crds:
    enabled: true