Upgrade Cert-Manager

The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running kubectl get pods --all-namespaces and checking which namespace the cert-manager-* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.

These instructions have been updated for Helm 3. If you are still using Helm 2, refer to these instructions.

In order to upgrade cert-manager, follow these instructions:

Click to expand

as a precaution

Uninstall existing deployment

helm uninstall cert-manager

Delete the CustomResourceDefinition using the link to the version vX.Y.Z you installed

kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/vX.Y.Z/cert-manager.crds.yaml

Install the CustomResourceDefinition resources separately
```
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/vX.Y.Z/cert-manager.crds.yaml
```
Note: If you are running Kubernetes v1.15 or below, you will need to add the --validate=false flag to your kubectl apply command above. Otherwise, you will receive a validation error relating to the x-kubernetes-preserve-unknown-fields field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.

Add the Jetstack Helm repository

helm repo add jetstack https://charts.jetstack.io

Update your local Helm chart repository cache
```
helm repo update
```
Install the new version of cert-manager

kubectl apply -f cert-manager-backup.yaml

Click to expand

Before you can perform the upgrade, you must prepare your air gapped environment by adding the necessary container images to your private registry and downloading or rendering the required Kubernetes manifest files.

Follow the guide to Prepare your Private Registry with the images needed for the upgrade.
From a system connected to the internet, add the cert-manager repo to Helm
```
helm repo add jetstack https://charts.jetstack.io
```
Fetch the latest cert-manager chart available from the .
```
helm fetch jetstack/cert-manager --version v0.12.0
```

Render the cert manager template with the options you would like to use to install the chart. Remember to set the image.repository option to pull the image from your private registry. This will create a cert-manager directory with the Kubernetes manifest files.

The Helm 3 command is as follows:

helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
--namespace cert-manager \
--set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
--set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
--set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector

The Helm 2 command is as follows:

--name cert-manager --namespace cert-manager \
--set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
--set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
--set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector

Download the required CRD file for cert-manager (old and new)

curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml

Back up existing resources as a precaution

Delete the existing cert-manager installation

kubectl -n cert-manager \
delete deployment,sa,clusterrole,clusterrolebinding \
-l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2'

Delete the CustomResourceDefinition using the link to the version vX.Y you installed

kubectl delete -f cert-manager/cert-manager-crd-old.yaml

Install the CustomResourceDefinition resources separately
```
kubectl apply -f cert-manager/cert-manager-crd.yaml
```
Note: If you are running Kubernetes v1.15 or below, you will need to add the --validate=false flag to your kubectl apply command above. Otherwise, you will receive a validation error relating to the x-kubernetes-preserve-unknown-fields field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
Create the namespace for cert-manager
```
kubectl create namespace cert-manager
```

Install cert-manager

kubectl -n cert-manager apply -R -f ./cert-manager

Restore back up resources

Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods:

Cert-manager has deprecated the use of the certificate.spec.acme.solvers field and will drop support for it completely in an upcoming release.

Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format.

Details about the change and migration instructions can be found in the .

The v0.11 release marks the removal of the v1alpha1 API that was used in previous versions of cert-manager, as well as our API group changing to be cert-manager.io instead of certmanager.k8s.io.

We have also removed support for the old configuration format that was deprecated in the v0.8 release. This means you must transition to using the new solvers style configuration format for your ACME issuers before upgrading to v0.11. For more information, see the upgrading to v0.8 guide.

Details about the change and migration instructions can be found in the .

Upgrading Cert-Manager

Upgrade Cert-Manager