Skip to main content

Configuring log levels for cert-manager and the cert-manager Operator for Red Hat OpenShift

To troubleshoot issues with the cert-manager components and the cert-manager Operator for Red Hat OpenShift, you can configure the log level verbosity.

note

To use different log levels for different cert-manager components, see Customizing cert-manager Operator API fields.

Setting a log level for cert-manager​

To troubleshoot issues and control log volume, configure the log level for the cert-manager Operator for Red Hat OpenShift. You can set specific verbosity levels to capture the necessary details for debugging or to reduce noise in your cluster logs.

Prerequisites

  • You have access to the cluster with cluster-admin privileges.
  • You have installed version 1.11.1 or later of the cert-manager Operator for Red Hat OpenShift.

Procedure

  1. Edit the CertManager resource by running the following command:

    $ oc edit certmanager.operator cluster

  2. Set the log level value by editing the spec.logLevel section:

    apiVersion: operator.openshift.io/v1alpha1
    kind: CertManager
    ...
    spec:
      logLevel: <log_level>

    The CertManager resource supports the following logLevel values:

    Normal
    Audits logs and records common operations. The default setting. Use this level when there are no issues.
    Debug
    Provides verbose logs. Use this level to troubleshoot minor issues.
    Trace
    Provides highly verbose logs. Use this level to troubleshoot major issues.
    TraceAll
    Provides maximum log detail. Use this level to troubleshoot serious issues.
    note

    TraceAll generates huge amount of logs. After setting logLevel to TraceAll, you might experience performance issues.

  3. Save your changes and quit the text editor to apply your changes. After applying the changes, the verbosity level for the cert-manager components controller, CA injector, and webhook is updated.

Setting a log level for the cert-manager Operator for Red Hat OpenShift​

To troubleshoot issues and control log volume, set the log level for the cert-manager Operator for Red Hat OpenShift. You can configure the verbosity of the Operator log messages to capture the specific details required for your environment.

Prerequisites

  • You have access to the cluster with cluster-admin privileges.
  • You have installed version 1.11.1 or later of the cert-manager Operator for Red Hat OpenShift.

Procedure

  • Update the subscription object for cert-manager Operator for Red Hat OpenShift to provide the verbosity level for the operator logs by running the following command:

    $ oc -n cert-manager-operator patch subscription openshift-cert-manager-operator --type='merge' -p '{"spec":{"config":{"env":[{"name":"OPERATOR_LOG_LEVEL","value":"v"}]}}}'

    Replace v with the desired log level number. The valid values for v can range from 1to 10. The default value is 2.

Verification

  1. The cert-manager Operator pod is redeployed. Verify that the log level of the cert-manager Operator for Red Hat OpenShift is updated by running the following command:

    $ oc set env deploy/cert-manager-operator-controller-manager -n cert-manager-operator --list | grep -e OPERATOR_LOG_LEVEL -e container
    Example output
    # deployments/cert-manager-operator-controller-manager, container kube-rbac-proxy
    OPERATOR_LOG_LEVEL=9
    # deployments/cert-manager-operator-controller-manager, container cert-manager-operator
    OPERATOR_LOG_LEVEL=9

  2. Verify that the log level of the cert-manager Operator for Red Hat OpenShift is updated by running the oc logs command:

    $ oc logs deploy/cert-manager-operator-controller-manager -n cert-manager-operator

Additional resources