# A ClusterIssuer for DNS-01 references a Secret holding DNS provider credentials. In which namespace does cert-manager look for that Secret?

cert-manager, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-clusterissuer-for-dns-01-references-a-secret-holding-dns-provider-credentials-in-which-namespace-does-cert-manager-look-for-th

- A. The namespace of the Certificate that is being issued
- B. The cluster resource namespace, cert-manager's own by default
- C. kube-system, where cluster-scoped Secrets are kept
- D. Any namespace, since ClusterIssuers search all of them

**Answer:** The cluster resource namespace, cert-manager's own by default

**Explanation:** ClusterIssuers are cluster-scoped but Secrets aren't, so cert-manager reads ClusterIssuer Secrets from the namespace set by its --cluster-resource-namespace flag. That defaults to cert-manager's own namespace. Putting the Secret next to the Certificate is a common mistake, and the issuer then reports that it can't find the Secret.