Helm: Error: global: Additional property is not allowed: prevents installation as a sub-chart and on Rancher RKE

[AreYouLoco]

📢 cert-manager v1.16.1 has the fix for this bug.

• https://github.com/cert-manager/cert-manager/releases/tag/v1.16.1

Describe the bug:
After trying to upgrade from v1.15.3 to v1.16.0 I encountered an issue. I believe its related to using RKE1 self-hosted as kubernetes engine. There is no way for me to delete the conflicting property "cattle" because it gets added automatically by Rancher Kubernetes Engine

root@rke-master:~# helm upgrade cert-manager jetstack/cert-manager --namespace cert-manager
Error: UPGRADE FAILED: values don't meet the specifications of the schema(s) in the
 following chart(s):
cert-manager:
- global: Additional property cattle is not allowed

Expected behaviour:
Deployment will pull the new image and successfully upgrade. I've read the breaking changes and I believe its because of new validation of the fields in values.yml

Steps to reproduce the bug:
First I've tried to upgrade from Rancher webui but the result is the same when using helm directly. Command and output above. To note I've made sure to apply CRDs before upgrade and that went well. No issues.

Anything else we need to know?:
The conflicting property from values.yml is the following:

global:
  cattle:
    systemProjectId: some-short-unique-value

I guess this property should be taken into account and/or getting whitelisted to solve the issue.

Environment details::

• Kubernetes version: v1.30.4
• Cloud-provider/provisioner: RKE1
• cert-manager version: v1.15.3 to v1.16.0
• Install method:
  Rancher webui and helm upgrade

/kind bug

[AreYouLoco]

Seems I managed to fix it by adding

--reset-values

to helm upgrade command. But I guess the problem might be back with next release. I cannot recall if I had something special in values.yml when initially deploying.

This should be in release notes that there might be a problem on RKE1.

[lemniskett]

Second this.

[roderik]

Same here with enabled: true

I install cert-manager as a subchart:

cert-manager:
  enabled: false
  ...

The latest version sets "additionalProperties": false, in the json schema and cert-manager does not know about enabled or in the OP's issue cattle. A similar issue in another chart open-telemetry/opentelemetry-helm-charts#228

[wallrj]

Thanks for reporting the issue. We'll investigate further.

• The JSON schema file was introduced in Enable Helm values.yaml jsonschema validation #7069
• The latest version) of helm-tool is used to generate the JSON schema: v0.5.1
• helm-tool > v0.4.2 contains a workaround for this problem which we first encountered in Helm chart JSON schema validation prevents it being used as a sub-chart approver-policy#389 and fixed in Add global value to JSON schema (2nd try) helm-tool#30
• Perhaps the reason the workaround isn't working for cert-manager is that the cert-manager chart has an existing global field, while approver-policy does not.

[wallrj]

Linked to this known issue in the 1.16.0 release page.

[wallrj]

/milestone 1.16

[wallrj]

📢 cert-manager v1.16.1 has the fix for this bug.

• https://github.com/cert-manager/cert-manager/releases/tag/v1.16.1

[AreYouLoco]

Thanks! The helm chart is not available yet. I will check it out when its there. CRDs already applied

[AreYouLoco]

I confirm that I upgraded without --reset-values and it went fine.