mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Myasnikov Daniil
b6badeeb96
cert-manager v1.20.0 introduced the
acme.cert-manager.io/http01-ingress-ingressclassname Ingress annotation
(cert-manager#8244). Cozystack templates already emit it (since
2b6e20cc) but v1.19.x silently ignored it, so cert-manager fell back
to the ClusterIssuer's solver class. HTTP-01 solver Ingresses for
non-publishing tenants ended up on the wrong IngressClass, breaking
Let's Encrypt issuance for any tenant ingress not on tenant-root.
Targeting v1.20.2 picks up cert-manager#8655 (clusterissuers/issuers
finalizer RBAC restored after v1.20.0 dropped it) and #8665 (webhook
helm-template fix).
Verified live on dev10:
- v1.19.3: Challenge solver class = "tenant-root" (BUG)
- v1.20.2: Challenge solver class = "<tenant>" (FIXED)
Notable upgrade considerations:
- Container UID/GID change 1000/0 -> 65532/65532
- New per-component NetworkPolicy templates (gated, default off)
- Image template signature refactored (cozystack values.yaml empty,
renders identically)
- CRDs gain selectableFields (k8s >=1.30) and Azure DNS01 zoneType
- RBAC adds clusterissuers/issuers finalizers + listenersets
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>