<p>We have a production AKS cluster that has a <code>stable/cert-manager</code> helm chart installed to allow using Let's Encrypt certificates. The current version installed is <code>cert-manager-v0.6.0</code> in the <code>kube-system</code> namespace.</p>

<p>Let's Encrypt is to stop support for traffic from cert-manager pre 8.0 version from 1st of November 2019.</p>

<p>I would like to upgrade but the latest available <code>stable</code> chart version is <code>v0.6.7</code>. Seems like the way to go is to switch to <code>jetstack/cert-manager</code>.</p>

<p>How do I best approach this? Shall I uninstall the current <code>stable/cert-manager</code> chart and install from scratch with the <code>jetstack/cert-manager</code>? Any resource on how to tackle this without downtime in production would be much appreciated. Please let me know if I can provide any more details.</p>

<p>For anyone asking the same question, I have tried to perform clean install on my test cluster and this seemed to work fairly smoothly. I have found what the name of my the helm release was by running <code>helm list</code> </p>

<p>then I have performed the following steps:</p>

<p><strong>1.Backup</strong>:</p>

<pre><code>kubectl get -o yaml \
   --all-namespaces \
   issuer,clusterissuer,certificates,orders,challenges &gt; cert-manager-backup.yaml
</code></pre>

<p><a href="https://docs.cert-manager.io/en/latest/tasks/backup-restore-crds.html" rel="nofollow noreferrer">Source</a></p>

<p><strong>2.Delete</strong>:</p>

<pre><code># Uninstall the Helm chart
helm delete --purge &lt;your release name here&gt;

# Ensure the cert-manager CustomResourceDefinition resources do not exist:
kubectl delete crd \
    certificates.certmanager.k8s.io \
    issuers.certmanager.k8s.io \
    clusterissuers.certmanager.k8s.io
</code></pre>

<p>described in step 2 <a href="https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.5-0.6.html" rel="nofollow noreferrer">here</a></p>

<p><strong>3.Install a fresh jetstack version</strong>:</p>

<pre><code># Install the CustomResourceDefinition resources separately
kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml

# Create the namespace for cert-manager
kubectl create namespace cert-manager

# Label the cert-manager namespace to disable resource validation
kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true

# Add the Jetstack Helm repository
helm repo add jetstack https://charts.jetstack.io

# Update your local Helm chart repository cache
helm repo update

# Install the cert-manager Helm chart
helm install --name &lt;your release name here&gt; --namespace cert-manager --version v0.9.1 jetstack/cert-manager
</code></pre>

<p>described <a href="https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html#installing-with-helm" rel="nofollow noreferrer">here</a></p>

<p><strong>4.Restore</strong>:</p>

<p>I have tried running</p>

<pre><code>kubectl apply -f cert-manager-backup.yaml
</code></pre>

<p>as described <a href="https://docs.cert-manager.io/en/latest/tasks/backup-restore-crds.html#restoring" rel="nofollow noreferrer">here</a> but this step actually didn't fully work for me. The Issuers were created (self signed and CA) but I could not re-create the <code>Certificates</code> and <code>ClusterIssuer</code>. These were the errors I have received:</p>

<pre><code>Error from server (InternalError): Internal error occurred: failed calling webhook "clusterissuers.admission.certmanager.k8s.io": the server is currently unable to handle the request
Error from server (InternalError): Internal error occurred: failed calling webhook "certificates.admission.certmanager.k8s.io": the server is currently unable to handle the request
</code></pre>

<p>I had my original <code>yaml</code> files and was able to create the <code>ClusterIssuer</code> and <code>Certificate</code> by applying them</p>
