This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 22%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
I created a Service "A", in my AKS, and then created an Ingress. When prompted I created the Key vaults and SSL Certificates. After completing the setup, when I check the Ingress Event, I get a warning of MountVolume.Setup Failed, with reason "Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time". Also when I click on the Public Ip address of the Ingress, it shows Not found error. Please help in solving this.
After multiple failed attempts I tried to follow the steps mentioned at https://github.com/MicrosoftDocs/azure-docs/blob/90f41730b9836e89d3e53b44707109c32b5e52d0/articles/aks/ingress-tls.md. All steps worked expect for the Certificate status step "kubectl get certificate" which shows the state as False. And again when I hit the IP address, nothing comes.
Can you describe the certificate ?>>kubectl describe certificate <certificate-name>also need Event
kubectl get events -A
https://cert-manager.io/docs/troubleshooting/
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 74%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAN%3C/text%3E%3C/svg%3E)
Hello Praveen Maniyan, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
This is still not resolved. When I check describe the certificate and describe the Challenge, it shows Timeout error, saying unable to ping http://subdomain.mysite.com/.well-known, most likely firewall problem.
Hello Praveen Maniyan,
thankyou for replying back
Check if the DNS record for the subdomain is correctly configured and resolving to the correct IP address. You can use the nslookup command to check the DNS resolution.
Check if the firewall is blocking the HTTP traffic to the subdomain.
You can try accessing the URL http://subdomain.mysite.com/.well-known from a browser or using the curl command to see if the traffic is blocked.
If the traffic is blocked, you may need to configure the firewall to allow HTTP traffic to the subdomain.
Check if the Ingress resource is correctly configured. Make sure that the host field in the Ingress resource matches the subdomain name and that the tls section is correctly configured with the certificate name and secret.
Check if the cert-manager pod is running correctly. You can check the logs of the cert-manager pod to see if there are any errors or issues with the certificate issuance process.
Check if the certificate issuer is correctly configured.
Hope this helps you
Hello Praveen Maniyan, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Hi Anveshreddy, thanks for the instructions. I figure out the issue and resolved it. Somehow the documentation is not that clear. I have updated the answer below. Thanks once again.
Had to follow the following steps to get this resolved. First do all the steps from https://learn.microsoft.com/en-us/azure/aks/ingress-basic?tabs=azure-cli. Then follow the steps at https://learn.microsoft.com/en-us/azure/aks/ingress-tls?tabs=azure-cli. For troubleshooting certificate manager issues, refer https://cert-manager.io/docs/troubleshooting/acme/.
If there are some issues with Cert Manager, delete it and reinstall in again.
Hello Praveen Maniyan, Thankyou for posting the answer here.