I am using cert-manager with my EKS cluster to generate Lets Encrypt certificates for my ALB. While the certificate is generated just fine, the Ingress cannot find it and fails to start the ALB with the error
Failed build model due to ingress: prod/prod-ingress: no certificate found for host: *.domain.com
Here is the certificate
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: letsencrypt-staging
namespace: prod
spec:
secretName: letsencrypt-staging
renewBefore: 240h
dnsNames:
- "*.domain.com"
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer
And this is created just fine as I mentioned earlier
k get certificate -n prod
NAME READY SECRET AGE
letsencrypt-staging True letsencrypt-staging 27m
Here is the ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: prod-ingress
namespace: prod
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/subnets: subnet-ef84a5b6,subnet-a3177fc6
cert-manager.io/cluster-issuer: letsencrypt-staging
spec:
tls:
- hosts:
- "*.domain.com"
secretName: letsencrypt-staging
rules:
- host: portal.domain.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web-server-svc
port:
number: 80
which fails with the following error
Name: prod-ingress
Labels: <none>
Namespace: prod
Address:
Default backend: default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
letsencrypt-staging terminates *.domain.com
Rules:
Host Path Backends
---- ---- --------
portal.domain.com
/ web-server-svc:80 (XXXX:80)
Annotations: alb.ingress.kubernetes.io/listen-ports: [{"HTTP": 80}, {"HTTPS":443}]
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/subnets: subnet-ef84a5b6,subnet-a3177fc6
alb.ingress.kubernetes.io/target-type: ip
cert-manager.io/cluster-issuer: letsencrypt-staging
kubernetes.io/ingress.class: alb
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning FailedBuildModel 3s (x13 over 23s) ingress Failed build model due to ingress: prod/prod-ingress: no certificate found for host: *.domain.com
Why is the ingress unable to find the certificate, yet they are both in the same namespace?