← Problem Library
K8s L5 K8S 1382 · 14 min

A cert-manager CA injector updates one namespace and misses another

The CA bundle refresh works in part of the cluster, yet one webhook object is no longer selected by the injector after a label schema change.

K8sPlatform ReliabilityLevel 5Pro14 min
Scenario

A chart upgrade modernizes labels and later one admission path begins failing with stale CA data while others keep working.

What to check first
  • Identify the primary failure signal in the The Injector Was Running and One Webhook Fell Outside the Labels It Watched scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare injector selectors and target object labels before rotating certificates or restarting webhooks.

Questions worth viewing together
What should you verify first when A cert-manager CA injector updates one namespace and misses another appears?

Community-field Kubernetes problem inspired by cert-manager and Helm community patterns where CA injection missed one webhook after a label change. Injection drift can come from label schema changes that silently drop one object out of scope.

What usually causes A cert-manager CA injector updates one namespace and misses another in production?

Teams often blame broken CA issuance when one webhook simply no longer matches the injector selector.

What should you document after resolving A cert-manager CA injector updates one namespace and misses another?

Chart upgrades that touch labels should be checked against controller selectors, not only app pods and Services.