From ae7f742144a89e3dc04e8c2192c33c77d763b62a Mon Sep 17 00:00:00 2001
From: Alberto Gonzalez Rodriguez <josegonz@redhat.com>
Date: Thu, 15 Jan 2026 19:47:18 +0100
Subject: [PATCH] [ocp4_workload_cert_manager] Fix environments without
 fallback provider

---
 roles/ocp4_workload_cert_manager/tasks/workload.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/roles/ocp4_workload_cert_manager/tasks/workload.yml b/roles/ocp4_workload_cert_manager/tasks/workload.yml
index a349bfd..a86debd 100644
--- a/roles/ocp4_workload_cert_manager/tasks/workload.yml
+++ b/roles/ocp4_workload_cert_manager/tasks/workload.yml
@@ -106,7 +106,6 @@
     template: "{{ item }}"
   loop:
   - clusterissuer.yaml.j2
-  - clusterissuer-fallback.yaml.j2
   - certificate-ingress.yaml.j2
   - certificate-api.yaml.j2
   register: r_clusterissuer
@@ -114,6 +113,13 @@
   delay: 30
   until: r_clusterissuer is success
 
+
+- name: Set up ClusterIssuer fallback
+  when: ocp4_workload_cert_manager_provider_fallback | default("") != ""
+  kubernetes.core.k8s:
+    state: present
+    template: "clusterissuer-fallback.yaml.j2
+
 - name: Install Ingress controller certificate
   when: ocp4_workload_cert_manager_install_ingress_certificates | bool
   block: