Release 1.3.1-gcm.0

[maelvls]

We released cert-manager 1.3.1 last week and we want to let new users of GCM be able to use v1.3.1 when deployment both using the CLI installation and the click-to-deploy installation.

⚠️ Note that we DO NOT HAVE an upgrade process documented yet. This has not been prioritized yet, see #48. If a user has installed 1.1.0-gcm.7 (either using the CLI installation or the click-to-deploy installation), then they do not have a way to upgrade to 1.3.1-gcm.0 yet.

Progress for releasing 1.3.1-gcm.0:

• Cannot run on github.com/jetstack/preflight@v0.1.29 jakexks/go-providence-checker#2: fix go-providence-checker so that it works for preflight
• find out about the flackiness, cf convo
• open an issue about logex not having a LICENSE file → The dependency chzyer/logex does not have a LICENSE file jetstack-secure#229
• Rebuild our images that meet the Google Marketplace licenses requirements #10: Add LICENSES.txt to cert-manager, jetstack-secure-agent and google-cas-issuer images using go-providence-checker -> done in Add a cloudbuild for running go-providence-checker on all images #49
• add the new RBAC rules for the Approval API to the google-cas-issuer chart
• Follow the manual GCM update instructions to create a GitHub Release
• Update README.md to point to 1.3.1-gcm.0.

[maelvls]

@james-w When do we want to have that done? I am currently focusing on cert-manager/website#426, but I could prioritize the upgrade of GCM to 1.3.

[maelvls]

After this morning's cert-manager internal meeting, upgrading to v1.3.1 has been prioritized for today.

Requirement: In order to upgrade the GCM version to v1.3.1, we first need to:

1. Rebuild our images that meet the Google Marketplace licenses requirements #10 (be able to use the re-licensing tool written by @jakexks)
2. Use Cloud Build to build and push images manually to the gcr.io/jetstack-public repository #18 (have everything automated)

[maelvls]

Oops, looks like the cluster had been scaled to 0. I'll add an instruction to scale to 1 and then scale to 0 afterward:

Step #13 - "verify": 10s Warning FailedScheduling pod/preflight-f7484c6f5-pgtpv 0/1 nodes are available: 1 Insufficient cpu.

[maelvls]

I am stuck on another issue.

I0429 16:17:06.312677       1 main.go:123]  >   0: kubectl smoke test: PASSED
I0429 16:17:06.313019       1 main.go:123]  >   1: Create test issuer and self signed cert: PASSED
E0429 16:17:06.313355       1 main.go:125]  >   2: Try to get new cert: FAILED
E0429 16:17:06.313422       1 main.go:125]  >   3: Try to get cert secret: FAILED
I0429 16:17:06.313448       1 main.go:123]  >   4: Delete issuer and self signed cert: PASSED

Looking at the test suite, the certificate does not become ready within 2 minutes... Not sure why, and this is blocking the release of GCM 1.3.1! 😩

I have seen the following event though:

6s          Warning   CRNotApproved          certificaterequest/googlecas-cert-2z78m   certificate request is not approved yet

I have very little "insights" except for these cloud build logs 😞

cc @jakexks

[jakexks]

I'll take a look.

Are you installing the new RBAC rules for cert-manager v1.3 approvals?

[maelvls]

You are right, I forgot to add the new RBAC rules 😅

[maelvls]

Done! I just submitted 1.3.1-gcm.0! Let's hope it gets reviewed during the night. Dinesh reported errors, I'll re-submit.

[maelvls]

The 1.3.1-gcm.0 is now live!