From 49f32640ed66ab62d0f1dc25666b819bb781aba5 Mon Sep 17 00:00:00 2001 From: Dan Ramich Date: Fri, 23 Aug 2019 11:24:18 -0700 Subject: [PATCH 1/3] Add information for cert-manager Problem: cert-manager is old and will be cut off soon Solution: Update docs to include current install instructions and instructions on how to upgrade cert-manager to the current version --- .../upgrade-cert-manager-airgap/_index.md | 92 +++++++++++++++++++ .../upgrade-cert-manager/_index.md | 47 ++++++++++ .../install-rancher/_index.md | 33 +++++-- .../prepare-private-registry/_index.md | 4 +- .../en/installation/ha/helm-rancher/_index.md | 40 ++++++-- .../ha-server-upgrade-helm-airgap/_index.md | 2 + .../upgrades/ha-server-upgrade-helm/_index.md | 4 + 7 files changed, 206 insertions(+), 16 deletions(-) create mode 100644 content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md create mode 100644 content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md diff --git a/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md b/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md new file mode 100644 index 00000000000..ddf7ee9e99d --- /dev/null +++ b/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md @@ -0,0 +1,92 @@ +--- +title: Upgrade Cert-manager Airgap +weight: 2040 +--- + +[Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow these instructions: + +>**Note:** The namespaces used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues. + +## Prerequisites + +- **Populate Images** + + Follow the guide to [Prepare the Private Registry]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images for the upgrade Rancher release. + +- **Prepare cert-manager** + +1. From a system connected to the internet, add the cert-manager repo to helm + + ```plain + helm repo add jetstack https://charts.jetstack.io + helm repo update + ``` + +1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). + + ```plain + helm fetch jetstack/cert-manager --version v0.9.1 + ``` + +1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. + + ```plain + helm template ./cert-manager-v0.9.1.tgz --output-dir . \ + --name cert-manager --namespace kube-system \ + --set image.repository=/quay.io/jetstack/cert-manager-controller + ``` + +1. Download the required CRD file for cert-manager + + ```plain + curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + ``` + +## Install cert-manager + +1. Back up existing resources as a precaution + + ```plain + kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml + ``` + +1. Delete the existing deployment + + ```plain + helm delete --purge cert-manager + ``` + +1. Install the CustomResourceDefinition resources separately + + ```plain + kubectl apply -f cert-manager/cert-manager-crd.yaml + ``` + +1. Label the kube-system namespace to disable resource validation + + ```plain + kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true + ``` + +1. Install cert-manager + + ```plain + kubectl -n kube-system apply -R -f ./cert-manager + ``` + +Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods: + +``` +kubectl get pods --namespace kube-system + +NAME READY STATUS RESTARTS AGE +cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m +cert-manager-webhook-5b5dd6999-kst4x 1/1 Running 0 3m +cert-manager-cainjector-3ba5cd2bcd-de332x 1/1 Running 0 3m +``` + +If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide. + +[Additional information on the annotation.](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace) + +[Additional information on the webhook feature.](https://docs.cert-manager.io/en/latest/getting-started/webhook.html) \ No newline at end of file diff --git a/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md b/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md new file mode 100644 index 00000000000..70a59798003 --- /dev/null +++ b/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md @@ -0,0 +1,47 @@ +--- +title: Upgrade Cert-manager +weight: 2040 +--- + +[Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow these instructions: + + +``` +# Back up existing resources as a precaution +kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml + +# Delete the existing deployment +helm delete --purge cert-manager + +# Install the CustomResourceDefinition resources separately +kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + +# Label the kube-system namespace to disable resource validation +kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true + +# Add the Jetstack Helm repository +helm repo add jetstack https://charts.jetstack.io + +# Update your local Helm chart repository cache +helm repo update + +# Install the new version of cert-manager +helm install --version 0.9.1 --name cert-manager --namespace kube-system jetstack/cert-manager +``` + +Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods: + +``` +kubectl get pods --namespace kube-system + +NAME READY STATUS RESTARTS AGE +cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m +cert-manager-webhook-5b5dd6999-kst4x 1/1 Running 0 3m +cert-manager-cainjector-3ba5cd2bcd-de332x 1/1 Running 0 3m +``` + +If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide. + +[Additional information on the annotation.](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace) + +[Additional information on the webhook feature.](https://docs.cert-manager.io/en/latest/getting-started/webhook.html) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md index b6d09e42324..09174cdaa08 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md @@ -52,23 +52,43 @@ Based on the choice your made in [B. Choose your SSL Configuration](#b-optional- In this section you will configure your cert manager and private registry in the Rancher template. {{% accordion id="self-signed" label="Option A: Default Self-Signed Certificate" %}} -By default, Rancher generates a CA and uses cert manager to issue the certificate for access to the Rancher server interface. +By default, Rancher generates a CA and uses cert-manger to issue the certificate for access to the Rancher server interface. -1. From a system connected to the internet, fetch the latest cert-manager chart available from the [official Helm chart repository](https://github.com/helm/charts/tree/master/stable). +1. From a system connected to the internet, add the cert-manager repo to helm ```plain - helm fetch stable/cert-manager --version 0.5.2 + helm repo add jetstack https://charts.jetstack.io + helm repo update + ``` + +1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). + + ```plain + helm fetch jetstack/cert-manager --version v0.9.1 ``` 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. ```plain - helm template ./cert-manager-v0.5.2.tgz --output-dir . \ - --name cert-manager --namespace kube-system \ + helm template ./cert-manager-v0.9.1.tgz --output-dir . \ + --name cert-manager --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller ``` +1. Download the required CRD file for cert-manager + + ```plain + curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + ``` + 1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools. To configure Rancher to use your private registry when starting the `rancher/rancher` container, use the `CATTLE_SYSTEM_DEFAULT_REGISTRY` variable. You can set the the extra environment variable `extraEnv` to use the same `name` and `value` keys as the container manifest definitions. Remember to quote the values: + + Placeholder | Description + ------------|------------- + `` | The version number of the output tarball. + `` | The DNS name you pointed at your load balancer. + `` | The DNS name for your private registry.). + ```plain helm template ./rancher-.tgz --output-dir . \ @@ -127,7 +147,8 @@ Use `kubectl` to create namespaces and apply the rendered manifests. If you are using self-signed certificates, install cert-manager: ```plain -kubectl -n kube-system apply -R -f ./cert-manager +kubectl apply -f cert-manager/cert-manager-crd.yaml +kubectl -n cert-manager apply -R -f ./cert-manager ``` Install rancher: diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md index d02f1385b1e..22b18c3e6a1 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md @@ -50,7 +50,9 @@ Start by collecting all the images needed to install Rancher in an air gap envir 1. Fetch the latest `cert-manager` Helm chart and parse the template for image details. ```plain - helm fetch stable/cert-manager --version 0.5.2 + helm repo add jetstack https://charts.jetstack.io + helm repo update + helm fetch jetstack/cert-manager --version v0.9.1 helm template ./cert-manager-.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt ``` diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index 0e97eb52adc..779aed80ae5 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -37,26 +37,48 @@ There are three recommended options for the source of the certificate. > **Important:** Due to an issue with Helm v2.12.0 and cert-manager, please use Helm v2.12.1 or higher. -Rancher relies on [cert-manager](https://github.com/kubernetes/charts/tree/master/stable/cert-manager) version v0.5.2 from the official Kubernetes Helm chart repository to issue certificates from Rancher's own generated CA or to request Let's Encrypt certificates. +Rancher relies on [cert-manager](https://github.com/jetstack/cert-manager) to issue certificates from Rancher's own generated CA or to request Let's Encrypt certificates. +[These instructions come from cert-manager's official docs.](https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html#installing-with-helm) -Install `cert-manager` from Kubernetes Helm chart repository. ``` -helm install stable/cert-manager \ +# Install the CustomResourceDefinition resources separately +kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + +# Create the namespace for cert-manager +kubectl create namespace cert-manager + +# Label the cert-manager namespace to disable resource validation +kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true + +# Add the Jetstack Helm repository +helm repo add jetstack https://charts.jetstack.io + +# Update your local Helm chart repository cache +helm repo update + +# Install the cert-manager Helm chart +helm install \ --name cert-manager \ - --namespace kube-system \ - --version v0.5.2 + --namespace cert-manager \ + --version v0.9.1 \ + jetstack/cert-manager ``` -Wait for `cert-manager` to be rolled out: +Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: ``` -kubectl -n kube-system rollout status deploy/cert-manager -Waiting for deployment "cert-manager" rollout to finish: 0 of 1 updated replicas are available... -deployment "cert-manager" successfully rolled out +kubectl get pods --namespace kube-system + +NAME READY STATUS RESTARTS AGE +cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m +cert-manager-webhook-5b5dd6999-kst4x 1/1 Running 0 3m +cert-manager-cainjector-3ba5cd2bcd-de332x 1/1 Running 0 3m ``` +If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide. +
#### Rancher Generated Certificates diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md index 9681ef22fed..8fc35406bf2 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md @@ -5,6 +5,8 @@ weight: 1021 The following instructions will guide you through upgrading a high-availability Rancher Server installed in an air gap environment. +>**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow [these instructions.]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap) + ## Prerequisites - **Populate Images** diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md index 471a172acf8..e1a783e6a3e 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md @@ -11,6 +11,10 @@ The following instructions will guide you through upgrading a high-availability > > As of release v2.0.8, Rancher supports installation and upgrade by Helm chart, although RKE installs/upgrades are still supported as well. If you want to change upgrade method from RKE Add-on to Helm chart, follow this procedure. +--- + +>**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow [these instructions.]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/upgrade-cert-manager) + ## Prerequisites From 86e3fa24ec2cad10aa8ad96f9e95300329c9d9b8 Mon Sep 17 00:00:00 2001 From: Craig Jellick Date: Tue, 3 Sep 2019 19:57:30 -0700 Subject: [PATCH 2/3] Revamp cert-manager docs - Condense air gap and normal upgrade instructions for cert-manager down to a single page. This allowed us to consolidate some repetetive text. - Add a section explaining cert-manager's API change and the recommended data migration - Moved the upgrade instructions out of the cluster administration section and into the Advanced installation options (not perfect but our best fit) - On the pages where we instruct the user to install cert-manger, made a note and link to our upgrade documentation --- .../upgrade-cert-manager-airgap/_index.md | 92 ----------- .../upgrade-cert-manager/_index.md | 47 ------ .../install-rancher/_index.md | 9 +- .../en/installation/ha/helm-rancher/_index.md | 54 ++++--- .../options/upgrading-cert-manager/_index.md | 149 ++++++++++++++++++ 5 files changed, 189 insertions(+), 162 deletions(-) delete mode 100644 content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md delete mode 100644 content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md create mode 100644 content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md diff --git a/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md b/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md deleted file mode 100644 index ddf7ee9e99d..00000000000 --- a/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap/_index.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Upgrade Cert-manager Airgap -weight: 2040 ---- - -[Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow these instructions: - ->**Note:** The namespaces used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues. - -## Prerequisites - -- **Populate Images** - - Follow the guide to [Prepare the Private Registry]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images for the upgrade Rancher release. - -- **Prepare cert-manager** - -1. From a system connected to the internet, add the cert-manager repo to helm - - ```plain - helm repo add jetstack https://charts.jetstack.io - helm repo update - ``` - -1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). - - ```plain - helm fetch jetstack/cert-manager --version v0.9.1 - ``` - -1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. - - ```plain - helm template ./cert-manager-v0.9.1.tgz --output-dir . \ - --name cert-manager --namespace kube-system \ - --set image.repository=/quay.io/jetstack/cert-manager-controller - ``` - -1. Download the required CRD file for cert-manager - - ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml - ``` - -## Install cert-manager - -1. Back up existing resources as a precaution - - ```plain - kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml - ``` - -1. Delete the existing deployment - - ```plain - helm delete --purge cert-manager - ``` - -1. Install the CustomResourceDefinition resources separately - - ```plain - kubectl apply -f cert-manager/cert-manager-crd.yaml - ``` - -1. Label the kube-system namespace to disable resource validation - - ```plain - kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true - ``` - -1. Install cert-manager - - ```plain - kubectl -n kube-system apply -R -f ./cert-manager - ``` - -Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods: - -``` -kubectl get pods --namespace kube-system - -NAME READY STATUS RESTARTS AGE -cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m -cert-manager-webhook-5b5dd6999-kst4x 1/1 Running 0 3m -cert-manager-cainjector-3ba5cd2bcd-de332x 1/1 Running 0 3m -``` - -If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide. - -[Additional information on the annotation.](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace) - -[Additional information on the webhook feature.](https://docs.cert-manager.io/en/latest/getting-started/webhook.html) \ No newline at end of file diff --git a/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md b/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md deleted file mode 100644 index 70a59798003..00000000000 --- a/content/rancher/v2.x/en/cluster-admin/upgrade-cert-manager/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Upgrade Cert-manager -weight: 2040 ---- - -[Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow these instructions: - - -``` -# Back up existing resources as a precaution -kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml - -# Delete the existing deployment -helm delete --purge cert-manager - -# Install the CustomResourceDefinition resources separately -kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml - -# Label the kube-system namespace to disable resource validation -kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true - -# Add the Jetstack Helm repository -helm repo add jetstack https://charts.jetstack.io - -# Update your local Helm chart repository cache -helm repo update - -# Install the new version of cert-manager -helm install --version 0.9.1 --name cert-manager --namespace kube-system jetstack/cert-manager -``` - -Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods: - -``` -kubectl get pods --namespace kube-system - -NAME READY STATUS RESTARTS AGE -cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m -cert-manager-webhook-5b5dd6999-kst4x 1/1 Running 0 3m -cert-manager-cainjector-3ba5cd2bcd-de332x 1/1 Running 0 3m -``` - -If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide. - -[Additional information on the annotation.](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace) - -[Additional information on the webhook feature.](https://docs.cert-manager.io/en/latest/getting-started/webhook.html) \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md index 09174cdaa08..83071b85249 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md @@ -52,7 +52,10 @@ Based on the choice your made in [B. Choose your SSL Configuration](#b-optional- In this section you will configure your cert manager and private registry in the Rancher template. {{% accordion id="self-signed" label="Option A: Default Self-Signed Certificate" %}} -By default, Rancher generates a CA and uses cert-manger to issue the certificate for access to the Rancher server interface. +By default, Rancher generates a CA and uses cert-manager to issue the certificate for access to the Rancher server interface. + +> **Note:** +> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.9.1, please see our [upgrade documentation]({{< baseurl >}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/). 1. From a system connected to the internet, add the cert-manager repo to helm @@ -88,7 +91,7 @@ By default, Rancher generates a CA and uses cert-manger to issue the certificate `` | The version number of the output tarball. `` | The DNS name you pointed at your load balancer. `` | The DNS name for your private registry.). - + ```plain helm template ./rancher-.tgz --output-dir . \ @@ -166,4 +169,4 @@ These resources could be helpful when you install Rancher: - [Adding TLS secrets]({{}}/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/) - [Troubleshooting Rancher HA installations]({{}}/rancher/v2.x/en/installation/ha/helm-rancher/troubleshooting/) -### [Next: Configure Rancher System Charts]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/) \ No newline at end of file +### [Next: Configure Rancher System Charts]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/) diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index 779aed80ae5..ce6e551f9be 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -35,36 +35,50 @@ There are three recommended options for the source of the certificate. > **Note:** cert-manager is only required for certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) and Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). You should skip this step if you are using your own certificate files (option `ingress.tls.source=secret`) or if you use [TLS termination on an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#external-tls-termination). -> **Important:** Due to an issue with Helm v2.12.0 and cert-manager, please use Helm v2.12.1 or higher. +> **Important:** + +> Due to an issue with Helm v2.12.0 and cert-manager, please use Helm v2.12.1 or higher. + +> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.9.1, please see our [upgrade documentation]({{< baseurl >}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/). Rancher relies on [cert-manager](https://github.com/jetstack/cert-manager) to issue certificates from Rancher's own generated CA or to request Let's Encrypt certificates. -[These instructions come from cert-manager's official docs.](https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html#installing-with-helm) +These instructions are adapted from the [official cert-manager documentation](https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html#installing-with-helm). -``` -# Install the CustomResourceDefinition resources separately -kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml +1. Install the CustomResourceDefinition resources separately + ```plain + kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + ``` -# Create the namespace for cert-manager -kubectl create namespace cert-manager +1. Create the namespace for cert-manager + ```plain + kubectl create namespace cert-manager + ``` -# Label the cert-manager namespace to disable resource validation -kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true +1. Label the cert-manager namespace to disable resource validation + ```plain + kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true + ``` -# Add the Jetstack Helm repository -helm repo add jetstack https://charts.jetstack.io +1. Add the Jetstack Helm repository + ```plain + helm repo add jetstack https://charts.jetstack.io + ``` -# Update your local Helm chart repository cache -helm repo update +1. Update your local Helm chart repository cache + ```plain + helm repo update + ``` -# Install the cert-manager Helm chart -helm install \ - --name cert-manager \ - --namespace cert-manager \ - --version v0.9.1 \ - jetstack/cert-manager -``` +1. Install the cert-manager Helm chart + ```plain + helm install \ + --name cert-manager \ + --namespace cert-manager \ + --version v0.9.1 \ + jetstack/cert-manager + ``` Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md new file mode 100644 index 00000000000..d898013bb8f --- /dev/null +++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md @@ -0,0 +1,149 @@ +--- +title: Upgrading Cert-Manager +weight: 2040 +--- + +Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, two important changes to cert-manager are set to occur that you need to take aciton on if you have an HA deployment of Rancher: + +1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) +1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html#upgrading-from-v0-7-to-v0-8). This change has no exact deadline. + +To address these changes, this guide will do two things: + +1. Document the procedure for upgrading cert-manager +1. Explain the cert-manager API changes and link to cert-manager's offficial documentation for migrating your data + + +## Performing the upgrade +>**Note:** The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues. + +In order to upgrade cert-manager to the follow these instructions: +{{% accordion id="normal" label="Upgrading cert-manager with Internet access" %}} +1. Back up existing resources as a precaution + ```plain + kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml + ``` + +1. Delete the existing deployment + ```plain + helm delete --purge cert-manager + ``` + +1. Install the CustomResourceDefinition resources separately + ```plain + kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + ``` + +1. Label the kube-system namespace to disable resource validation + ```plain + kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true + ``` + +1. Add the Jetstack Helm repository + ```plain + helm repo add jetstack https://charts.jetstack.io + ``` + +1. Update your local Helm chart repository cache + ```plain + helm repo update + ``` + +1. Install the new version of cert-manager + ```plain + helm install --version 0.9.1 --name cert-manager --namespace kube-system jetstack/cert-manager + ``` +{{% /accordion %}} + +{{% accordion id="airgap" label="Upgrading cert-manager in an airgapped environment" %}} +### Prerequisites +Before you can perform the upgrade, you must prepare your air gapped environment by adding the necesary container images to your private registry and downloading or rendering the required Kubernetes manifest files. + +1. Follow the guide to [Prepare your Private Registry]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images needed for the upgrade. + +1. From a system connected to the internet, add the cert-manager repo to helm + + ```plain + helm repo add jetstack https://charts.jetstack.io + helm repo update + ``` + +1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). + + ```plain + helm fetch jetstack/cert-manager --version v0.9.1 + ``` + +1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. + + ```plain + helm template ./cert-manager-v0.9.1.tgz --output-dir . \ + --name cert-manager --namespace kube-system \ + --set image.repository=/quay.io/jetstack/cert-manager-controller + ``` + +1. Download the required CRD file for cert-manager + + ```plain + curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml + ``` + +### Install cert-manager + +1. Back up existing resources as a precaution + + ```plain + kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml + ``` + +1. Delete the existing deployment + + ```plain + helm delete --purge cert-manager + ``` + +1. Install the CustomResourceDefinition resources separately + + ```plain + kubectl apply -f cert-manager/cert-manager-crd.yaml + ``` + +1. Label the kube-system namespace to disable resource validation + + ```plain + kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true + ``` + +1. Install cert-manager + + ```plain + kubectl -n kube-system apply -R -f ./cert-manager + ``` +{{% /accordion %}} + + +Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods: + +``` +kubectl get pods --namespace kube-system + +NAME READY STATUS RESTARTS AGE +cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m +cert-manager-webhook-5b5dd6999-kst4x 1/1 Running 0 3m +cert-manager-cainjector-3ba5cd2bcd-de332x 1/1 Running 0 3m +``` + +If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check cert-manager's [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide. + +> **Note:** The above instructions ask you to add the disable-validation label to the kube-system namespace. Here are additional resources that explain why this is necessary: +> +> - [Information on the disable-validation label](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace) +> - [Information on webhook validation for certificates](https://docs.cert-manager.io/en/latest/getting-started/webhook.html) + +## Cert-Manager API change and data migration + +Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release. + +Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format. + +Details about the change and migration instructions can be found in the [cert-manager v0.7 to v0.8 upgrade instructions](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html). From 4f543ca7c68be7b74b15db600a512edb086ed971 Mon Sep 17 00:00:00 2001 From: Craig Jellick Date: Thu, 5 Sep 2019 18:56:47 -0700 Subject: [PATCH 3/3] address review comments --- .../install-rancher/_index.md | 27 +++++++++++++++---- .../prepare-private-registry/_index.md | 2 ++ .../en/installation/ha/helm-rancher/_index.md | 4 +-- .../options/upgrading-cert-manager/_index.md | 10 ++++--- .../ha-server-upgrade-helm-airgap/_index.md | 2 +- .../upgrades/ha-server-upgrade-helm/_index.md | 4 +-- 6 files changed, 35 insertions(+), 14 deletions(-) diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md index 83071b85249..acabfbe8f7e 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/_index.md @@ -57,7 +57,7 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat > **Note:** > Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.9.1, please see our [upgrade documentation]({{< baseurl >}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/). -1. From a system connected to the internet, add the cert-manager repo to helm +1. From a system connected to the internet, add the cert-manager repo to Helm. ```plain helm repo add jetstack https://charts.jetstack.io @@ -76,6 +76,8 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat helm template ./cert-manager-v0.9.1.tgz --output-dir . \ --name cert-manager --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller + --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook + --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector ``` 1. Download the required CRD file for cert-manager @@ -149,10 +151,25 @@ Use `kubectl` to create namespaces and apply the rendered manifests. If you are using self-signed certificates, install cert-manager: -```plain -kubectl apply -f cert-manager/cert-manager-crd.yaml -kubectl -n cert-manager apply -R -f ./cert-manager -``` +1. Create the namespace for cert-manager. + ```plain + kubectl create namespace cert-manager + ``` + +1. Label the cert-manager namespace to disable resource validation. + ```plain + kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true + ``` + +1. Create the cert-manager CustomResourceDefinitions (CRDs). + ```plain + kubectl apply -f cert-manager/cert-manager-crd.yaml + ``` + +1. Launch cert-manager. + ```plain + kubectl apply -R -f ./cert-manager + ``` Install rancher: diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md index 22b18c3e6a1..bf699e4bba1 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/_index.md @@ -49,6 +49,8 @@ Start by collecting all the images needed to install Rancher in an air gap envir 1. Fetch the latest `cert-manager` Helm chart and parse the template for image details. + > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.9.1, please see our [upgrade documentation]({{< baseurl >}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/). + ```plain helm repo add jetstack https://charts.jetstack.io helm repo update diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md index ce6e551f9be..601855b1d75 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md @@ -33,7 +33,7 @@ There are three recommended options for the source of the certificate. ### Optional: Install cert-manager -> **Note:** cert-manager is only required for certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) and Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). You should skip this step if you are using your own certificate files (option `ingress.tls.source=secret`) or if you use [TLS termination on an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#external-tls-termination). +**Note:** cert-manager is only required for certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) and Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). You should skip this step if you are using your own certificate files (option `ingress.tls.source=secret`) or if you use [TLS termination on an External Load Balancer]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-rancher/chart-options/#external-tls-termination). > **Important:** @@ -83,7 +83,7 @@ These instructions are adapted from the [official cert-manager documentation](ht Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: ``` -kubectl get pods --namespace kube-system +kubectl get pods --namespace cert-manager NAME READY STATUS RESTARTS AGE cert-manager-7cbdc48784-rpgnt 1/1 Running 0 3m diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md index d898013bb8f..9458da3fd59 100644 --- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md @@ -3,7 +3,7 @@ title: Upgrading Cert-Manager weight: 2040 --- -Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, two important changes to cert-manager are set to occur that you need to take aciton on if you have an HA deployment of Rancher: +Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, two important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher: 1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) 1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html#upgrading-from-v0-7-to-v0-8). This change has no exact deadline. @@ -17,7 +17,7 @@ To address these changes, this guide will do two things: ## Performing the upgrade >**Note:** The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues. -In order to upgrade cert-manager to the follow these instructions: +In order to upgrade cert-manager, follow these instructions: {{% accordion id="normal" label="Upgrading cert-manager with Internet access" %}} 1. Back up existing resources as a precaution ```plain @@ -57,11 +57,11 @@ In order to upgrade cert-manager to the follow these instructions: {{% accordion id="airgap" label="Upgrading cert-manager in an airgapped environment" %}} ### Prerequisites -Before you can perform the upgrade, you must prepare your air gapped environment by adding the necesary container images to your private registry and downloading or rendering the required Kubernetes manifest files. +Before you can perform the upgrade, you must prepare your air gapped environment by adding the necessary container images to your private registry and downloading or rendering the required Kubernetes manifest files. 1. Follow the guide to [Prepare your Private Registry]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images needed for the upgrade. -1. From a system connected to the internet, add the cert-manager repo to helm +1. From a system connected to the internet, add the cert-manager repo to Helm ```plain helm repo add jetstack https://charts.jetstack.io @@ -80,6 +80,8 @@ Before you can perform the upgrade, you must prepare your air gapped environment helm template ./cert-manager-v0.9.1.tgz --output-dir . \ --name cert-manager --namespace kube-system \ --set image.repository=/quay.io/jetstack/cert-manager-controller + --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook + --set cainjector.image.repository=/quay.io/jetstack/cert-manager-cainjector ``` 1. Download the required CRD file for cert-manager diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md index 8fc35406bf2..d16b051d8bd 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md @@ -5,7 +5,7 @@ weight: 1021 The following instructions will guide you through upgrading a high-availability Rancher Server installed in an air gap environment. ->**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow [these instructions.]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap) +>**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/upgrade-cert-manager-airgap) ## Prerequisites diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md index e1a783e6a3e..9b34822a98c 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md @@ -7,13 +7,13 @@ The following instructions will guide you through upgrading a high-availability >**Note:** If you installed Rancher using the RKE Add-on yaml, see the following documents to migrate or upgrade. > ->* [Migrating from RKE Add-On Install]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on) +>- [Migrating from RKE Add-On Install]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on) > > As of release v2.0.8, Rancher supports installation and upgrade by Helm chart, although RKE installs/upgrades are still supported as well. If you want to change upgrade method from RKE Add-on to Helm chart, follow this procedure. --- ->**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) In order to upgrade cert-manager to the newer version follow [these instructions.]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/upgrade-cert-manager) +>**Note:** [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/upgrade-cert-manager) ## Prerequisites