BUGFIX: Fix consistency bugs in filtered secrets logic

[inteon]

The SecretsFilteredCaching feature that was promoted to Beta in 1.13 has an issue with consistency across the typed and metadata cache. This results in cert-manager thinking that secrets do not exist when the label is being removed/ added from the resource. This can result in incorrect reconciliations of the linked Certificates #6494.

How to reproduce:

1. create a Certificate resource
2. remove the fao annotation from the Secret
3. notice that cert-manager re-issues the Certificate

Kind

/kind bug

Release Note

NONE

[jetstack-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from inteon. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jetstack-bot]

@inteon: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-master-make-test	f0543bf	link	true	/test pull-cert-manager-master-make-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[inteon]

UPDATE: it doesn't seem like an issue that can be easily fixed. Furthermore, the error only occurs if you upgrade from a <v1.12 version to a v1.13 version (skipping v1.12).

See #6494 (comment) for full analysis and conclusions.