cert-manager is started without --enable-gateway-api=true when gateway is enabled on platform and tenant level #3725

Activity

1. Ray Low (crossRT)

   added

   kind/bugCategorizes issue or PR as related to a bugCategorizes issue or PR as related to a bug

   triage/needs-triageIndicates an issue needs triage by a maintainerIndicates an issue needs triage by a maintainer

   on Aug 10, 2026
2. dosubot commented on Aug 10, 2026

   

   dosubotBot

   on Aug 10, 2026 – with DosuBot

   More actions

   This looks like a valid bug. The cert-manager deployment in Cozystack (v1.20.2) does not explicitly enable Gateway API support — featureGates is set to an empty string and config is {}, so neither --enable-gateway-api nor enableGatewayAPI in the controller config is being passed [1] [2]. There are also no overrides in the wrapper chart's values.yaml [3].

   The error you're seeing — gateway api is not enabled — confirms cert-manager doesn't know it should use Gateway API HTTPRoutes for the HTTP-01 ACME challenge solver.

   The fix would be to set enableGatewayAPI: true in cert-manager's controller configuration. In Cozystack's chart structure, this would go in packages/system/cert-manager/values.yaml under the cert-manager key, something like:

   cert-manager:
     config:
       apiVersion: controller.config.cert-manager.io/v1alpha1
       kind: ControllerConfiguration
       enableGatewayAPI: true

   This config gets rendered into a ConfigMap and mounted into the controller via --config [4] [5].

   Ideally this should be conditionally enabled based on whether gateway.enabled: true is set in the platform values, since the Gateway API CRDs may not be present when gateway is disabled.

   To reply, just mention @dosu.

   ---

   Share context across your team and agents. Try Dosu.

   
3. lexfrei commented on Aug 14, 2026

   

   Aleksei Sviridkin (lexfrei)

   on Aug 14, 2026

   Contributor

   More actions

   Confirmed, and the two halves of this already disagree in the tree.

   packages/system/cert-manager-issuers/templates/cluster-issuers.yaml renders http01.gatewayHTTPRoute with a parentRef to the cozystack Gateway whenever gateway-enabled is true, so the ClusterIssuer does ask for the Gateway solver. The controller then refuses it, because packages/system/cert-manager/values.yaml sets no config block and --enable-gateway-api is off by default. That produces the couldn't Present challenge ...: gateway api is not enabled line on every challenge for as long as the Gateway is enabled.

   The fix is small:

   cert-manager:
     config:
       apiVersion: controller.config.cert-manager.io/v1alpha1
       kind: ControllerConfiguration
       enableGatewayAPI: true

   Enabling it unconditionally is safe. The controller only needs the Gateway API CRDs to exist at startup, and cozystack.cert-manager already declares dependsOn: cozystack.gateway-api-crds in the platform sources, so they land first in every variant that ships cert-manager.
4. lexfrei commented on Sep 2, 2026

   

   Aleksei Sviridkin (lexfrei)

   on Sep 2, 2026

   Contributor

   More actions

   Correction to my note above: the config block must not become a default of system/cert-manager. The same chart is installed into tenant Kubernetes clusters, where the Gateway API CRDs are an opt-in addon, and cert-manager v1.20 fails to start when the flag is on and the CRDs are missing (buildClients in pkg/controller/context.go returns an error on purpose). #4039 threads the flag from the platform bundle into the host cert-manager instead, the same way the tenant addon already does it under addons.gatewayAPI.enabled.

   👍React with 👍1Reacted by Ray Low
5. Aleksei Sviridkin (lexfrei)

   added

   area/networkingIssues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)Issues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)

   triage/acceptedIndicates an issue is ready to be actively worked onIndicates an issue is ready to be actively worked on

   priority/important-soonMust be staffed and worked on either currently, or very soon, ideally in time for the next releaseMust be staffed and worked on either currently, or very soon, ideally in time for the next release

   and removed

   triage/needs-triageIndicates an issue needs triage by a maintainerIndicates an issue needs triage by a maintainer

   on Sep 23, 2026
6. Aleksei Sviridkin (lexfrei)

   closed this as completedin #4039on Oct 7, 2026
7. Marian Koreniuk (themoriarti)

   added a commit that references this issue on Oct 7, 2026

   fix(cert-manager): enable the Gateway API solver in the host cert-man…

   ...

   This issue will close once commit 0a2bb5e is merged into the 'main' branch.

   0a2bb5e