Helm installation does not allow cert-manager ClusterIssuer use

[maakuth]

Helm installation assumes cert-manager issuer type to be Issuer, so it is not usable for situations where the desired issuer would be ClusterIssuer instead.

[im-konge]

@maakuth do you plan to open a PR with fix for this? I'm asking because I just wanted to start release of new version. Thanks :)

[maakuth]

Not at the moment, no. I suppose another helm parameter and respective condition in the helm template should do it, but I haven't started on it yet.

[scholzj]

Triaged on 4.9.2025: This might be useful for some users. We should keep the issue.

[scholzj]

@maakuth So, getting back to this:

• What is the point of using ClusterIssuer? It does not really matter what kind of issuer is used as it is anyway used only for communication between Kube and Drain Cleaner. There is no expectation that anyone else would call the webhook.
• Is the point of this issue that the Helm Chart should create ClusterIssuer instead of Issuer? Or that you need/want to use your own ClusterIssuer for some reason?

CC @aywengo

[maakuth]

If one does want to reuse an ClusterIssuer that's already present in the cluster, this would be needed. Normally your (Cluster)Issuer isn't configured solely for the drain-cleaner's benefit, so the choice between ClusterIssuer and Issuer could have been done much earlier. This was the case for me.

[scholzj]

I would tend to agree that normally, you want to use some shared issuer. But at least for me, normally means that you are securing communication between two or more applications which communicate together. But in this case, there is no such thing. The Drain Cleaner is expected to be called only by Kubernetes through the webhook. There is no expectation for other applications to call it. So why exactly do you need to use some shared issuer?

[maakuth]

For convenience, not having to configure separate issuer for one component.