cert-manager: cannot issue certificated with cert manager, not sure why.

I’m currently struggling through deploying this to GCP and will send a full list of gotchas when I’m done (hopefully in a PR), but basically there is no actual “you need these N things to get it working.” The “quick start” is “helm install stable/cert-manager” but in reality, it’s “install cert-manager, install an issuer, and maybe install a certificate but we don’t provide any clear path to doing that.”

@bbriggs I am struggling to configure cert-manager on my GCP kubernetes cluster too. A guide or improved documentation would be awesome!

It’s really sad when this is the best documentation I can find on how to actually get cert-manager working.

Okay. I think it makes sense now, but just to be exhaustively clear…

First I will create this Ingress resource:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "gce"
spec:
  tls:
  - hosts:
    - www.mysite.com
    secretName: my-site-tls
  rules:
  - host: www.mysite.com
    http:
     paths:
     - backend:
         serviceName: my-site-service
         servicePort: 80

Once the IP address is allocated I will point the A record for www.mysite.com to the newly allocated address. Once I’ve confirmed www.mysite.com resolves to the Ingress I will update the ingress to match the following…

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/tls-acme: "true"
    kubernetes.io/ingress.class: "gce"
spec:
  tls:
  - hosts:
    - www.mysite.com
    secretName: my-site-tls
  rules:
  - host: www.mysite.com
    http:
     paths:
     - backend:
         serviceName: my-site-service
         servicePort: 80

At this point cert-manager will begin the process of verifying the endpoint and creating the tls secret. Does this sound like the correct way to go if I don’t want to risk the failed verification timeout?

@DoryZi performing self-check means cert-manager is trying to make an HTTP request for http://staging.mydomain.ai/.wellknown/acme-challenge/... to make sure the challenge file is there before it asks the ACME server to check.

It will be stuck if it can’t make that request because, e.g.

• the domain name staging.mydomain.ai doesn’t exist
• the domain name staging.mydomain.ai doesn’t resolve to the IP of your ingress controller
• your Ingress isn’t working for some reason (e.g. target path annotation or forced ssl redirect)
• your network permission don’t let cert-manager make the request

If it is something to do with your Ingress settings, like it uses rewrite-target see #286 for a way to deal with that.

I found the solution after carefully reading the docs. By using the annotation certmanager.k8s.io/acme-http01-edit-in-place: "true" the old behavior can still be used. I wasn’t aware that the default behavior had changed, so I assumed this was specific to GCE.

I’ll see if I add some documentation on this, since there’s nothing here ATM: https://cert-manager.readthedocs.io/en/master/tutorials/acme/http-validation.html

When creating an ingress are we supposed to leave out the initial tls options?

For instance:

1. Create an ingress
2. Point mysite.com to ingress IP
3. Create cert-manager Certificate resource
4. Cert manager automagically adds tls to the targeted ingress !!! <---- not sure about this

Is that how the workflow should be setup?

@ericuldall you either create a Certificate and Ingress, or an Ingress with the acme annotation. In both cases the Ingress should include the ‘tls’ reference to the certifiate/TLS Secret (whether that Secret exists yet or not).

The clean method it to create the Certificate resource first, using ‘ingressClass’ in the Certificate to identify your ingress controller. The cert-manager will create a temporary Ingress, issue the certificate and create the Secret. Then, whenever you do deploy the Ingress for your application, you don’t need any Ingress annotation at all, and the TLS Secret will be there ready to go.

The alternative, convenience method is you deploy an Ingress with the acme annotation, and that refers to the TLS Secret (that doesn’t exist yet). The ingress controller will just sit on the Ingress waiting for the named Secret to appear. cert-manager will see the Ingress annotation and create a Certificate resource for you, which will trigger the certificate to be issued and the certificate Secret created, When the Secret appears, the ingress controller will pick it up.