Kubernetes Nginx Ingress could not load custom certificate from cert-manager

Rodrigo

9/26/23, 1:31 PM

I am using cert-manager with this custom wildcard certificate

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-myapp-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected] # CHANGE-ME
    privateKeySecretRef:
      name: wildcard-myapp-com
    solvers:
      # ACME DNS-01 provider configurations
      - dns01:
          cloudDNS:
            serviceAccountSecretRef:
              name: clouddns-service-account
              key: dns-service-account.json
            project: myapp
        selector:
          dnsNames:
            - '*.myapp.com'
            - myapp.com
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-com-tls
  namespace: default
spec:
  secretName: myapp-com-tls
  issuerRef:
    name: letsencrypt-myapp-issuer
  commonName: '*.myapp.com'
  dnsNames:
    - '*.myapp.com'
    - myapp.com

I am deploying Nginx ingress with kustomize

spec:
  template:
    spec:
      containers:
      - name: controller
        args:
        - /nginx-ingress-controller
        - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
        - --election-id=ingress-controller-leader
        - --controller-class=k8s.io/ingress-nginx
        - --ingress-class=nginx
        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        - --default-ssl-certificate=default/myapp-com-tls # NOTE THIS LINE

When I open the logs of the ingress controller, I could see this error

Error loading custom default certificate, falling back to generate ││ local SSL certificate default/myapp-com-tls was not found

What I can do to troubleshoot this?

UPDATE

If I run

kubectl get secret myapp-com-tls --namespace default

It returns nothing. However, if I run

kubectl get secret myapp.com-tls-qpmpr --namespace default

It returns

NAME                      TYPE     DATA   AGE
myapp.com-tls-qpmpr   Opaque   1      47m

However, if I change to this on YAML, I get the same error

--default-ssl-certificate=default/myapp.com-tls-qpmpr

$ kubectl describe certificates myapp-com-tls -n cert-manager
Error from server (NotFound): certificates.cert-manager.io "myapp-com-tls" not found

0 + 0

nginx-ingress

cert-manager

mdaniel

9/26/23, 7:16 PM

(a) did you actually look at `kubectl -n default get secret` to ensure it was there? (b) be aware that cert-manager takes non-zero time to resolve the LE request loop, so you could be facing a race condition

Rodrigo

9/26/23, 7:22 PM

I updated my question. Could you please check again?

mdaniel

9/27/23, 3:39 PM

That Secret having only 1 datum smells suspicious, did you check to see what's in it? The TLS ones usually have a key and a cert

Rodrigo

9/27/23, 4:23 PM

There only the `key` in the secret, the cert is missing

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Kubernetes Nginx Ingress could not load custom certificate from cert-manager

TH: Kubernetes Nginx Ingress ไม่สามารถโหลดใบรับรองที่กำหนดเองจาก cert-manager

RO: Kubernetes Nginx Ingress nu a putut încărca certificatul personalizat de la cert-manager

RU: Kubernetes Nginx Ingress не удалось загрузить собственный сертификат из диспетчера сертификатов

VI: Kubernetes Nginx Ingress không thể tải chứng chỉ tùy chỉnh từ trình quản lý chứng chỉ

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.