cert-manager: add feature gate options for webhook and cainjector

docs/addons.md

@@ -208,6 +208,27 @@ spec:
     useServiceAccountExternalPermissions: true
 ```
 
+##### Feature gates
+
+{{ kops_feature_table(kops_added_default='1.37') }}
+
+The cert-manager controller, webhook and cainjector each accept their own set of feature gates, so they are configured
+per component: `featureGates` applies to the controller, `webhookFeatureGates` to the webhook and `cainjectorFeatureGates`
+to the cainjector. Some features, such as `AdditionalCertificateOutputFormats` and `NameConstraints`, must be enabled on
+both the controller and the webhook to take effect.
+
+```yaml
+spec:
+  certManager:
+    enabled: true
+    featureGates:
+      AdditionalCertificateOutputFormats: true
+    webhookFeatureGates:
+      AdditionalCertificateOutputFormats: true
+```
+
+See the [cert-manager feature gates documentation](https://cert-manager.io/docs/installation/configuring-components/#feature-gates) for the gates each component supports.
+
 Read more about cert-manager in the [official documentation](https://cert-manager.io/docs/)
 
 #### Karpenter

k8s/crds/kops.k8s.io_clusters.yaml

@@ -325,6 +325,12 @@ spec:
               certManager:
                 description: CertManager determines the metrics server configuration.
                 properties:
+                  cainjectorFeatureGates:
+                    additionalProperties:
+                      type: boolean
+                    description: CAInjectorFeatureGates is a list of experimental
+                      features that can be enabled or disabled for the cainjector.
+                    type: object
                   defaultIssuer:
                     description: |-
                       defaultIssuer sets a default clusterIssuer
@@ -364,6 +370,12 @@ spec:
                     items:
                       type: string
                     type: array
+                  webhookFeatureGates:
+                    additionalProperties:
+                      type: boolean
+                    description: WebhookFeatureGates is a list of experimental features
+                      that can be enabled or disabled for the webhook.
+                    type: object
                 type: object
               channel:
                 description: The Channel we are following

pkg/apis/kops/componentconfig.go

@@ -1250,6 +1250,12 @@ type CertManagerConfig struct {
 
 	// FeatureGates is a list of experimental features that can be enabled or disabled.
 	FeatureGates map[string]bool `json:"featureGates,omitempty"`
+
+	// WebhookFeatureGates is a list of experimental features that can be enabled or disabled for the webhook.
+	WebhookFeatureGates map[string]bool `json:"webhookFeatureGates,omitempty"`
+
+	// CAInjectorFeatureGates is a list of experimental features that can be enabled or disabled for the cainjector.
+	CAInjectorFeatureGates map[string]bool `json:"cainjectorFeatureGates,omitempty"`
 }
 
 // LoadBalancerControllerSpec determines the AWS LB controller configuration.

pkg/apis/kops/v1alpha2/componentconfig.go

@@ -1321,6 +1321,12 @@ type CertManagerConfig struct {
 
 	// FeatureGates is a list of experimental features that can be enabled or disabled.
 	FeatureGates map[string]bool `json:"featureGates,omitempty"`
+
+	// WebhookFeatureGates is a list of experimental features that can be enabled or disabled for the webhook.
+	WebhookFeatureGates map[string]bool `json:"webhookFeatureGates,omitempty"`
+
+	// CAInjectorFeatureGates is a list of experimental features that can be enabled or disabled for the cainjector.
+	CAInjectorFeatureGates map[string]bool `json:"cainjectorFeatureGates,omitempty"`
 }
 
 // LoadBalancerControllerSpec determines the AWS LB controller configuration.

pkg/apis/kops/v1alpha3/componentconfig.go

@@ -1233,6 +1233,12 @@ type CertManagerConfig struct {
 
 	// FeatureGates is a list of experimental features that can be enabled or disabled.
 	FeatureGates map[string]bool `json:"featureGates,omitempty"`
+
+	// WebhookFeatureGates is a list of experimental features that can be enabled or disabled for the webhook.
+	WebhookFeatureGates map[string]bool `json:"webhookFeatureGates,omitempty"`
+
+	// CAInjectorFeatureGates is a list of experimental features that can be enabled or disabled for the cainjector.
+	CAInjectorFeatureGates map[string]bool `json:"cainjectorFeatureGates,omitempty"`
 }
 
 // LoadBalancerControllerSpec determines the AWS LB controller configuration.

tests/integration/update_cluster/many-addons/data/aws_s3_object_cluster-completed.spec_content

@@ -11,9 +11,13 @@ spec:
   awsLoadBalancerController:
     enabled: true
   certManager:
+    cainjectorFeatureGates:
+      ServerSideApply: true
     enabled: true
     featureGates:
       AdditionalCertificateOutputFormats: true
+    webhookFeatureGates:
+      AdditionalCertificateOutputFormats: true
   channel: stable
   cloudConfig:
     awsEBSCSIDriver:

tests/integration/update_cluster/many-addons/data/aws_s3_object_many-addons.example.com-addons-bootstrap_content

@@ -48,7 +48,7 @@ spec:
       k8s-app: metrics-server
   - id: k8s-1.16
     manifest: certmanager.io/k8s-1.16.yaml
-    manifestHash: 17db9ccb408cc6e020ba494e0fbfb5a25e773a836799dd28f46852d0bb6234d9
+    manifestHash: 5a9e96bc8f86441558134f498eb30fca8d3568efe33e7a941a1dfc722e111599
     name: certmanager.io
     prune:
       kinds:

tests/integration/update_cluster/many-addons/data/aws_s3_object_many-addons.example.com-addons-certmanager.io-k8s-1.16_content

@@ -14414,6 +14414,7 @@ spec:
       - args:
         - --v=2
         - --leader-election-namespace=kube-system
+        - --feature-gates=ServerSideApply=true
         env:
         - name: POD_NAMESPACE
           valueFrom:
@@ -14605,6 +14606,7 @@ spec:
         - --dynamic-serving-dns-names=cert-manager-webhook
         - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
         - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
+        - --feature-gates=AdditionalCertificateOutputFormats=true
         env:
         - name: POD_NAMESPACE
           valueFrom:

tests/integration/update_cluster/many-addons/in-v1alpha2.yaml

@@ -7,9 +7,13 @@ spec:
   awsLoadBalancerController:
     enabled: true
   certManager:
+    cainjectorFeatureGates:
+      ServerSideApply: true
     enabled: true
     featureGates:
       AdditionalCertificateOutputFormats: true
+    webhookFeatureGates:
+      AdditionalCertificateOutputFormats: true
   clusterAutoscaler:
     enabled: true
     podAnnotations:

upup/models/cloudup/resources/addons/certmanager.io/k8s-1.16.yaml.template

@@ -13248,6 +13248,9 @@ spec:
           args:
           - --v=2
           - --leader-election-namespace=kube-system
+          {{ range $key, $value := .CertManager.CAInjectorFeatureGates }}
+          - --feature-gates={{ $key }}={{ $value }}
+          {{ end }}
           ports:
           - containerPort: 9402
             name: http-metrics
@@ -13453,6 +13456,9 @@ spec:
           - --dynamic-serving-dns-names=cert-manager-webhook
           - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
           - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
+          {{ range $key, $value := .CertManager.WebhookFeatureGates }}
+          - --feature-gates={{ $key }}={{ $value }}
+          {{ end }}
           ports:
           - name: https
             protocol: TCP