Cannot create Issuers or Certificates after upgrade

You are unable to create Issuers or Certificates after upgrading from foundational services Extended Update Support (EUS) version to version 3.16.0.

Symptoms

After upgrading foundational services from Extended Update Support (EUS) version to version 3.16.0, you are not able to create Issuers and Certificates, and the error similar to the following line is displayed in the logs:

Internal error occurred: failed calling webhook \\\\\"webhook.certmanager.k8s.io\\\\\": the server could not find the requested resource

Cause

Certificate manager did not complete the upgrade properly. The operator upgraded, but it failed to fully upgrade its operands and other resources, for example, cert-manager-cainjector and cert-manager-webhook. This issue is being investigated.

Resolving the problem

To resolve the problem, delete the Certificate manager custom resource, and then recreate it.

  1. Back up the Certificate manager custom resource.

     oc get certmanager -n ibm-common-services default > certmanager.yaml
    
  2. Edit the back up file certmanager.yaml, and remove the following sections: managedFields and status.

  3. Delete the Certificate manager custom resource to remove its operands.

     oc delete certmanager -n ibm-common-services default
    
  4. Re-create Certificate manager operands.

     oc apply -n ibm-common-services -f certmanager.yaml
    
  5. After the following operand pods: cert-manager-cainjector, cert-manager-controller, and cert-manager-webhook are Ready, verify you can create Issuers and Certificates.