cert-manager: Cannot get certificateRequest after dns change
Hello, I have deployed kube-prometheus-stack with helm, actually the certificate for prometheus and alert-manager is ok but not for grafana. The certificate is stuck at the “Issuing” step, no certificateRequest is created.
Ingress logs
Normal CreateCertificate 19m (x13 over 23d) cert-manager Successfully created Certificate "grafana-general-tls"
Certs logs
Normal Issuing 20m cert-manager Issuing certificate as Secret does not exist
ClusterIssuer
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
namespace: cert-manager
spec:
acme:
email: xxx@xxx.xx
preferredChain: ""
privateKeySecretRef:
name: letsencrypt-prod
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- http01:
ingress:
class: nginx
helm values for grafana
grafana:
ingress:
enabled: true
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
certmanager.k8s.io/cluster-issuer: letsencrypt-prod
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
hosts:
- grafana.mydomain.com
tls:
- hosts:
- grafana.mydomain.com
secretName: grafana-general-tls
IngressClass
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
creationTimestamp: "2021-12-20T16:04:59Z"
generation: 1
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/version: 1.0.5
helm.sh/chart: ingress-nginx-4.0.7
name: nginx
resourceVersion: "349268769"
selfLink: /apis/networking.k8s.io/v1/ingressclasses/nginx
spec:
controller: k8s.io/ingress-nginx
Expected behaviour:
Steps to reproduce the bug: Deploy kube-prometheus-stack with a domain name for grafana, delete it, and redeploy with another domain name.
Environment details::
- Kubernetes version: v1.19.15-eks-9c63c4
- Cloud-provider/provisioner: aws
- cert-manager version: v1.7.0
- Install method: helm
/kind bug
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 20
Looking at the configs here https://github.com/jetstack/cert-manager/issues/4790#issuecomment-1023307237 I see two
MutatingWebhookConfigurations that both seem to apply to cert-manager resources one calledgitlab-certmanager-webhookfor cert-manager v1.2 and one calledcert-manager-webhookfor cert-manager v1.7I guess you have some leftovers from cert-manager v1.2