mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 19:47:37 +09:00
myasnikovdaniil
aa8ea10392
## What this PR does HTTP-01 ACME issuance in Cozystack has been relying on deprecated cert-manager fields that happen to still work, but point at a non-existent ingress class on default installs. **The bug:** - `ClusterIssuer`s (`letsencrypt-prod`, `letsencrypt-stage`) hardcode `http01.ingress.class: nginx`, but Cozystack's nginx ingress classes are named after tenants (`tenant-root`, `tenant-*`) — there is no class called `nginx`. - Every ingress that needs a cert overrides this with the deprecated annotation `acme.cert-manager.io/http01-ingress-class: <class>`. cert-manager still honors it, which is why issuance works at all. - Mixing the modern `ingressClassName` field with the legacy `http01-ingress-class` annotation produces `fields ingressClassName and class cannot be set at the same time` (cert-manager#6651), so the migration has to be atomic. **The fix:** - Parameterize the `ClusterIssuer` HTTP-01 solver from `_cluster.expose-ingress` (default `tenant-root`) using the modern `ingressClassName` field. - Rename the override annotation on all ingresses to the modern `acme.cert-manager.io/http01-ingress-ingressclassname`. - No new features, no behavior change for operators who already set `_cluster.expose-ingress` correctly — just removes the dependency on the deprecated API and stops pointing at a phantom class. Touched ingresses (9 templates): keycloak, dashboard, linstor-gui, bucket, grafana, alerta, bootbox/matchbox, seaweedfs, harbor. Plus `seaweedfs` values.yaml default annotation and the `cert-manager-issuers` ClusterIssuer template. Verified renders for `http01` + `tenant-root`, `http01` + custom class, and `dns01` (correctly omits the http01 branch). ### Release note ```release-note fix(platform): ACME HTTP-01 challenges now use the modern `ingressClassName` API and target the tenant ingress class from `_cluster.expose-ingress` (default `tenant-root`) instead of a hardcoded `nginx` class that did not exist on most installs. Ingress templates switched from the deprecated `acme.cert-manager.io/http01-ingress-class` annotation to `acme.cert-manager.io/http01-ingress-ingressclassname`. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Chores** * Updated cert-manager ACME HTTP-01 solver annotations across ingress configurations to use the newer `ingressclassname` format for improved compatibility with current cert-manager versions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->