About this scenario
The platform team runs an internal CA with cert-manager. The public Gateway in infra has an HTTPS listener for shop.internal.example that reads its certificate from the Secret shop-tls. That Secret doesn't exist, because the Certificate that should create it has never become Ready.
Follow the chain cert-manager builds: Certificate, CertificateRequest, issuer. Three things are wrong along it. The last one only shows when you make the HTTPS request.
The CA bootstrap manifests are in the editor as ca.yaml. When everything works, call the shop with curl --cacert, never with -k.
Objectives
- Trace the Certificate to the reason it isn't issued
- ClusterIssuer internal-ca is Ready
- Certificate shop-tls is Ready, signed by internal-ca
- The certificate is valid for shop.internal.example
- Call the shop over HTTPS, trusting the internal CA
What you'll practice
- cert-manager works through a chain: a Certificate creates a CertificateRequest, and the issuer signs it. The Certificate's status stays vague; the CertificateRequest and the issuer carry the real message.
issuerRef.kind defaults to Issuer. Naming a ClusterIssuer without the kind looks for a namespaced Issuer that doesn't exist.- A ClusterIssuer has no namespace, so it reads Secrets from the cluster resource namespace, which is
cert-manager unless the controller was started with another one. - The usual private CA setup is a self-signed ClusterIssuer, a CA Certificate with
isCA: true, and a CA issuer that points at that Certificate's Secret. - A Ready certificate can still be for the wrong name. Clients check the SANs against the host they call, and a private CA has to be handed to them, here from
ca.crt in the Secret.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Helm, Flux, Argo CD, Kyverno, Cilium, Istio) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.