bugfix: update secret function adapt ssa feature gate

[xumeng1231]

Pull Request Motivation

When I deployed the cert-manager 1.16 version to the k8s 1.22 cluster, I encountered an error: "re-queuing item due to error processing" err="failed to apply secret tcs-system/tcs-admission-webhook-tls: 415: Unsupported Media Type" logger="cert-manager.controller". I checked the code and found that in the module where the controller updates the secret, there was no control using the ssa feature gate. Because I noticed that the default value of ServerSideApply was false. After I redeployed using the modified code to the cluster, it worked normally.

Kind

/kind bug

Release Note

NONE

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign erikgb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cert-manager-prow]

Hi @xumeng1231. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[erikgb]

@xumeng1231, cert-manager 1.16 is unsupported. See https://cert-manager.io/docs/releases/#currently-supported-releases.

[xumeng1231]

@xumeng1231, cert-manager 1.16 is unsupported. See https://cert-manager.io/docs/releases/#currently-supported-releases.

[xumeng1231]

@xumeng1231, cert-manager 1.16 is unsupported. See https://cert-manager.io/docs/releases/#currently-supported-releases.

However, the problem still exists in the master branch.

[erikgb]

@xumeng1231, cert-manager 1.16 is unsupported. See https://cert-manager.io/docs/releases/#currently-supported-releases.

However, the problem still exists in the master branch.

Yes, you are correct.

/ok-to-test
/cc @inteon

[erikgb]

/retest

[inteon]

@xumeng1231 As mentioned by @erikgb, we no longer support cert-manager 1.16, we also do not support kubernetes 1.22.
We assume that ServerSideApply works in your cluster (oldest k8s version we support is 1.29).

If I recall correctly, we depend on ServerSideApply for this part of the code to work correctly (merge existing secrets with our changes etc.). I agree that it is misleading that not all our ServerSideApply patches are gated by the ServerSideApply feature gate.

[xumeng1231]

@xumeng1231 As mentioned by @erikgb, we no longer support cert-manager 1.16, we also do not support kubernetes 1.22. We assume that ServerSideApply works in your cluster (oldest k8s version we support is 1.29).

If I recall correctly, we depend on ServerSideApply for this part of the code to work correctly (merge existing secrets with our changes etc.). I agree that it is misleading that not all our ServerSideApply patches are gated by the ServerSideApply feature gate.

Yes, after I supplemented it with the ServerSideApply feature gate, cert-manager was able to run normally on my 1.22 cluster (although it does not support Kubernetes 1.22). However, you must admit that there are issues with the code.

[xumeng1231]

/retest

[cert-manager-prow]

@xumeng1231: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-master-make-test	d0b9e0c	link	true	/test pull-cert-manager-master-make-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[inteon]

Sorry @xumeng1231, we won't accept this change. Our long term goal is to move to SSA 100%. We don't have capacity right now to review changes to support k8s 1.22.
I agree that the feature gate is not gating all SSA code, but given our long-term goal and supported k8s versions, fixing this is not a priority.

[maelvls]

@xumeng1231 Hey, thanks for working on this! As Tim mentioned, cert-manager no longer supports Kubernetes 1.22, and we would like to avoid going down this path.

I'd love to hear more about the reasons that led you to stay on Kubernetes 1.22. Feel free to join one of our open standups or biweekly meetings: https://cert-manager.io/docs/contributing/#daily-check-in.