2026-07-22 06:23:56 +00:00
1 changed files with 9 additions and 0 deletions
@@ -73,6 +73,15 @@ spec:
        enabled: true
        # Empty => chart provisions its own self-signed CA (self-contained).
        issuerRef: {}
+        # Chart 0.24.0 bug: the agent/bouncer/appsec Certificate templates emit
+        # `secretTemplate:` unconditionally while its child blocks are guarded,
+        # so with nothing set it renders as null and cert-manager's webhook
+        # rejects it ("spec.secretTemplate ... must be of type object"). (The
+        # lapi cert template guards the whole key, which is why only the others
+        # failed.) Setting a label makes secretTemplate a valid non-null object.
+        secretTemplate:
+          labels:
+            app.kubernetes.io/part-of: crowdsec
      agent:
        tlsClientAuth: true