Wilcard certificate is ignored

[roosnic1]

I'm having trouble using a wildcard certificate with my feature deployments. I've been trying to get this to work now for the last 4 hours and I'm out of ideas. I have the following Kubernetes objects:

Issuer:

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: wepublish-dev-prod-issuer
  namespace: wepublish-dev
spec:
  acme:
    email: mail-to-me@blabla.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: private-key
    solvers:
    - selector:
        dnsZones:
          - "cclusterwildcardcertificate.wepublish.dev"
      dns01:
        cloudDNS:
          project: project-id
          serviceAccountSecretRef:
            name: service-account-name
            key: key.json

Wildcard Certificate:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: development-wepublish-wildcard
  namespace: wepublish-dev
spec:
  secretName: development-wepublish-wildcard-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  subject:
    organizations:
      - wepublish
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - server auth
    - client auth
  dnsNames:
    - "*.cclusterwildcardcertificate.wepublish.dev"
  issuerRef:
    name: wepublish-dev-prod-issuer
    kind: Issuer

Ingress:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/acme-challenge-type: dns01
    cert-manager.io/acme-dns01-provider: cloudDNS
    cert-manager.io/issuer: wepublish-dev-prod-issuer
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-body-size: 10m
    nginx.ingress.kubernetes.io/proxy-read-timeout: "30"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  labels:
    app: api
    release: development
    slug: cclusterwildcardcertificate
  name: cclusterwildcardcertificate-api-development
  namespace: wepublish-dev
spec:
  rules:
  - host: api.cclusterwildcardcertificate.wepublish.dev
    http:
      paths:
      - backend:
          serviceName: cclusterwildcardcertificate-api-development
          servicePort: 8000
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - api.cclusterwildcardcertificate.wepublish.dev
    secretName: development-wepublish-wildcard-tls

But every time i apply the ingress i get the following log message in the cert-manager logs:

2021-10-05T19:15:55.628743740Z
cert-manager/controller/certificates-trigger "msg"="Certificate must be re-issued" "key"="wepublish-dev/development-wepublish-wildcard-tls" "message"="Existing issued Secret is not up to date for spec: [spec.commonName spec.dnsNames]" "reason"="SecretMismatch"

It then creates a new certificate and uses that. Any idea what I'm doing wrong? Ayn help is much appreciated.

[maelvls]

It seems like you are using both the "Ingress shim" (which creates a Certificate with secretName development-wepublish-wildcard-tls) as well as a standalone Certificate with the secretName development-wepublish-wildcard-tls.

cert-manager tries to reconcile two Certificates for the same secretName; one symptom of this is the SecretMismatch error.

You may want to remove the line

    cert-manager.io/issuer: wepublish-dev-prod-issuer

from your Ingress. That will prevent cert-manager from creating a Certificate.

[roosnic1]

Oh thank you so much. Removed the line and everything worked like it should be. You saved me countless more hours of debugging 🙏🏾 .