cert-manager: Failed to install " failed post-install: timed out waiting for the condition"

Seeing this with v1.5.1 as well. I had to clean up resources manually and then the install worked with these flags:

helm uninstall cert-manager -n cert-manager
kubectl delete roles cert-manager-startupapicheck:create-cert -n cert-manager;
kubectl delete serviceaccount cert-manager-startupapicheck -n cert-manager;
kubectl delete serviceaccount default -n cert-manager;
kubectl delete jobs cert-manager-startupapicheck -n cert-manager;
kubectl delete rolebindings cert-manager-startupapicheck:create-cert -n cert-manager;

Finally: helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.5.1 --set startupapicheck.timeout=5m --set installCRDs=true

In case it helps someone else: I got this same error and was using a GKE autopilot Kubernetes cluster, and this had to be set when using helm to install: --set global.leaderElection.namespace=cert-manager got this info here: https://cert-manager.io/docs/installation/compatibility/

Since curling the webhook seems to work, maybe the timeout for the post-install job is too short.

By default, the timeout is 1 minute, which may be too short when downloading the image container itself takes a full minute:

https://github.com/jetstack/cert-manager/blob/7923823cff0afe5af49282bde3a5a1cc6f5abc84/deploy/charts/cert-manager/values.yaml#L424-L425

You can try a longer timeout:

helm install my-release --namespace cert-manager --version v1.6.1 jetstack/cert-manager --set startupapicheck.timeout=5m

it seems that installCRDs=true resolves this issue for me (using le v1.6.1)

In case someone sees this error message failed post-install: timed out waiting for the condition when using AKS + windows nodepool, you need to set nodeSelector to linux for the container images used by cert-manager.

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v1.8 \
  --set installCRDs=true \
  --set nodeSelector."kubernetes\.io/os"=linux \
  --set webhook.nodeSelector."kubernetes\.io/os"=linux \
  --set cainjector.nodeSelector."kubernetes\.io/os"=linux \
  --set startupapicheck.nodeSelector."kubernetes\.io/os"=linux

I tried to clean uninstall and then run this on a GKE autopilot Kubernetes cluster

helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set startupapicheck.timeout=5m --set installCRDs=true --set global.leaderElection.namespace=cert-manager

and finally got success

NAME: cert-manager
LAST DEPLOYED: Fri Jun  2 04:40:45 2023
NAMESPACE: cert-manager
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
cert-manager v1.12.1 has been deployed successfully!

The solution with startupapicheck.timeout solved it for me aswell.

If anyone using terraform this was my code:

resource "helm_release" "cert_manager" {
  name  = "cert-manager"
  repository = "https://charts.jetstack.io"
  chart = "cert-manager"
  create_namespace = true
  version    = "v1.9.1"
  namespace  = "cert-manager"

  set {
    name  = "startupapicheck.timeout"
    value = "5m"
  }
  set {
    name  = "installCRDs"
    value = true 
  }
}

Do we have any update on this ? I’m facing the same issue, any thoughts ?

Disabling IPsec encryption in flannel fixed it for me!

Thank you @def1nity: The version via kubectl seems to work.

I am facing the same problem. Running curl like so from another pod works (at least no timeouts): curl -v -k -X POST -d ‘{“test”: “test”}’ https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s

Seeing this with v1.5.1 as well. I had to clean up resources manually and then the install worked with these flags:

helm uninstall cert-manager -n cert-manager
kubectl delete roles cert-manager-startupapicheck:create-cert -n cert-manager;
kubectl delete serviceaccount cert-manager-startupapicheck -n cert-manager;
kubectl delete serviceaccount default -n cert-manager;
kubectl delete jobs cert-manager-startupapicheck -n cert-manager;
kubectl delete rolebindings cert-manager-startupapicheck:create-cert -n cert-manager;

Finally: helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.5.1 --set startupapicheck.timeout=5m --set installCRDs=true

Solved the issue!

In my case, the startupapicheck Job was stuck because of Istio’s sidecar auto-injection.

Simplest way to fix the problem is to add sidecar.istio.io/inject=false label to the target pod.

We can leverage startupapicheck.podLabels Helm Chart Value to configure it.

This issue is usually caused by the Kubernetes API server being unable to reach the webhook pod. There are a vast number of different reason for this, but they are all platform, networking or CNI specific. We have documented some of the solutions on the website: https://cert-manager.io/docs/concepts/webhook/#known-problems-and-solutions .

I’m going to close this issue because it’s becoming a catch-all for this error message, but if you are sure you have a unique issue feel free to open another.

Also @inteon found out my issue is with flanneld running on vxlan mode. For my environment switching to host-gw solved my issues. I’ve also create this issue on flannel repo: https://github.com/flannel-io/flannel/issues/1511

@inteon I’m running Debian 11 with flannel 1.15.1 This is a bare metal system. No network policies whatsoever.

So I did two things: first added the label cert-manager.io/disable-validation: “true” to cert-manager namespace and deleted the webhook with: kubectl delete validatingwebhookconfigurations/cert-manager-webhook with those my certificate is issued with no side effects (for now).