AKS azure container storage extensions installs own cert-manager as helm dependency.

The other way what would work for me is to add labels to pods and service accounts.
We want to use cert-manager with managed identity for the DNS01 challenge. If I self deploy it, I can add the labels with these values:

  --set-string serviceAccount.labels."azure\.workload\.identity/use"="true" \
  --set-string podLabels."azure\.workload\.identity/use"="true" \

I saw in the chart values that there is a section cert-manager.podLabels: {} So from my understanding it should be possible to add labels via the az cli --config parameter, but it has a problem parsing the dots and slashes, I get an error.

--config cert-manager.podLabels.azure\.workload\.identity/use=true

(ExtensionOperationFailed) The extension operation failed with the following error: Helm Upgrade Failed : Unable to build the Kubernetes resources in the extension based on the cluster : InnerError [unable to decode "": json: cannot unmarshal object into Go struct field ObjectMeta.metadata.labels of type string], For general troubleshooting visit: https://aka.ms/k8s-extensions-TSG. Code: ExtensionOperationFailed

I tried different escape patterns and also put it in a json file but always the same. Does anyone see how I can get this to work?

Hello GrandoKevin-7124, the underlying Helm chart for the Azure Container Storage extension does expose fields like cert-manager.podLabels and cert-manager.serviceAccount.labels. You’ve hit a known pain point: the az k8s-extension CLI doesn't support passing complex nested keys like cert-manager.podLabels.azure.workload.identity/use due to the way it serializes values into JSON for the extension backend.

When you do something like this-

--config cert-manager.podLabels.azure.workload.identity/use=true

The backend tries to deserialize this into a structure like this

{

  "cert-manager": {

"podLabels": {

  "azure.workload.identity/use": "true"

}

  }

}

But it treats azure.workload.identity/use as a nested object, and this breaks parsing because Kubernetes labels must be flat key-value strings. Hence the error:

json: cannot unmarshal object into Go struct field ObjectMeta.metadata.labels of type string

Even using --config-file with valid JSON doesn’t work because the Helm extension parser doesn’t allow literal strings with / in keys inside maps — it’s a limitation of the current extension framework.

I would recommend that you once try patching the cert-manager deployment and service account after installation

Or

Since you already mentioned you're open to deploying your own cert-manager, I would recommend you try that path as that may actually be a cleaner solution long term.

I would recommend that you once try patching the cert-manager deployment and service account after installation

I would, but the helm deployment should override my changes on each reconcile run.

Since you already mentioned you're open to deploying your own cert-manager, I would recommend you try that path as that may actually be a cleaner solution long term.

This was my intention from the beginning, but as I wrote in my first post, I cannot disable the cert-manager installed by azure container storage.

Hello Kevin, as I already mentioned and even you pointed out acs doesn't support disabling cert mgr. There is currently no supported way to prevent acs from installing it's own cert mgr instance and you are correct. Helm reconciliation will override the manual patches. I tried the same from my end. Currently it's a limitation.

Hi GrandoKevin-7124,

Because of the current limitations of Azure Container Storage (ACS) notably its hardcoded installation of an outdated cert-manager without customization options, the better approach I can say is to uninstall ACS and directly deploy OpenEBS. This strategy grants full control over your storage setup and cert-manager configuration, ensuring compatibility with workload identity and DNS challenges.

Follow the steps mentioned below

Uninstall Azure Container Storage Extension:

 az k8s-extension delete --cluster-name <AKS_CLUSTER_NAME> --resource-group <RESOURCE_GROUP_NAME> --name azurecontainerstorage --cluster-type managedClusters

Install OpenEBS via Helm:

helm repo add openebs https://openebs.github.io/charts
helm repo update
helm install openebs openebs/openebs \
                  --namespace openebs \
                  --create-namespace \
                  -f custom-values.yaml

Refer to the OpenEBS Installation Guide for detailed instructions.

Deploy Custom cert-manager with Workload Identity Labels:

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
      --namespace cert-manager \
      --create-namespace \
      --set installCRDs=true \
      --set-string serviceAccount.labels."azure\.workload\.identity/use"="true" \
      --set-string podLabels."azure\.workload\.identity/use"="true"

For more information, consult the cert-manager Helm Installation Documentation.

Please let us know if it was helpful, and feel free to reach out if you have any further queries.