0

I am using cert-manager with my EKS cluster to generate Lets Encrypt certificates for my ALB. While the certificate is generated just fine, the Ingress cannot find it and fails to start the ALB with the error

Failed build model due to ingress: prod/prod-ingress: no certificate found for host: *.domain.com

Here is the certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: letsencrypt-staging
  namespace: prod
spec:
  secretName: letsencrypt-staging
  renewBefore: 240h
  dnsNames:
    - "*.domain.com"
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer

And this is created just fine as I mentioned earlier

k get certificate -n prod
NAME                  READY   SECRET                AGE
letsencrypt-staging   True    letsencrypt-staging   27m

Here is the ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: prod-ingress
  namespace: prod
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/listen-ports:  '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/subnets: subnet-ef84a5b6,subnet-a3177fc6 
    cert-manager.io/cluster-issuer: letsencrypt-staging
spec:
  tls:
    - hosts:
        - "*.domain.com"
      secretName: letsencrypt-staging
  rules:
    - host: portal.domain.com
      http: 
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-server-svc
                port:
                  number: 80

which fails with the following error

Name:             prod-ingress
Labels:           <none>
Namespace:        prod
Address:          
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
  letsencrypt-staging terminates *.domain.com
Rules:
  Host                    Path  Backends
  ----                    ----  --------
  portal.domain.com  
                          /   web-server-svc:80 (XXXX:80)
  
Annotations:              alb.ingress.kubernetes.io/listen-ports: [{"HTTP": 80}, {"HTTPS":443}]
                          alb.ingress.kubernetes.io/scheme: internet-facing
                          alb.ingress.kubernetes.io/subnets: subnet-ef84a5b6,subnet-a3177fc6
                          alb.ingress.kubernetes.io/target-type: ip
                          cert-manager.io/cluster-issuer: letsencrypt-staging
                          kubernetes.io/ingress.class: alb
Events:
  Type     Reason            Age                From     Message
  ----     ------            ----               ----     -------
  Warning  FailedBuildModel  3s (x13 over 23s)  ingress  Failed build model due to ingress: prod/prod-ingress: no certificate found for host: *.domain.com

Why is the ingress unable to find the certificate, yet they are both in the same namespace?

1 Answer 1

0

Alb only supports ACM certificates. You need to upload certificate to ACM or you can create certs with AWS

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .