From 3a152ef28ff0f3e87fc217f49c1cd6b15e2b64b6 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Wed, 22 Jul 2026 07:46:48 +0200 Subject: [PATCH] fix(crowdsec): set tls secretTemplate so cert-manager accepts the certs (#340) The mTLS fix in #343 failed to apply: chart 0.24.0's agent/bouncer/appsec Certificate templates emit `secretTemplate:` unconditionally while its child blocks are guarded, so with nothing configured it rendered as null and cert-manager's webhook rejected it (spec.secretTemplate must be of type object). The helm upgrade failed and rolled back, so agents stayed on the fragile register-based path. Set tls.certManager.secretTemplate.labels so secretTemplate renders as a valid object. Verified via kubectl apply --dry-run=server against the live cert-manager webhook: all 4 Certificates now accepted. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/infrastructure/crowdsec/helmrelease.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kubernetes/infrastructure/crowdsec/helmrelease.yaml b/kubernetes/infrastructure/crowdsec/helmrelease.yaml index df3d5c6f..540dae32 100644 --- a/kubernetes/infrastructure/crowdsec/helmrelease.yaml +++ b/kubernetes/infrastructure/crowdsec/helmrelease.yaml @@ -73,6 +73,15 @@ spec: enabled: true # Empty => chart provisions its own self-signed CA (self-contained). issuerRef: {} + # Chart 0.24.0 bug: the agent/bouncer/appsec Certificate templates emit + # `secretTemplate:` unconditionally while its child blocks are guarded, + # so with nothing set it renders as null and cert-manager's webhook + # rejects it ("spec.secretTemplate ... must be of type object"). (The + # lapi cert template guards the whole key, which is why only the others + # failed.) Setting a label makes secretTemplate a valid non-null object. + secretTemplate: + labels: + app.kubernetes.io/part-of: crowdsec agent: tlsClientAuth: true -- 2.54.0