Josh van Leeuwen

@xUnholy Indeed it is istio-csr which is populating this configmap in all namespaces. This should be on the istio proxy container rather than the main httpbin one: ```bash $ kubectl...

@xUnholy if it helps, these are the manifests which I used when setting up with google-cas if you want to compare notes :slightly_smiling_face: ```yaml apiVersion: install.istio.io/v1alpha1 kind: IstioOperator metadata: namespace:...

@xUnholy aha- this sounds like the culprit. I'm not very familiar with ASM myself so am not entirely sure how it is propagating the CA certificate, but would expect it...

Hi @anannaya, AKAIK istio only exposes the following Prometheus metric, which is not very useful for certificates that are signed with a TTL =< 24h. ``` # TYPE envoy_server_days_until_first_cert_expiring gauge...

Hi @smarunich, all tests successfully pass against cert-manager `v1.7`

Hi @isality, this looks to be a duplicate of https://github.com/cert-manager/istio-csr/issues/175 Can you update your helm version, and try again?

Could you explain this a bit more, I’m not sure I follow? ``` But i think it's not okay, when a non-existent field is accessed ```

Hi @anannaya, Can you please share the istio-csr version and configuration you used. Sharing your kube and istio version will also help. > one pods was hung at Can you...

Hi @Shourabh28, this is likely because you have an older version of cert-manager installed on the cluster. `revisionHistoryLimit` was introduced in cert-manager v1.3, which is the lowest compatible version with...

@Shourabh28 I am not sure how that is the case either, as the use of `revisionHistoryLimit` was introduced in [`v0.2.0`](https://github.com/cert-manager/istio-csr/releases/tag/v0.2.0). I'd double check istiod's Certificate on those other clusters.