Skip to content

Enabling pages breaks cert-manager.io/issuer annotation on webservice ingress for helm 3.13.0+

Summary

Using a values file with global.pages.enabled: false the cert-manager.io/issuer annotation on the webservice Ingress will be exactly where it should be.

Changing global.pages.enabled to true will result in a blank line instead. The registry + KAS ingress objects are unaffected (retain the expected annotation).

Steps to reproduce

Using the minimal values in current.yaml:

certmanager:
  install: true
certmanager-issuer:
  email: me@example.com
global:
  pages:
    enabled: false
  redis:
    auth:
      key: password
      secret: gitlab-redis-password
    host: master.my-redis.5m8rhk.aps1.cache.amazonaws.com
    port: '6379'
    scheme: rediss

From the charts repo run

helm template --release-name gitlab --debug -f current.yaml .

Observe the blank line in the webservice ingress annotations:

    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "15"
    
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"

Edit current.yaml and change global.pages.enabled to false, run again and observe:

    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "15"
    cert-manager.io/issuer: "gitlab-issuer"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"

Configuration used

See above.

Current behavior

When global.pages.enabled is set to true, the annotation is omitted

Expected behavior

When global.pages.enabled is set to true, the annotation is included

Versions

  • Chart: 7.9.3 and 7.10.1
  • Helm: (helm version)
    • Client: v3.13.0
    • Server: N/A

Helm version 3.12.3 works correctly. I'm suspicious of the second notable change in https://github.com/helm/helm/releases/tag/v3.13.0 with its comments about null and numerous issues fixed. But I don't have anything more concrete yet.