cert-manager and cluster issuer - not registering subdomain

Question

I have this issue with one particular domain.

I have a setup in AWS where I deploy apps in EKS via helm-charts (ArgoCD) and if the helm chart has ingress defined ... it registers the domain in Route53 and maps it to that pod ...

It works great for all my pods even for a multidomain pod .. but it doesn't for one (not sure why - everything is exactly the same as for the others which work fine)

here is my wildcard-cert.yaml

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - '*.example.com'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  secretName: wildcard-cert

Here is values.dev.yaml for the working app:

ingress:
  enabled: true
  ingressClassName: nginx
  hostname: app-dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - app-dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer

Here is the one which doesn't trigger the certificate manager (I even tried diff subdomains thinking that "dev" might be an exception so I tried www-dev as well; didn't work):

ingress:
  enabled: true
  ingressClassName: nginx
  hostname: dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer

There are no error events(logs) as far as I can see ....

The app starts fine, just does not trigger the cert manager and thus does not create R53 record ...

If I create the record manually - it works and redirects to the app/pod (but the catch is -> it's not a trustworthy for there is no let's encrypt cert) - anyway I still need it to work through the pipeline ... not having the need to manually manage the domains ...

ArgoCd's app (not triggering the cert manager):

ArgoCd's app (triggering the cert correctly):

I even tried to delete and re-create the app again .. not luck tho

Answer 1

The problem is you are trying to handle the certificate twice using the annotation cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer on both ingresses. Let the Certificate have its own lifecycle and link just the secret to the ingresses.

Apply the Certificate manifest first (with no existing ingresses):

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - '*.example.com'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  secretName: wildcard-cert

Create the two ingresses, without mentioning the cluster-issuer, but just including the secret:

ingress:
  enabled: true
  ingressClassName: nginx
  hostname: app-dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - app-dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer

and then:

ingress:
  enabled: true
  ingressClassName: nginx
  hostname: dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer