Make sure the self-signed resources are applied AFTER cert-manager itself

charts/kubezero-cert-manager/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-cert-manager
 description: KubeZero Umbrella Chart for cert-manager
 type: application
-version: 0.3.3
+version: 0.3.4
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:
@@ -15,6 +15,6 @@ dependencies:
     version: ">= 0.1.1"
     repository: https://zero-down-time.github.io/kubezero/
   - name: cert-manager
-    version: 0.15.0
+    version: 0.15.1
     repository: https://charts.jetstack.io
 kubeVersion: ">= 1.16.0"

charts/kubezero-cert-manager/templates/cluster-ca.yaml

@@ -9,6 +9,8 @@ metadata:
   namespace: kube-system
   labels:
 {{ include "kubezero-lib.labels" . | indent 4 }}
+  annotations:
+    "helm.sh/hook": "post-install"
 spec:
   selfSigned: {}
 ---
@@ -19,6 +21,8 @@ metadata:
   namespace: kube-system
   labels:
 {{ include "kubezero-lib.labels" . | indent 4 }}
+  annotations:
+    "helm.sh/hook": "post-install"
 spec:
   secretName: kubezero-ca-tls
   commonName: "kubezero-local-ca"
@@ -37,6 +41,8 @@ metadata:
   namespace: kube-system
   labels:
 {{ include "kubezero-lib.labels" . | indent 4 }}
+  annotations:
+    "helm.sh/hook": "post-install"
 data:
   tls.crt: {{ .Values.localCA.ca.crt | b64enc }}
   tls.key: {{ .Values.localCA.ca.key | b64enc }}
@@ -50,6 +56,8 @@ metadata:
   namespace: kube-system
   labels:
 {{ include "kubezero-lib.labels" . | indent 4 }}
+  annotations:
+    "helm.sh/hook": "post-install"
 spec:
   ca:
     secretName: kubezero-ca-tls

charts/kubezero-cert-manager/templates/cluster-issuer.yaml

@@ -5,6 +5,8 @@ metadata:
   name: {{ .Values.clusterIssuer.name }}
   labels:
 {{ include "kubezero-lib.labels" . | indent 4 }}
+  annotations:
+    "helm.sh/hook": "post-install"
 spec:
   acme:
     server: {{ .Values.clusterIssuer.server }}