<p>The problem is you are trying to handle the certificate twice using the annotation <code>cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer</code> on both ingresses. Let the Certificate have its own lifecycle and link just the secret to the ingresses.</p>
<p>Apply the Certificate manifest first (with no existing ingresses):</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - '*.example.com'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  secretName: wildcard-cert
</code></pre>
<p>Create the two ingresses, without mentioning the cluster-issuer, but just including the secret:</p>
<pre class="lang-yaml prettyprint-override"><code>ingress:
  enabled: true
  ingressClassName: nginx
  hostname: app-dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - app-dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
    #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
</code></pre>
<p>and then:</p>
<pre class="lang-yaml prettyprint-override"><code>ingress:
  enabled: true
  ingressClassName: nginx
  hostname: dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
    #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
</code></pre>

CC BY-SA 4.0
2024-11-24T10:58:07.717Z
2024-11-24T10:58:07.717Z
brutz
<p>I have this issue with one particular domain.</p>
<p>I have a setup in AWS where I deploy apps in EKS via helm-charts (ArgoCD) and if the helm chart has ingress defined ... it registers the domain in Route53 and maps it to that pod ...</p>
<p>It works great for all my pods even for a multidomain pod .. but it doesn't for one (not sure why - everything is exactly the same as for the others which work fine)</p>
<p>here is my wildcard-cert.yaml</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - '*.example.com'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  secretName: wildcard-cert
</code></pre>
<p>Here is values.dev.yaml for the working app:</p>
<pre class="lang-yaml prettyprint-override"><code>ingress:
  enabled: true
  ingressClassName: nginx
  hostname: app-dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - app-dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
</code></pre>
<p>Here is the one which doesn't trigger the certificate manager (I even tried diff subdomains thinking that &quot;dev&quot; might be an exception so I tried www-dev as well; didn't work):</p>
<pre class="lang-yaml prettyprint-override"><code>ingress:
  enabled: true
  ingressClassName: nginx
  hostname: dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: &quot;false&quot;
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
</code></pre>
<p>There are no error events(logs) as far as I can see ....</p>
<p>The app starts fine, just does not trigger the cert manager and thus does not create R53 record ...</p>
<p>If I create the record manually - it works and redirects to the app/pod (but the catch is -&gt; it's not a trustworthy for there is no let's encrypt cert) - anyway I still need it to work through the pipeline ... not having the need to manually manage the domains ...</p>
<p>ArgoCd's app (not triggering the cert manager):
<a href="https://i.sstatic.net/BOHe5GOz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/BOHe5GOz.png" alt="enter image description here" /></a></p>
<p>ArgoCd's app (triggering the cert correctly):
<a href="https://i.sstatic.net/eASp7T2v.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/eASp7T2v.png" alt="enter image description here" /></a></p>
<p>I even tried to delete and re-create the app again .. not luck tho</p>

<kubernetes><helm><eks><cert-manager><argocd>
cert-manager and cluster issuer - not registering subdomain
Mr.P
# cert-manager and cluster issuer - not registering subdomain

(Asked by: username_0 on 2024-09-24)

I have this issue with one particular domain.
I have a setup in AWS where I deploy apps in EKS via helm-charts (ArgoCD) and if the helm chart has ingress defined ... it registers the domain in Route53 and maps it to that pod ...
It works great for all my pods even for a multidomain pod .. but it doesn't for one (not sure why - everything is exactly the same as for the others which work fine)
here is my wildcard-cert.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - '*.example.com'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  secretName: wildcard-cert

Here is values.dev.yaml for the working app:
ingress:
  enabled: true
  ingressClassName: nginx
  hostname: app-dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - app-dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer

Here is the one which doesn't trigger the certificate manager (I even tried diff subdomains thinking that "dev" might be an exception so I tried www-dev as well; didn't work):
ingress:
  enabled: true
  ingressClassName: nginx
  hostname: dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer

There are no error events(logs) as far as I can see ....
The app starts fine, just does not trigger the cert manager and thus does not create R53 record ...
If I create the record manually - it works and redirects to the app/pod (but the catch is -> it's not a trustworthy for there is no let's encrypt cert) - anyway I still need it to work through the pipeline ... not having the need to manually manage the domains ...
ArgoCd's app (not triggering the cert manager):

ArgoCd's app (triggering the cert correctly):

I even tried to delete and re-create the app again .. not luck tho

**Tags:** kubernetes, helm, eks, cert-manager, argocd


---

## 1 answers

### Answer by username_1 on 2024-11-24. Score: 0

The problem is you are trying to handle the certificate twice using the annotation cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer on both ingresses. Let the Certificate have its own lifecycle and link just the secret to the ingresses.
Apply the Certificate manifest first (with no existing ingresses):
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
spec:
  dnsNames:
  - '*.example.com'
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  secretName: wildcard-cert

Create the two ingresses, without mentioning the cluster-issuer, but just including the secret:
ingress:
  enabled: true
  ingressClassName: nginx
  hostname: app-dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - app-dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer

and then:
ingress:
  enabled: true
  ingressClassName: nginx
  hostname: dev.example.com
  tls:
    - secretName: wildcard-cert
      hosts:
        - dev.example.com
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
    nginx.ingress.kubernetes.io/server-tokens: "false"
    #cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer


---

