Kubernetes cert-manager no certificate found on AWS ALB ingress

Question

It's been a while and I cant get it to work. Basically I have a K8s Cluster on AWS EKS, ExternalDNS is set and works and now I'm trying to add TLS/SSL certificates with cert-manager.

Those are my configs:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: my-email
    privateKeySecretRef:
      name: letsencrypt-cluster-issuer-key
    solvers:
      - selector:
          dnsZones:
            - "example.it"
            - "*.example.it"
        dns01:
          route53:
            region: eu-central-1
            hostedZoneID: HOSTEDZONEID
            accessKeyID: ACCESSKEYID
            secretAccessKeySecretRef:
              name: route53-secret
              key: secretkey
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  commonName: "*.example.it"
  dnsNames:
    - "*.example.it"

ExternalDNS:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: external-dns
  labels:
    app.kubernetes.io/name: external-dns
rules:
  - apiGroups: [""]
    resources: ["services", "endpoints", "pods", "nodes"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: external-dns-viewer
  labels:
    app.kubernetes.io/name: external-dns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns
subjects:
  - kind: ServiceAccount
    name: external-dns
    namespace: externaldns # change to desired namespace: externaldns, kube-addons
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns
  labels:
    app.kubernetes.io/name: external-dns
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: external-dns
  template:
    metadata:
      labels:
        app.kubernetes.io/name: external-dns
    spec:
      serviceAccountName: external-dns
      containers:
        - name: external-dns
          image: k8s.gcr.io/external-dns/external-dns:v0.11.0
          args:
            - --source=service
            - --source=ingress
            - --domain-filter=example.it # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
            - --provider=aws
            - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
            - --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
            - --registry=txt
            - --txt-owner-id=external-dns
          env:
            - name: AWS_DEFAULT_REGION
              value: eu-central-1 # change to region where EKS is installed

Cert-manager is deployed in the cert-manager namespace, while ExternalDNS is in its externaldns namespace. AWS ALB is in kube-system.

Finally, my ingress deployed in default ns:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: master
  namespace: default
  labels:
    name: master
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/backend-protocol: HTTP
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
    alb.ingress.kubernetes.io/group.name: "alta"
    alb.ingress.kubernetes.io/group.order: "0"
    alb.ingress.kubernetes.io/ssl-redirect: "443"
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
spec:
  ingressClassName: alb
  tls:
    - hosts:
        - "example.it"
      secretName: "tls-secret"
  rules:
    - host: example.it
      http:
        paths:
          - pathType: Prefix
            path: /
            backend:
              service:
                name: echoserver # random test service, returns some page w/some info
                port:
                  number: 80

With all this config, i still get "no certificate found for host: example.it" in my ingress. Certificate is being issued and all looks ok. Do you have an idea? I'm going insane over this.

Answer 1

Posting this in case someone encounters the same problem.

Basically AWS ALB does not support cert-manager, you have to go to AWS ACM, get yourself a certificate there and then add it through the certificate-arn annotation on your ingress. Then everything should start working. Thx reddit for this.