Skip to content

Rancher AWS: Resource module.rancher_common.helm_release.cert_manager runs into 5m timeout during destroy #244

@wombelix

Description

@wombelix

Issue:
Helm uninstall of cert-manager runs into 5m timeout during destroy.

Reason:
As long Rancher Quickstart uses an (outdated) cert-manager version below 1.15.0, the problem doesn't occur:

https://cert-manager.io/docs/installation/helm/#uninstalling-with-helm

cert-manager versions prior to v1.15.0 do not keep the CustomResourceDefinition on uninstall and will remove all Issuers,ClusterIssuers,Certificates,CertificateRequests,Orders and Challenges resources from the cluster. Make sure to back up your cert-manager resources before uninstalling cert-manager if you are using a version prior to v1.15.0. Or upgrade to v1.15.0 before uninstalling.

Running Helm manually without --wait, uninstall works but provides this additional output:

These resources were kept due to the resource policy:
[CustomResourceDefinition] certificaterequests.cert-manager.io
[CustomResourceDefinition] certificates.cert-manager.io
[CustomResourceDefinition] challenges.acme.cert-manager.io
[CustomResourceDefinition] clusterissuers.cert-manager.io
[CustomResourceDefinition] issuers.cert-manager.io
[CustomResourceDefinition] orders.acme.cert-manager.io

When using --wait / wait = true, Helm will wait for the CRDs to be gone, which will never happen.
Easiest fix is to use wait = false, Rancher depends on cert-manager but doesn't need all resources up and running during installation.

Fixing this Issue will unblock the cert-manager version bump in #240 too.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions