[VC-52277] Add cert-manager gatherers to discovery-agent#799
Closed
George-Yanev wants to merge 1 commit intomasterfrom
Closed
[VC-52277] Add cert-manager gatherers to discovery-agent#799George-Yanev wants to merge 1 commit intomasterfrom
George-Yanev wants to merge 1 commit intomasterfrom
Conversation
Without k8s/certificates, k8s/issuers and k8s/clusterissuers the TLSPK backend cannot determine cert-manager lifecycle for discovered certificates, causing all certs to show as NOT_MANAGED in the clusters page.
George-Yanev
commented
May 5, 2026
| resource-type: | ||
| version: v1 | ||
| resource: pods | ||
| - kind: k8s-dynamic |
Author
There was a problem hiding this comment.
notes: I'm not sure if those should be in the default for all use cases as we need that for NGTS
Contributor
There was a problem hiding this comment.
I created a list of gatherers which are present in the old chart but aren't in the new chart:
data-gatherers:
# gather k8s apiserver version information
- kind: "k8s-discovery"
name: "k8s-discovery"
- kind: "k8s-dynamic"
name: "k8s/namespaces"
config:
resource-type:
resource: namespaces
version: v1
# gather services for pod readiness probe rules
- kind: "k8s-dynamic"
name: "k8s/services"
config:
resource-type:
resource: services
version: v1
- kind: "k8s-dynamic"
name: "k8s/ingresses"
config:
resource-type:
group: networking.k8s.io
version: v1
resource: ingresses
- kind: "k8s-dynamic"
name: "k8s/certificates"
config:
resource-type:
group: cert-manager.io
version: v1
resource: certificates
- kind: "k8s-dynamic"
name: "k8s/certificaterequests"
config:
resource-type:
group: cert-manager.io
version: v1
resource: certificaterequests
- kind: "k8s-dynamic"
name: "k8s/issuers"
config:
resource-type:
group: cert-manager.io
version: v1
resource: issuers
- kind: "k8s-dynamic"
name: "k8s/clusterissuers"
config:
resource-type:
group: cert-manager.io
version: v1
resource: clusterissuers
- kind: "k8s-dynamic"
name: "k8s/googlecasissuers"
config:
resource-type:
group: cas-issuer.jetstack.io
version: v1beta1
resource: googlecasissuers
- kind: "k8s-dynamic"
name: "k8s/googlecasclusterissuers"
config:
resource-type:
group: cas-issuer.jetstack.io
version: v1beta1
resource: googlecasclusterissuers
- kind: "k8s-dynamic"
name: "k8s/awspcaissuer"
config:
resource-type:
group: awspca.cert-manager.io
version: v1beta1
resource: awspcaissuers
- kind: "k8s-dynamic"
name: "k8s/awspcaclusterissuers"
config:
resource-type:
group: awspca.cert-manager.io
version: v1beta1
resource: awspcaclusterissuers
- kind: "k8s-dynamic"
name: "k8s/mutatingwebhookconfigurations"
config:
resource-type:
group: admissionregistration.k8s.io
version: v1
resource: mutatingwebhookconfigurations
- kind: "k8s-dynamic"
name: "k8s/validatingwebhookconfigurations"
config:
resource-type:
group: admissionregistration.k8s.io
version: v1
resource: validatingwebhookconfigurations
- kind: "k8s-dynamic"
name: "k8s/gateways"
config:
resource-type:
group: networking.istio.io
version: v1alpha3
resource: gateways
- kind: "k8s-dynamic"
name: "k8s/virtualservices"
config:
resource-type:
group: networking.istio.io
version: v1alpha3
resource: virtualservices
- kind: "k8s-dynamic"
name: "k8s/routes"
config:
resource-type:
version: v1
group: route.openshift.io
resource: routes
- kind: "k8s-dynamic"
name: "k8s/venaficonnections"
config:
resource-type:
group: jetstack.io
version: v1alpha1
resource: venaficonnections
- kind: "k8s-dynamic"
name: "k8s/venaficlusterissuers"
config:
resource-type:
group: jetstack.io
version: v1alpha1
resource: venaficlusterissuers
- kind: "k8s-dynamic"
name: "k8s/venafiissuers"
config:
resource-type:
group: jetstack.io
version: v1alpha1
resource: venafiissuers
- kind: "k8s-dynamic"
name: "k8s/fireflyissuers"
config:
resource-type:
group: firefly.venafi.com
version: v1
resource: issuers
- kind: "k8s-dynamic"
name: "k8s/stepissuers"
config:
resource-type:
group: certmanager.step.sm
version: v1beta1
resource: stepissuers
- kind: "k8s-dynamic"
name: "k8s/stepclusterissuers"
config:
resource-type:
group: certmanager.step.sm
version: v1beta1
resource: stepclusterissuers
- kind: "k8s-dynamic"
name: "k8s/originissuers"
config:
resource-type:
group: cert-manager.k8s.cloudflare.com
version: v1
resource: originissuers
- kind: "k8s-dynamic"
name: "k8s/clusteroriginissuers"
config:
resource-type:
group: cert-manager.k8s.cloudflare.com
version: v1
resource: clusteroriginissuers
- kind: "k8s-dynamic"
name: "k8s/freeipaissuers"
config:
resource-type:
group: certmanager.freeipa.org
version: v1beta1
resource: issuers
- kind: "k8s-dynamic"
name: "k8s/freeipaclusterissuers"
config:
resource-type:
group: certmanager.freeipa.org
version: v1beta1
resource: clusterissuers
- kind: "k8s-dynamic"
name: "k8s/ejbcaissuers"
config:
resource-type:
group: ejbca-issuer.keyfactor.com
version: v1alpha1
resource: issuers
- kind: "k8s-dynamic"
name: "k8s/ejbcaclusterissuers"
config:
resource-type:
group: ejbca-issuer.keyfactor.com
version: v1alpha1
resource: clusterissuersMaybe we should just copy them all?
Contributor
|
Replaced by #800 ! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Without k8s/certificates, k8s/issuers and k8s/clusterissuers the TLSPK backend cannot determine cert-manager lifecycle for discovered certificates, causing all certs to show as
NOT_MANAGEDin the clusters page.