cert-manager: ClusterIssuer not found

just came across this issue and the problems was specifying the right kind of issuer in your certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: <name>
spec:
  secretName: <secret>
  issuerRef:
    name: <my-ref>
    kind: <ClusterIssuer | Issuer >
  dnsNames:
  ...

“ClusterIssuer not found” can also occur from a problem in a subtle upgrade detail where Helm charts are involved. When the annotations on the Helm chart (or certificate indication of issuer) don’t match with the latest versions of cert-manager.

https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/

In particular you need ingress definitions in Helm chart ingress annotations to change from “k8s.io” to “cert-manager.io”

e.g. certmanager.k8s.io/cluster-issuer: to cert-manager.io/cluster-issuer:

I’m adding this because the issue name is confusing and the problem can crop up for multiple reasons. OP looks like a timeout issue reaching the host.

Notes from a serial upgrader

So here’s a bizarre twist.

$ kubectl get clusterissuers
No resources found in default namespace.

BUT

I can list my certificates and they all come back as ready. This is after and upgrade from 9-12 directly.

Client Version: version.Info{Major:"1", Minor:"17", GitVersion:"v1.17.0", GitCommit:"70132b0f130acc0bed193d9ba59dd186f0e634cf", GitTreeState:"clean", BuildDate:"2019-12-13T11:52:32Z", GoVersion:"go1.13.4", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"15+", GitVersion:"v1.15.7-gke.23", GitCommit:"06e05fd0390a51ea009245a90363f9161b6f2389", GitTreeState:"clean", BuildDate:"2020-01-17T23:10:45Z", GoVersion:"go1.12.12b4", Compiler:"gc", Platform:"linux/amd64"}

---

In general it seems that the cert-manager pod has to come online before kubectl will find your new/old resource version.

You’ll see:

$ kubectl get clusterissuers
Error from server (NotFound): Unable to list "certmanager.k8s.io/v1alpha1, Resource=clusterissuers": the server could not find the requested resource (get clusterissuers.certmanager.k8s.io)

Until the upgraded version is running.

---

Generally it seems you need to restart the cert-manager pod in order for this to work. Not sure why that is. Not sure how many times is necessary.

---

Another fun thing: kubectl caches the CRDs I think? So client-go looking for specific resources and versions works great, but kubectl gets:

$ kubectl get certificates --all-namespaces
Error from server (NotFound): Unable to list "certmanager.k8s.io/v1alpha1, Resource=certificates": the server could not find the requested resource (get certificates.certmanager.k8s.io)

Running kubectl api-resources will get it to resync the resources.

I add the same problem after an upgrade on AKS 1.22.11 going from cert-manager 1.4 to 1.5 (1.5.5 at the time)

kubectl describe certificaterequest cert-mycert-9sz6g

outputs

[...]
Normal  IssuerNotFound   63m (x5 over 63m)  cert-manager  Referenced "ClusterIssuer" not found: clusterissuer.cert-manager.io "letsencrypt" not found

But the issuer was here:

kubectl describe clusterissuer letsencrypt

outputs

Status:
  Acme:
    Last Registered Email:  my@email.com
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/XXXXXXXXgfdsa
  Conditions:
    Last Transition Time:  2022-08-22T14:45:12Z
    Message:               The ACME account was registered with the ACME server
    Observed Generation:   1
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

Reading though this doc:

https://cert-manager.io/docs/faq/acme/#1-troubleshooting-clusterissuers

I found some request related issues / method for troubleshooting.

While you are kubectl describeing element one by one you get the link to the other:

• kubectl describe certificate => certificaterequest
• kubectl describe certificaterequest => challenge
• kubectl describe challenges
• etc.

At one point I saw previous secret aged more that my upgrade, I delete them, the certificate too. etc. Once I finally arrive to the challenge that gave me:

  Reason:      Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://sub.domain.com/.well-known/acme-challenge/n0Zf1EeE_5AfD_Ugck1V3qbpcReLDABeawZOLHQgEbc': Get "http://sub.domain.com/.well-known/acme-challenge/n0Zf1EeE_5AfD_Ugck1V3qbpcReLDABeawZOLHQgEbc": dial tcp 12.34.156.78:80: connect: connection refused

The IP was resoling but not the http request.

The solution was to upgrade too my nginx-ingress-controller.

Was related to the fact that the IngressClass was not existing at all in the previous one (an old legacy one in my case)

Hope this input would help someone seeking around with this error message.

I have the same problem . Kubernetes version v1.17.0 same with v1.16.3 Cert-manager version: v0.12.0 Install method: static manifest and Helm after uninstall Static method

Work with selfSigned but failed with Acme letsencrypt Staging & production