Azure Kubernetes Service
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
2,447 questions
Setup cert-manager in AKS cluster
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 22%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHP%3C/text%3E%3C/svg%3E)
Hari Prasad
0
Reputation points
I am trying to setup the cert-manager latest version using helm on my AKS cluster.
Deployment fails with this error:
Error: INSTALLATION FAILED: failed post-install: 1 error occurred:
* timed out waiting for the condition
Cert manager pod log error:
E1011 15:01:25.825828 1 leaderelection.go:436] error retrieving resource lock /cert-manager-controller: Get "https://<aks_api_service_ip>:443/apis/coordination.k8s.io/v1/leases/cert-manager-controller": EOF
I found the similar error with below config as well.
leaderElection:
# Override the namespace used for the leader election lease.
namespace: "kube-system"
Azure Kubernetes Service
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2024-10-14T04:39:44.5666667+00:00 Hi Hari Prasad,
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.
It looks like the issue is due to cert-manager being unable to connect to the Kubernetes API server, as indicated by the EOF error. This could be caused by network policies, API server connectivity or misconfigured RBAC roles.
To resolve:
Check that there are no network policies blocking the cert-manager pod from accessing the API server.
Ensure that the correct namespace is being used for leader election (e.g., cert-manager or kube-system), and verify RBAC roles and permissions are correctly applied.
Test API server connectivity from the cert-manager pod using curl https://<aks_api_service_ip>:443.
Increase timeout settings if needed when using Helm.
For more details, please refer to the documentation: Use TLS with an ingress controller on Azure Kubernetes Service (AKS).
If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".
-
Anonymous
2024-10-15T03:19:05.06+00:00 Hi Hari Prasad,
Just checking in to see if you had a chance to review my comment on your question. Please let us know if it was helpful and feel free to reach out if you have any further queries.
If you found the information useful, please click "Upvote" on the post to let us know.
Thank You.
-
Anonymous
2024-10-16T01:05:01.4566667+00:00 Hi Hari Prasad,
I wanted to check if you had the opportunity to review the information which was provided in my previous posted comment.
If it was helpful, please click "Upvote" on his post to let us know.
Thank You.
-
Hari Prasad 0 Reputation points
2024-10-22T04:07:12.38+00:00 - Curl is giving timeout error.
- There are no network policies to either namespace level or in pod level.
- Leader election used is cert-manager namespace.
We have firewall configured, I don't see any specific logs in firewall apart from Action: Deny. Reason: SNI TLS extension was missing.
-
Anonymous
2024-10-22T08:49:51.1633333+00:00 Hi Hari Prasad,
The timeout issue is likely due to the firewall blocking traffic because the Server Name Indication (SNI) TLS extension is missing. You can try by ensuring that
curlexplicitly includes the SNI. Use the following command to force SNI inclusion:curl --resolve <hostname>:443:<aks_api_service_ip> https://<hostname>Additionally, review the firewall configuration to ensure it allows traffic to the AKS API server and that port 443 is open. If you're using Azure CNI, ensure NSGs allow communication between the cert-manager pod and the API server.
Refer to the below documentation for more details:
Network security groups in Azure Kubernetes Service (AKS).
If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".
Sign in to comment
Sign in to answer