cert-manager
Hard
Troubleshooting
A ClusterIssuer for DNS-01 references a Secret holding DNS provider credentials. In which namespace does cert-manager look for that Secret?
Select your answer:
Show answer and explanation
Answer: The cluster resource namespace, cert-manager's own by default
Explanation
ClusterIssuers are cluster-scoped but Secrets aren't, so cert-manager reads ClusterIssuer Secrets from the namespace set by its --cluster-resource-namespace flag. That defaults to cert-manager's own namespace. Putting the Secret next to the Certificate is a common mistake, and the issuer then reports that it can't find the Secret.
More hard cert-manager questions
- How do you get cert-manager to create and manage a Certificate for an Ingress automatically?
- What does privateKey.rotationPolicy: Always do on a Certificate?
- How do you make cert-manager reissue a certificate right away, before it is due for renewal?
- What does the Secret named in an ACME issuer's privateKeySecretRef contain?
- Let's Encrypt fails HTTP-01 validation for app.example.com. Which URL must be reachable from the internet?
- A Certificate fails to issue several times in a row, for example because the issuer is misconfigured. How does cert-manager retry?