argo-cd: Certificate resources from cert-manager v1 fails / syncing becomes stuck

guys, i do use this

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  resource.customizations.health.cert-manager.io_Certificate: |
    hs = {}
    if obj.status ~= nil then
      if obj.status.conditions ~= nil then
        for i, condition in ipairs(obj.status.conditions) do
          if condition.type == "Ready" and condition.status == "False" and condition.reason ~= "DoesNotExist" then
            hs.status = "Degraded"
            hs.message = condition.message
            return hs
          end
          if condition.type == "Ready" and condition.status == "True" and condition.reason ~= "DoesNotExist" then
            hs.status = "Healthy"
            hs.message = condition.message
            return hs
          end
        end
      end
    end
    hs.status = "Progressing"
    hs.message = "Waiting for certificate"
    return hs

but still

Name:               devops
Project:            chania-project
Server:             https://kubernetes.default.svc
Namespace:          devops
URL:                http://localhost:34295/applications/devops
Repo:               https://github.com/hlacik/gitops-chania.git
Target:             chania-2
Path:               devops
SyncWindow:         Sync Allowed
Sync Policy:        Automated (Prune)
Sync Status:        OutOfSync from chania-2 (45ddafb)
Health Status:      Healthy

GROUP                KIND           NAMESPACE     NAME                 STATUS     HEALTH   HOOK  MESSAGE
                     Secret         cert-manager  vault-approle        Synced                    
                     Secret         devops        registry-pcr-docker  Synced                    
                     Service        kube-system   traefik-apn          Synced     Healthy        
cert-manager.io      Certificate    devops        carpc-tls            OutOfSync  Healthy        
cert-manager.io      ClusterIssuer                vault-issuer         Synced                    
traefik.containo.us  TLSOption      devops        default              Synced                    
traefik.containo.us  TLSStore       devops        default              Synced      

Certificate is OutOfSync , using latest cert-manager v1.10.0

@hlacikd @CryptoTr4der @L-U-C-K-Y I had a thrashing issue, and I solved it with the below; try it and let me know.

Under configs.cm.resource.customizations, set the value:

cert-manager.io/Certificate:
          health.lua: |
            hs = {}
            if obj.status ~= nil then
              if obj.status.conditions ~= nil then
                for i, condition in ipairs(obj.status.conditions) do
                  if condition.type == "Ready" and condition.status == "False" then
                    hs.status = "Degraded"
                    hs.message = condition.message
                    return hs
                  end
                  if condition.type == "Ready" and condition.status == "True" then
                    hs.status = "Healthy"
                    hs.message = condition.message
                    return hs
                  end
                end
              end
            end

            hs.status = "Progressing"
            hs.message = "Waiting for certificate"
            return hs

I was getting the same thing, can confirm this worked for me, Argo CD v2.7.4, cert-manager v1.12.2

@hlacikd @CryptoTr4der @L-U-C-K-Y I had a thrashing issue, and I solved it with the below; try it and let me know.

Under configs.cm.resource.customizations, set the value:

cert-manager.io/Certificate:
          health.lua: |
            hs = {}
            if obj.status ~= nil then
              if obj.status.conditions ~= nil then
                for i, condition in ipairs(obj.status.conditions) do
                  if condition.type == "Ready" and condition.status == "False" then
                    hs.status = "Degraded"
                    hs.message = condition.message
                    return hs
                  end
                  if condition.type == "Ready" and condition.status == "True" then
                    hs.status = "Healthy"
                    hs.message = condition.message
                    return hs
                  end
                end
              end
            end

            hs.status = "Progressing"
            hs.message = "Waiting for certificate"
            return hs

Experiencing the same thing as @hlacikd

@aliusmiles sad to see u gone. @jessesuen would you be able to help? Any help will be much appreciated.

Argo version: Tried both : “1.8.7” My Certificate config has got helm hooks configured

  annotations:
    helm.sh/hook: pre-install
    helm.sh/hook-weight: '-5'

Argo is overriding the same with Argo sync hooks as per document. The provisioning fails with error “Issuing certificate as Secret does not exist” . All the other Deployment resources are blocked on this since Certificate provisioning is failing as Failed or Degraded.

Certificate config

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  annotations:
    helm.sh/hook: pre-install
    helm.sh/hook-weight: '-5'
  labels:
    app.kubernetes.io/instance: storage
  name: storage-cert
  namespace: atom-storage
spec:
  commonName: storage.atom-storage
  issuerRef:
    kind: ClusterIssuer
    name: commoncaissuer
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    rotationPolicy: Always
    size: 2048
  renewBefore: 360h0m0s
  secretName: storage-atom-storage-tls
  subject:
    organizations:
      - xxxxx

Deployment config

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: storage
  name: storage
  namespace: atom-storage
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: storage
      app.kubernetes.io/name: storage
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: storage
        app.kubernetes.io/name: storage
    spec:
      containers:
        - args:
            - '--config=/etc/storage/config/config.json'
            - '--level=info'
          image: >-
            storage:1.2.0-g1d2e72a864
          imagePullPolicy: IfNotPresent

          name: storage
          ports:
            - containerPort: 8080
              name: https
              protocol: TCP
          volumeMounts:
            - mountPath: /etc/storage/config/certs
              name: tls-certs
            - mountPath: /etc/storage/config
              name: config
      volumes:
        - name: tls-certs
          secret:
            secretName: storage-atom-storage-tls
        - configMap:
            name: storage-config
          name: config

Health check applied for certificate

  resource.customizations: |
    cert-manager.io/Certificate:
      health.lua: |
        hs = {}
        if obj.status ~= nil then
          if obj.status.conditions ~= nil then
            for i, condition in ipairs(obj.status.conditions) do
              if condition.type == "Ready" and condition.status == "False" and obj.metadata.namespace ~= "external-dns" then
                hs.status = "Degraded"
                hs.message = condition.message
                return hs
              end
              if condition.type == "Ready" and condition.status == "True" then
                hs.status = "Healthy"
                hs.message = condition.message
                return hs
              end
            end
          end
        end

        hs.status = "Progressing"
        hs.message = "Waiting for certificate"
        return hs

I also noticed a similar error being spoken of in issue #1826 . It seemed to have moved as fixed. I still see the issue. Am I missing some thing?

The issue got resolved with moving to ArgoCD 2.0

seems to work for me with this https://argoproj.github.io/argo-cd/operator-manual/health/#way-1-define-a-custom-health-check-in-argocd-cm-configmap but need to do some deployments to confirm – not sure if custom healthcheck helped or me terminating sync