<p>I'm attempting to upgrade cert-manager in my kubernetes cluster. Currently the version installed was pre crd name change and I'm trying to clean up the old CRDs.</p>

<pre><code>&gt; kubectl get crd | grep certmanager.k8s.io 

certificates.certmanager.k8s.io                2020-01-31T08:25:56Z
challenges.certmanager.k8s.io                  2020-01-31T08:25:56Z
clusterissuers.certmanager.k8s.io              2020-01-31T08:25:58Z
issuers.certmanager.k8s.io                     2020-01-31T08:25:03Z
orders.certmanager.k8s.io                      2020-01-31T08:25:08Z
</code></pre>

<p>After identifying the crds I delete them:</p>

<pre><code>&gt; kubectl delete customresourcedefinition certificates.certmanager.k8s.io challenges.certmanager.k8s.io clusterissuers.certmanager.k8s.io issuers.certmanager.k8s.io orders.certmanager.k8s.io

customresourcedefinition.apiextensions.k8s.io "certificates.certmanager.k8s.io" deleted
customresourcedefinition.apiextensions.k8s.io "challenges.certmanager.k8s.io" deleted
customresourcedefinition.apiextensions.k8s.io "clusterissuers.certmanager.k8s.io" deleted
customresourcedefinition.apiextensions.k8s.io "issuers.certmanager.k8s.io" deleted
customresourcedefinition.apiextensions.k8s.io "orders.certmanager.k8s.io" deleted
</code></pre>

<p>Following deletion <code>kubectl get crd | grep certmanager.k8s.io</code> shows no crds but after about 30 seconds they are regenerated. Where do I need to look to identify what's causing them to regenerate.</p>

<p>All other cert-manager resources have been deleted.</p>

<p>This has come about because I don't seem to be able to view/edit/delete resources in the new CRD but applying changes updates the (hidden) resource. </p>

Nick
<p>The behavior you are experiencing is probably caused by the Istio addon. When Istio is enabled in the cluster, the following resources are created:</p>

<p>certificates.certmanager.k8s.io,</p>

<p>challenges.certmanager.k8s.io,</p>

<p>clusterissuers.certmanager.k8s.io, </p>

<p>issuers.certmanager.k8s.io, and </p>

<p>orders.certmanager.k8s.io </p>

<p>.. and istio is in charge of reconciling them periodically. This means if you delete them manually they will get automatically recreated.</p>

<p>You can verify this by creating a sample cluster with enabling istio and then run the following command:</p>

<p>~$ kubectl get apiservices</p>

<p>~$ kubectl get customresourcedefinitions.apiextensions.k8s.io, and</p>

<p>~$ kubectl describe customresourcedefinitions.apiextensions.k8s.io certificates.certmanager.k8s.io</p>

<p>There is an addon with label “addonmanager.kubernetes.io/mode=Reconcile” which by definition periodically reconciles and this is the reason why the CRD (managed by Istio) kept getting recreated. For details you can refer to this <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/addon-manager" rel="nofollow noreferrer">URL</a>. Please try disabling the addon before doing the deletion."</p>
