cert-manager
Hard
Architecture
When you create a Certificate that uses an ACME issuer, which chain of resources does cert-manager create?
Select your answer:
Show answer and explanation
Answer: Certificate → CertificateRequest → Order → Challenge
Explanation
The Certificate controller creates a CertificateRequest that holds the CSR. For ACME issuers, that request creates an Order with the ACME server, and the Order creates one Challenge per domain to prove. Running 'kubectl describe' on each step, or 'cmctl status certificate', shows where issuance is stuck.
More hard cert-manager questions
- A ClusterIssuer for DNS-01 references a Secret holding DNS provider credentials. In which namespace does cert-manager look for that Secret?
- How do you get cert-manager to create and manage a Certificate for an Ingress automatically?
- What does privateKey.rotationPolicy: Always do on a Certificate?
- How do you make cert-manager reissue a certificate right away, before it is due for renewal?
- What does the Secret named in an ACME issuer's privateKeySecretRef contain?
- Let's Encrypt fails HTTP-01 validation for app.example.com. Which URL must be reachable from the internet?