-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ClusterIssuer w/ Cloudflare DNS01 cannot find Secret #263
Comments
The default namespace for these cluster scoped supporting resources is |
I figured I was missing something, I thought the cluster-issuer was what needed direct access to the key so it was confusing me. Thanks a lot! |
@mikejk8s I think this issue should be opened because and either ClusterIssuer should be disallowed to be created in namespaces other than kube-system, or Certificate should read secrets from the same namespace it is in. Otherwise it creates much confusion. |
I'm seeing this failure case here, and am fairly new to k8s. How would I go about modifying the above config to ensure that the secret is created in the correct namespace? As of now, DO I add a namespace to the ClusterIssuer? Do I add a namespace to the DNS01 configuration like so?:
Or something else entirely? Thanks for the help. |
For everyone who arrives here looking for a solution to this particular problem, the above comment is right, Cloudflare API secret has to reside in kube-system namespace or namespace where cert-manager is running in. As per official docs:
Just found this out the hard way 👎 . |
Moved the secret to
Put the secret in |
Is this a BUG REPORT or FEATURE REQUEST?:
/kind bug
What happened:
I deployed via helm today and spent quite a bit of time trying to get ClusterIssuer working with Cloudflare DNS01 validation. Everything is being deployed to the default namespace. I'm going to ignore the portions installed by Helm as all I've done beyond that is add my API key, ClusterIssuer and Certificate.
When I try to generate a certificate using ClusterIssuer I get Secret Not Found errors;
When I convert my Certificate and ClusterIssuer to be an Issuer only (remove kind:ClusterIssuer from cert and switch kind to Issuer in Issuer.yaml) the Issuer can find the secret fine.
The only change at all is switching from ClusterIssuer to Issuer.
What you expected to happen:
ClusterIssuer should be able to reach Secret in the same namespace. Or let me know what I'm doing wrong, thanks!
How to reproduce it (as minimally and precisely as possible):
I've tried this multiple times before submitting ticket
Anything else we need to know?:
Environment:
kubectl version
): 1.86.0-GKEThe text was updated successfully, but these errors were encountered: