Answers: <p>The problem is you are trying to handle the certificate twice using the annotation <code>cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer</code> on both ingresses. Let the Certificate have its own lifecycle and link just the secret to the ingresses.</p>
  <p>Apply the Certificate manifest first (with no existing ingresses):</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: wildcard-cert
  spec:
    dnsNames:
    - '*.example.com'
    issuerRef:
      kind: ClusterIssuer
      name: letsencrypt-cluster-issuer
    secretName: wildcard-cert
  </code></pre>
  <p>Create the two ingresses, without mentioning the cluster-issuer, but just including the secret:</p>
  <pre class="lang-yaml prettyprint-override"><code>ingress:
    enabled: true
    ingressClassName: nginx
    hostname: app-dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - app-dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
      #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  </code></pre>
  <p>and then:</p>
  <pre class="lang-yaml prettyprint-override"><code>ingress:
    enabled: true
    ingressClassName: nginx
    hostname: dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
      #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-11-24T10:58:07.717Z
Answers: 2024-11-24T10:58:07.717Z
Answers: brutz
Body: <p>I have this issue with one particular domain.</p>
  <p>I have a setup in AWS where I deploy apps in EKS via helm-charts (ArgoCD) and if the helm chart has ingress defined ... it registers the domain in Route53 and maps it to that pod ...</p>
  <p>It works great for all my pods even for a multidomain pod .. but it doesn't for one (not sure why - everything is exactly the same as for the others which work fine)</p>
  <p>here is my wildcard-cert.yaml</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: wildcard-cert
  spec:
    dnsNames:
    - '*.example.com'
    issuerRef:
      kind: ClusterIssuer
      name: letsencrypt-cluster-issuer
    secretName: wildcard-cert
  </code></pre>
  <p>Here is values.dev.yaml for the working app:</p>
  <pre class="lang-yaml prettyprint-override"><code>ingress:
    enabled: true
    ingressClassName: nginx
    hostname: app-dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - app-dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
      cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  </code></pre>
  <p>Here is the one which doesn't trigger the certificate manager (I even tried diff subdomains thinking that &quot;dev&quot; might be an exception so I tried www-dev as well; didn't work):</p>
  <pre class="lang-yaml prettyprint-override"><code>ingress:
    enabled: true
    ingressClassName: nginx
    hostname: dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
      cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  </code></pre>
  <p>There are no error events(logs) as far as I can see ....</p>
  <p>The app starts fine, just does not trigger the cert manager and thus does not create R53 record ...</p>
  <p>If I create the record manually - it works and redirects to the app/pod (but the catch is -&gt; it's not a trustworthy for there is no let's encrypt cert) - anyway I still need it to work through the pipeline ... not having the need to manually manage the domains ...</p>
  <p>ArgoCd's app (not triggering the cert manager):
  <a href="https://i.sstatic.net/BOHe5GOz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/BOHe5GOz.png" alt="enter image description here" /></a></p>
  <p>ArgoCd's app (triggering the cert correctly):
  <a href="https://i.sstatic.net/eASp7T2v.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/eASp7T2v.png" alt="enter image description here" /></a></p>
  <p>I even tried to delete and re-create the app again .. not luck tho</p>
  
Tags: <kubernetes><helm><eks><cert-manager><argocd>
Title: cert-manager and cluster issuer - not registering subdomain
UserDisplayName: Mr.P
ThreadText: # cert-manager and cluster issuer - not registering subdomain
  
  (Asked by: username_0 on 2024-09-24)
  
  I have this issue with one particular domain.
  
  I have a setup in AWS where I deploy apps in EKS via helm-charts (ArgoCD) and if the helm chart has ingress defined ... it registers the domain in Route53 and maps it to that pod ...
  
  It works great for all my pods even for a multidomain pod .. but it doesn't for one (not sure why - everything is exactly the same as for the others which work fine)
  
  here is my wildcard-cert.yaml
  
  ```yaml
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: wildcard-cert
  spec:
    dnsNames:
    - '*.example.com'
    issuerRef:
      kind: ClusterIssuer
      name: letsencrypt-cluster-issuer
    secretName: wildcard-cert
  
  ```
  
  Here is values.dev.yaml for the working app:
  
  ```yaml
  ingress:
    enabled: true
    ingressClassName: nginx
    hostname: app-dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - app-dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: "false"
      cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  
  ```
  
  Here is the one which doesn't trigger the certificate manager (I even tried diff subdomains thinking that "dev" might be an exception so I tried www-dev as well; didn't work):
  
  ```yaml
  ingress:
    enabled: true
    ingressClassName: nginx
    hostname: dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: "false"
      cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  
  ```
  
  There are no error events(logs) as far as I can see ....
  
  The app starts fine, just does not trigger the cert manager and thus does not create R53 record ...
  
  If I create the record manually - it works and redirects to the app/pod (but the catch is -> it's not a trustworthy for there is no let's encrypt cert) - anyway I still need it to work through the pipeline ... not having the need to manually manage the domains ...
  
  ArgoCd's app (not triggering the cert manager):
  [![enter image description here](https://i.sstatic.net/BOHe5GOz.png)](https://i.sstatic.net/BOHe5GOz.png)
  
  ArgoCd's app (triggering the cert correctly):
  [![enter image description here](https://i.sstatic.net/eASp7T2v.png)](https://i.sstatic.net/eASp7T2v.png)
  
  I even tried to delete and re-create the app again .. not luck tho
  
  **Tags:** kubernetes, helm, eks, cert-manager, argocd
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-11-24. Score: 0
  
  The problem is you are trying to handle the certificate twice using the annotation `cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer` on both ingresses. Let the Certificate have its own lifecycle and link just the secret to the ingresses.
  
  Apply the Certificate manifest first (with no existing ingresses):
  
  ```yaml
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: wildcard-cert
  spec:
    dnsNames:
    - '*.example.com'
    issuerRef:
      kind: ClusterIssuer
      name: letsencrypt-cluster-issuer
    secretName: wildcard-cert
  
  ```
  
  Create the two ingresses, without mentioning the cluster-issuer, but just including the secret:
  
  ```yaml
  ingress:
    enabled: true
    ingressClassName: nginx
    hostname: app-dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - app-dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: "false"
      #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  
  ```
  
  and then:
  
  ```yaml
  ingress:
    enabled: true
    ingressClassName: nginx
    hostname: dev.example.com
    tls:
      - secretName: wildcard-cert
        hosts:
          - dev.example.com
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 40m
      nginx.ingress.kubernetes.io/server-tokens: "false"
      #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
  
  ```
  
  
  ---
  
  