cert-manager is creating new ingress with acme responder instead of modifying the existing

Question

I'm trying to use cert-manager to issue a certificate via LetsEncrypt.

I've followed through with the steps here http://docs.cert-manager.io/en/latest/getting-started/index.html

However, my existing ingress is not being modified (I assume it needs to modify it due to adding a path for .well-known/....

Instead I see an ingress created for this with a name like: cm-acme-http-solver-kgpz6? Which is rather confusing?

If I get the yaml for that ingress I see the following for rules:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: cm-acme-http-solver-2dd97
          servicePort: 8089
        path: /.well-known/acme-challenge/2T2D_XK1-zIJJ9_f2ANlwR-AcNTm3-WenOExNpmUytY

How exactly is this meant to work? As the documentation seems rather sparse.

is this all the steps? have you created secret? – aurelius Dec 12 '18 at 12:08 — aurelius, Dec 12 '18 at 12:08
@Chris could you update the question? – 030 Dec 23 '18 at 19:13 — 030, Dec 23 '18 at 19:13

score 7 · Answer 1 · answered Jan 15 '19 at 23:09

The record you are seeing is for the challenge. It needs to succeed to configure the cert. If you are using "example.com" as the domain then it will not succeed. To get this to work you'll need to configure a DNS record for a valid hostname so that LetsEncrypt can resolve the domain and complete the check.

Usually you will not even see the challenge ingress resource. It usually runs the challenge and then removes itself as long as DNS and the hostname have been configured correctly. After it is removed the resource you created will get loaded into your ingress controller.

There are a few ingress controllers that do not support multiple ingress resources per hostname. They will load one ingress resource and ignore the other, so this is sort of a workaround/fix to the issue.

cert-manager is creating new ingress with acme responder instead of modifying the existing

1 Answers1