# Issues setting up TLS for MongoDB with cert-manager

**URL:** <https://forums.percona.com/t/issues-setting-up-tls-for-mongodb-with-cert-manager/13231>\
**Category:** Percona Operator for MongoDB\
**Created:** [November 25, 2021, 4:22pm UTC](https://forums.percona.com/t/issues-setting-up-tls-for-mongodb-with-cert-manager/13231 "2021-11-25T16:22:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bstreitz](https://avatars.discourse-cdn.com/v4/letter/b/e68b1a/32.png) [@bstreitz](https://forums.percona.com/u/bstreitz)\
**Post date:** [November 25, 2021, 4:22pm UTC](https://forums.percona.com/t/issues-setting-up-tls-for-mongodb-with-cert-manager/13231/1 "2021-11-25T16:22:36Z")

</div>

Hello,

I’m currently trying to setup TLS for the MongoDB deployment. I want to use the cert-manager to issue the certificates.

Cert-manager v1.6.0 was deployed way before I started deploying the MongoDB operator into our Azure Kubernetes Cluster. We already serve Let’s-Encrypt certificates with it. So, it is working. Further, the CRDs are applied and show up when I list them with.

```auto
$ kubectl get crds | grep cert-manager
certificaterequests.cert-manager.io
certificates.cert-manager.io
challenges.acme.cert-manager.io
clusterissuers.cert-manager.io
issuers.cert-manager.io
orders.acme.cert-manager.io

```

I have following options set in the deployment file

```nohighlight
  mongod:
    security:
      redactClientLogData: false
      enableEncryption: true

```

So far so god, but I get an error:

```auto
"level":"error",
"ts":1637768579.1549218,
"logger":"controller_psmdb",
"msg":"issue cert with cert-manager",
"error":"create issuer: no matches for kind \"Issuer\" in version \"cert-manager.io/v1alpha2\"",
"stacktrace":
    "github.com/go-logr/zapr.(*zapLogger).Error
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/github.com/go-logr/zapr/zapr.go:128
    github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb.(*ReconcilePerconaServerMongoDB).reconsileSSL
        /go/src/github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb/ssl.go:37
    github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb.(*ReconcilePerconaServerMongoDB).Reconcile
        /go/src/github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb/psmdb_controller.go:296
    sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:256
    sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:232
    sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:211
    k8s.io/apimachinery/pkg/util/wait.JitterUntil.func1
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:152
    k8s.io/apimachinery/pkg/util/wait.JitterUntil
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:153
    k8s.io/apimachinery/pkg/util/wait.Until
        /go/src/github.com/percona/percona-server-mongodb-operator/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:88"

```

I checked for permissions using:

```auto
$ kubectl --as=system:serviceaccount:mongo-database:percona-psmdb-operator auth can-i get -n mongo-database issuers 
yes

```

Any idea where the issue lies? Is there an issue that the cert-manager and operator are located in dfiferent namespaces?

---

<div class="post-metadata">

**Author:** ![bstreitz](https://avatars.discourse-cdn.com/v4/letter/b/e68b1a/32.png) [@bstreitz](https://forums.percona.com/u/bstreitz)\
**Post date:** [November 26, 2021, 8:48am UTC](https://forums.percona.com/t/issues-setting-up-tls-for-mongodb-with-cert-manager/13231/2 "2021-11-26T08:48:39Z")

</div>

After a chat with the cert-manager devs I found out that v1alpha2 is no longer available in newer cert-manager versions.

Would you accept a PR which updates the cert creation to use the cert-manget api v1?  
I read somewhere that you intend to restructure the whole part.  
[https://github.com/percona/percona-server-mongodb-operator/blob/main/pkg/controller/perconaservermongodb/ssl.go](https://github.com/percona/percona-server-mongodb-operator/blob/main/pkg/controller/perconaservermongodb/ssl.go)

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [November 29, 2021, 2:03pm UTC](https://forums.percona.com/t/issues-setting-up-tls-for-mongodb-with-cert-manager/13231/3 "2021-11-29T14:03:23Z")

</div>

Hello @bstreitz , yeah, seems like updating the APIs would do the trick. @Ege_Gunes what do you think?

---

<div class="post-metadata">

**Author:** ![bstreitz](https://avatars.discourse-cdn.com/v4/letter/b/e68b1a/32.png) [@bstreitz](https://forums.percona.com/u/bstreitz)\
**Post date:** [November 29, 2021, 6:41pm UTC](https://forums.percona.com/t/issues-setting-up-tls-for-mongodb-with-cert-manager/13231/4 "2021-11-29T18:41:24Z")

</div>

After learning more about the configuration and the code I noticed that

```auto
  mongod:
    security:
      redactClientLogData: false
      enableEncryption: true

```

has nothing to do with TLS but encryption of data at rest. To clarify for those who stumble upon this thread, overall TLS handling is triggered via

```auto
spec:
  allowUnsafeConfigurations: false

```