Attention Iron Bank Customers: On March 27, 2025, we are moving SBOM artifacts from the Anchore Scan job to the Build job to streamline the container hardening pipeline. If you currently download SBOMs from the Anchore Scan job, you can still get them from the Build job and from other sources, including IBFE and image attestations.
#37 : Disable the validating webhook and certificate controller
This MR disables the cert-controller and validating webhook in the default external-secrets operator deployment. This resolves the issue we've seen where the deployment will come up in apparently healthy state but where resources cannot be created.
Unfortunately we haven't been able to (yet) reliably determine why this is occurring. What we can say for sure is that the issue is within the way that the cert-controller is behaving related to the validating webhook, and the certificates deployed to them. The only way we have found to reliably prevent this issue from occurring is to simply disable the cert-controller and the validating webhook.
Relevant logs/screenshots
Here is the result of this patch. Before this patch is applied, the wait job will reliably fail, which fails the release:
$ kubectl logs -n external-secrets external-secrets-wait-job-2h66j---Running wait.sh...---+ cat+ kubectl apply -f clustersecretstore.yamlError from server (InternalError): error when creating "clustersecretstore.yaml": Internal error occurred: failed calling webhook "validate.secretstore.external-secrets.io": failed to call webhook: Post "https://external-secrets-webhook.external-secrets.svc:443/validate-external-secrets-io-v1beta1-secretstore?timeout=5s": proxy error from 127.0.0.1:6443 while dialing 10.42.0.5:10250, code 502: 502 Bad Gateway+ [[ 1 -eq 0 ]]+ exit 1
... And here is the result of running that same wait script with this patch (--set webhook.create=false --set certController.create=false):
Release "external-secrets" does not exist. Installing it now.NAME: external-secretsLAST DEPLOYED: Mon Nov 11 11:42:30 2024NAMESPACE: external-secretsSTATUS: deployedREVISION: 1NOTES:external-secrets has been deployed successfully in namespace external-secrets!
If you are deploying any deprecated v1alpha1 custom resources, your deployment may break with this patch. Please upgrade resources to non-deprecated versions.
#37: Disable the validating webhook and certificate controller by defaultAndrew Kesterson authored