cert-manager.io/v1 Certificate no acme field

Question

I am trying to migrate cert-manager to API v1, I was able to migrate the Issuer to ClusterIssue (the first part of the YAML). However, I am dealing with a breaking change that there is no more acme on kind Certificate

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-myapp-issuer
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: wildcard-myapp-com
    solvers:
      - dns01:
          cloudDNS:
            serviceAccountSecretRef:
              name: clouddns-service-account
              key: key.json
            project: project-id

---

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-com-tls
  namespace: default
spec:
  secretName: myapp-com-tls
  issuerRef:
    name: letsencrypt-myapp-issuer
  commonName: '*.myapp.com'
  dnsNames:
  - myapp.com
  acme:
    config:
    - dns01:
        provider: google-dns
      domains:
      - '*.myapp.com'
      - myapp.com

When I run kubectl apply I got the error:

error validating data: ValidationError(Certificate.spec): unknown field "acme" in io.cert-manager.v1.Certificate.spec

How can I migrate to the new version of cert-manager?

Answer 1

As part of v0.8, a new format for configure ACME Certificate resources has been introduced. Notably, challenge solver configuration has moved from the Certificate resource (under certificate.spec.acme) and now resides on your configure Issuer resource, under issuer.spec.acme.solvers.

So the result manifests should be as following;

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-myapp-issuer
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: wildcard-myapp-com
    solvers:
      - selector:
          dnsNames:
          - '*.myapp.com'
          - myapp.com
        dns01:
          cloudDNS:
            serviceAccountSecretRef:
              name: clouddns-service-account
              key: key.json
            project: project-id

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-com-tls
  namespace: default
spec:
  secretName: myapp-com-tls
  issuerRef:
    name: letsencrypt-myapp-issuer
  commonName: '*.myapp.com'
  dnsNames:
  - myapp.com