{"action":"created","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/867","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/867/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/867/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/867/events","html_url":"https://github.com/jetstack/cert-manager/issues/867","id":356836900,"node_id":"MDU6SXNzdWUzNTY4MzY5MDA=","number":867,"title":"Memory leak due to errors preparing issuer?","user":{"login":"sneko","id":8195958,"node_id":"MDQ6VXNlcjgxOTU5NTg=","avatar_url":"https://avatars2.githubusercontent.com/u/8195958?v=4","gravatar_id":"","url":"https://api.github.com/users/sneko","html_url":"https://github.com/sneko","followers_url":"https://api.github.com/users/sneko/followers","following_url":"https://api.github.com/users/sneko/following{/other_user}","gists_url":"https://api.github.com/users/sneko/gists{/gist_id}","starred_url":"https://api.github.com/users/sneko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sneko/subscriptions","organizations_url":"https://api.github.com/users/sneko/orgs","repos_url":"https://api.github.com/users/sneko/repos","events_url":"https://api.github.com/users/sneko/events{/privacy}","received_events_url":"https://api.github.com/users/sneko/received_events","type":"User","site_admin":false},"labels":[{"id":728658048,"node_id":"MDU6TGFiZWw3Mjg2NTgwNDg=","url":"https://api.github.com/repos/jetstack/cert-manager/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-04T14:29:37Z","updated_at":"2018-09-04T17:30:38Z","closed_at":null,"author_association":"NONE","body":"> Bugs should be filed for issues encountered whilst operating cert-manager.\r\n> You should first attempt to resolve your issues through the community support\r\n> channels, e.g. Slack, in order to rule out individual configuration errors.\r\n> Please provide as much detail as possible.\r\n\r\n**Describe the bug**:\r\n\r\nThe memory of my cert-manager keeps increasing.\r\n\r\nHere are some metrics for the last 3 days:\r\n\r\n![image](https://user-images.githubusercontent.com/8195958/45036616-44f2a580-b05d-11e8-80cc-81caefd907f2.png)\r\n\r\nAfter reaching this huge amount of memory, my node crashed. I had to restart it manually to get this Kubernetes node up again.\r\n\r\nThe cert-manager restarted on another node but it behaves the same:\r\n\r\n![image](https://user-images.githubusercontent.com/8195958/45037755-f8f53000-b05f-11e8-9890-11ee98cbef36.png)\r\n\r\nHere are the logs of my pod:\r\n```\r\nI0904 14:20:21.588632       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:21.707462       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:21.849391       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:22.005796       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:22.064825       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:22.064860       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:22.064869       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:22.064880       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:22.064913       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:22.161952       1 http.go:122] wrong status code '503'\r\nI0904 14:20:22.162364       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:22.162435       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:22.244120       1 http.go:122] wrong status code '503'\r\nI0904 14:20:22.244441       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:22.244493       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:22.328779       1 http.go:122] wrong status code '503'\r\nI0904 14:20:22.328962       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:22.329038       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:22.329031453 +0000 UTC m=+6516.631610469\r\nI0904 14:20:22.329058       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:22.329287       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:22.336879       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:24.333418       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:24.333944       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:24.333987       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:24.334489       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:24.464914       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:24.530238       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:24.607541       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:24.685351       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:24.685550       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:24.685586       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:24.685613       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:24.685673       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:24.847423       1 http.go:122] wrong status code '503'\r\nI0904 14:20:24.847798       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:24.847894       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:24.961174       1 http.go:122] wrong status code '503'\r\nI0904 14:20:24.961561       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:24.961632       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:25.060232       1 http.go:122] wrong status code '503'\r\nI0904 14:20:25.060869       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:25.061039       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:25.061030748 +0000 UTC m=+6519.363609791\r\nI0904 14:20:25.061105       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:25.062320       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:25.069589       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:27.063063       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:27.063426       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:27.063437       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:27.063831       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:27.385211       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:27.527308       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:27.657788       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:27.795382       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:27.795432       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:27.795442       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:27.795453       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:27.795492       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:27.953974       1 http.go:122] wrong status code '503'\r\nI0904 14:20:27.954426       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:27.954500       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:28.103816       1 http.go:122] wrong status code '503'\r\nI0904 14:20:28.103966       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:28.104014       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:28.244028       1 http.go:122] wrong status code '503'\r\nI0904 14:20:28.244390       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:28.244465       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:28.2444573 +0000 UTC m=+6522.547036360\r\nI0904 14:20:28.244642       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:28.244964       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:28.252416       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:32.246038       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:32.246410       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:32.246422       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:32.246992       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:32.687306       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:32.826651       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:32.962155       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:33.103278       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:33.104356       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:33.104405       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:33.104428       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:33.105229       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:33.275735       1 http.go:122] wrong status code '503'\r\nI0904 14:20:33.276561       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:33.276666       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:33.420348       1 http.go:122] wrong status code '503'\r\nI0904 14:20:33.420728       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:33.420782       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:33.570301       1 http.go:122] wrong status code '503'\r\nI0904 14:20:33.570760       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:33.585191       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:33.570853185 +0000 UTC m=+6527.873432234\r\nI0904 14:20:33.585322       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:33.585663       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:33.592809       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:35.588474       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:35.588758       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:35.588769       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:35.590674       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:35.740416       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:35.806298       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:35.867137       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:35.979015       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:35.979161       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:35.979184       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:35.979373       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:35.979447       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:36.092172       1 http.go:122] wrong status code '503'\r\nI0904 14:20:36.092654       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:36.092762       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:36.188083       1 http.go:122] wrong status code '503'\r\nI0904 14:20:36.188444       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:36.188730       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:36.288305       1 http.go:122] wrong status code '503'\r\nI0904 14:20:36.288639       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:36.288723       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:36.28871652 +0000 UTC m=+6530.591295565\r\nI0904 14:20:36.288811       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:36.289142       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:36.296798       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:38.289807       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:38.290311       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:38.290365       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:38.290790       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:38.433449       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:38.497932       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:38.550659       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:38.697369       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:38.697516       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:38.697543       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:38.697582       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:38.697614       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:38.778667       1 http.go:122] wrong status code '503'\r\nI0904 14:20:38.779022       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:38.779134       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:38.873987       1 http.go:122] wrong status code '503'\r\nI0904 14:20:38.874339       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:38.874428       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:38.961521       1 http.go:122] wrong status code '503'\r\nI0904 14:20:38.961676       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:38.961736       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:38.961729124 +0000 UTC m=+6533.264308165\r\nI0904 14:20:38.961755       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:38.961974       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:38.968527       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:40.962477       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:40.962790       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:40.962802       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:40.963483       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:41.105378       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:41.173440       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:41.290215       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:41.367061       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:41.368653       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:41.368929       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:41.368986       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:41.369043       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:41.475476       1 http.go:122] wrong status code '503'\r\nI0904 14:20:41.475861       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:41.475940       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:41.620760       1 http.go:122] wrong status code '503'\r\nI0904 14:20:41.623640       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:41.623817       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:41.712303       1 http.go:122] wrong status code '503'\r\nI0904 14:20:41.712672       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:41.712813       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:41.712781772 +0000 UTC m=+6536.015360797\r\nI0904 14:20:41.712851       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:41.713230       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:41.721309       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:43.725708       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:43.729555       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:43.729812       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:43.732330       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:43.874836       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:43.940693       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:44.002257       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:44.102529       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:44.102734       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:44.102779       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:44.102798       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:44.102847       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:44.246725       1 http.go:122] wrong status code '503'\r\nI0904 14:20:44.247064       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:44.247143       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:44.338133       1 http.go:122] wrong status code '503'\r\nI0904 14:20:44.338520       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:44.338596       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:44.434385       1 http.go:122] wrong status code '503'\r\nI0904 14:20:44.434722       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:44.434796       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:44.434791138 +0000 UTC m=+6538.737370188\r\nI0904 14:20:44.435003       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:44.435293       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:44.442649       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:46.443161       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:46.443475       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:46.443485       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:46.443817       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:46.597008       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:46.673153       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:46.751879       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:46.811771       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:46.811807       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:46.811828       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:46.811844       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:46.811866       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:46.918549       1 http.go:122] wrong status code '503'\r\nI0904 14:20:46.919157       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:46.919332       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:47.059199       1 http.go:122] wrong status code '503'\r\nI0904 14:20:47.059529       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:47.059599       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:47.148125       1 http.go:122] wrong status code '503'\r\nI0904 14:20:47.148493       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:47.148568       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:47.148561022 +0000 UTC m=+6541.451140061\r\nI0904 14:20:47.148618       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:47.148944       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:47.155702       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:49.149629       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:49.150166       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:49.150215       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:49.150656       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:49.297807       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:49.348745       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:49.403777       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:49.463228       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:49.463430       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:49.463468       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:49.463489       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:49.463545       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:49.614326       1 http.go:122] wrong status code '503'\r\nI0904 14:20:49.614549       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:49.614584       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:49.719200       1 http.go:122] wrong status code '503'\r\nI0904 14:20:49.719522       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:49.720128       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:49.800595       1 http.go:122] wrong status code '503'\r\nI0904 14:20:49.800988       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:49.801226       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:49.801217813 +0000 UTC m=+6544.103796863\r\nI0904 14:20:49.801370       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:49.802322       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:49.810084       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:51.844949       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:51.846402       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:51.846669       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:51.847261       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:51.978267       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:52.041896       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:52.107704       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:52.167734       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:52.167881       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:52.167921       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:52.167944       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:52.167975       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:52.341179       1 http.go:122] wrong status code '503'\r\nI0904 14:20:52.341523       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:52.341611       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:52.405779       1 http.go:122] wrong status code '503'\r\nI0904 14:20:52.406189       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:52.406271       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:52.493239       1 http.go:122] wrong status code '503'\r\nI0904 14:20:52.493394       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:52.493442       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:52.49343705 +0000 UTC m=+6546.796016075\r\nI0904 14:20:52.493461       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:52.493672       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:52.570510       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:54.563199       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:54.563655       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:54.563708       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:54.564176       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:54.691148       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:54.796293       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:54.853500       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:54.935590       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:54.935637       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:54.935647       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:54.935658       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:54.935699       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:55.038655       1 http.go:122] wrong status code '503'\r\nI0904 14:20:55.039284       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:55.039403       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:55.111299       1 http.go:122] wrong status code '503'\r\nI0904 14:20:55.111642       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:55.111731       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:55.186655       1 http.go:122] wrong status code '503'\r\nI0904 14:20:55.187115       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:55.187220       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:55.187202639 +0000 UTC m=+6549.489781654\r\nI0904 14:20:55.187283       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:55.187560       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:55.195153       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:57.188285       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:57.188798       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:57.188848       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:57.189383       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:57.311997       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:57.365929       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:57.443656       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:20:57.509841       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:57.509876       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:57.511375       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:20:57.511402       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:20:57.511442       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:57.612249       1 http.go:122] wrong status code '503'\r\nI0904 14:20:57.612616       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:57.612791       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:57.732497       1 http.go:122] wrong status code '503'\r\nI0904 14:20:57.732939       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:20:57.733151       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:57.803916       1 http.go:122] wrong status code '503'\r\nI0904 14:20:57.804322       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:20:57.804400       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:57.804393706 +0000 UTC m=+6552.106972756\r\nI0904 14:20:57.804482       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:57.804847       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:57.818065       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\nI0904 14:20:59.805609       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 14:20:59.806251       1 sync.go:280] Preparing certificate istio-system/bb-cert-prod with issuer\r\nI0904 14:20:59.806308       1 acme.go:169] getting private key (letsencrypt-prod-secret->tls.key) for acme issuer kube-system/letsencrypt-prod\r\nI0904 14:20:59.806838       1 logger.go:27] Calling GetOrder\r\nI0904 14:20:59.986574       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:21:00.083442       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:21:00.525384       1 logger.go:57] Calling GetAuthorization\r\nI0904 14:21:00.753527       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:21:00.753771       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:21:00.754145       1 logger.go:77] Calling HTTP01ChallengeResponse\r\nI0904 14:21:00.754272       1 prepare.go:263] Cleaning up old/expired challenges for Certificate istio-system/bb-cert-prod\r\nI0904 14:21:00.754332       1 logger.go:52] Calling GetChallenge\r\nI0904 14:21:01.056775       1 http.go:122] wrong status code '503'\r\nI0904 14:21:01.057163       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:21:01.057314       1 logger.go:52] Calling GetChallenge\r\nI0904 14:21:01.229461       1 http.go:122] wrong status code '503'\r\nI0904 14:21:01.229815       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=775816683,certmanager.k8s.io/acme-http-token=1156386423\r\nI0904 14:21:01.229904       1 logger.go:52] Calling GetChallenge\r\nI0904 14:21:01.319579       1 http.go:122] wrong status code '503'\r\nI0904 14:21:01.319910       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=815793686,certmanager.k8s.io/acme-http-token=1042681451\r\nI0904 14:21:01.319981       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:21:01.319974548 +0000 UTC m=+6555.622553590\r\nI0904 14:21:01.320029       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:21:01.320395       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:21:01.328388       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\n```\r\n\r\nIt seems there are important errors like:\r\n```\r\nI0904 14:20:57.612616       1 ingress.go:33] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=781780466,certmanager.k8s.io/acme-http-token=1094848317\r\nI0904 14:20:57.612791       1 logger.go:52] Calling GetChallenge\r\nI0904 14:20:57.732497       1 http.go:122] wrong status code '503'\r\n```\r\n\r\nand:\r\n```\r\nI0904 14:20:52.493442       1 helpers.go:188] Found status change for Certificate \"bb-cert-prod\" condition \"Ready\": \"False\" -> \"False\"; setting lastTransitionTime to 2018-09-04 14:20:52.49343705 +0000 UTC m=+6546.796016075\r\nI0904 14:20:52.493461       1 sync.go:282] Error preparing issuer for certificate istio-system/bb-cert-prod: [http-01 self check failed for domain \"app.my.domain\", http-01 self check failed for domain \"api.my.domain\", http-01 self check failed for domain \"www.my.domain\"]\r\nI0904 14:20:52.493672       1 sync.go:174] Certificate istio-system/bb-cert-prod scheduled for renewal in -410 hours\r\nI0904 14:20:52.570510       1 controller.go:195] certificates controller: Finished processing work item \"istio-system/bb-cert-prod\"\r\n```\r\n\r\n**Expected behaviour**:\r\n\r\nNormal memory consumption.\r\n\r\n**Steps to reproduce the bug**:\r\n\r\nNot sure for the moment what I could provide you...\r\n\r\nHere is the settings file I apply with kubectl:\r\n```\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: ClusterIssuer\r\nmetadata:\r\n  name: letsencrypt-staging\r\nspec:\r\n  acme:\r\n    # The ACME server URL\r\n    server: https://acme-staging-v02.api.letsencrypt.org/directory\r\n    # Email address used for ACME registration\r\n    email: email@email.com\r\n    # Name of a secret used to store the ACME account private key\r\n    privateKeySecretRef:\r\n      name: letsencrypt-staging-secret\r\n    # Enable the HTTP-01 challenge provider\r\n    http01: {}\r\n---\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: ClusterIssuer\r\nmetadata:\r\n  name: letsencrypt-prod\r\nspec:\r\n  acme:\r\n    # The ACME server URL\r\n    server: https://acme-v02.api.letsencrypt.org/directory\r\n    # Email address used for ACME registration\r\n    email: email@email.com\r\n    # Name of a secret used to store the ACME account private key\r\n    privateKeySecretRef:\r\n      name: letsencrypt-prod-secret\r\n    # Enable the HTTP-01 challenge provider\r\n    http01: {}\r\n---\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: Certificate\r\nmetadata:\r\n  name: bb-cert-prod\r\n  namespace: istio-system\r\nspec:\r\n  secretName: istio-ingress-certs\r\n  issuerRef:\r\n    kind: ClusterIssuer\r\n    name: letsencrypt-prod\r\n  commonName: www.my.domain\r\n  dnsNames:\r\n  - www.my.domain\r\n  - app.my.domain\r\n  - api.my.domain\r\n  acme:\r\n    config:\r\n    - http01:\r\n        # This class doesn't exist on purpose so we'll use the less specific\r\n        # istio ingress one because we need the auth off annotation on the svc\r\n        ingressClass: not-there\r\n      domains:\r\n      - www.my.domain\r\n      - app.my.domain\r\n      - api.my.domain\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  name: cert-manager-ingress1\r\n  namespace: istio-system\r\n  annotations:\r\n    auth.istio.io/8089: NONE\r\nspec:\r\n  ports:\r\n  - port: 8089\r\n    name: http-certingr\r\n  selector:\r\n    certmanager.k8s.io/domain: www.my.domain\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  name: cert-manager-ingress2\r\n  namespace: istio-system\r\n  annotations:\r\n    auth.istio.io/8089: NONE\r\nspec:\r\n  ports:\r\n  - port: 8089\r\n    name: http-certingr\r\n  selector:\r\n    certmanager.k8s.io/domain: app.my.domain\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  name: cert-manager-ingress3\r\n  namespace: istio-system\r\n  annotations:\r\n    auth.istio.io/8089: NONE\r\nspec:\r\n  ports:\r\n  - port: 8089\r\n    name: http-certingr\r\n  selector:\r\n    certmanager.k8s.io/domain: api.my.domain\r\n---\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  annotations:\r\n    kubernetes.io/ingress.class: istio\r\n    certmanager.k8s.io/acme-challenge-type: http01\r\n    certmanager.k8s.io/cluster-issuer: \"letsencrypt-prod\"\r\n  name: istio-ingress-certs-mgr\r\n  namespace: istio-system\r\nspec:\r\n  rules:\r\n  - http:\r\n      paths:\r\n        # cert-manager adds its own rules to the ingress but we need our\r\n        # rule because we have to selectively disable auth for the service\r\n        # and route to the service and not a nodeport\r\n      - path: /.well-known/acme-challenge/.*\r\n        backend:\r\n          serviceName: cert-manager-ingress1\r\n          servicePort: http-certingr\r\n    # Unfortunately host isn't an array and there are no \"*\" allowed for all\r\n    host: www.my.domain\r\n  - http:\r\n      paths:\r\n      - path: /.well-known/acme-challenge/.*\r\n        backend:\r\n          serviceName: cert-manager-ingress2\r\n          servicePort: http-certingr\r\n    host: app.my.domain\r\n  - http:\r\n      paths:\r\n      - path: /.well-known/acme-challenge/.*\r\n        backend:\r\n          serviceName: cert-manager-ingress3\r\n          servicePort: http-certingr\r\n    host: api.my.domain\r\n```\r\n\r\n**Anything else we need to know?**:\r\n\r\n**Environment details:**:\r\n- Kubernetes:\r\nClient Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.3\", GitCommit:\"2bba0127d85d5a46ab4b778548be28623b32d0b0\", GitTreeState:\"clean\", BuildDate:\"2018-05-21T09:17:39Z\", GoVersion:\"go1.9.3\r\n\", Compiler:\"gc\", Platform:\"windows/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.6\", GitCommit:\"9f8ebd171479bec0ada837d7ee641dec2f8c6dd1\", GitTreeState:\"clean\", BuildDate:\"2018-03-21T15:13:31Z\", GoVersion:\"go1.9.3\",\r\n Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n- Cloud-provider/provisioner: GCE\r\n- cert-manager v0.4.1\r\n- Install method: Helm\r\n\r\n/kind bug\r\n"},"comment":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/comments/418452934","html_url":"https://github.com/jetstack/cert-manager/issues/867#issuecomment-418452934","issue_url":"https://api.github.com/repos/jetstack/cert-manager/issues/867","id":418452934,"node_id":"MDEyOklzc3VlQ29tbWVudDQxODQ1MjkzNA==","user":{"login":"sneko","id":8195958,"node_id":"MDQ6VXNlcjgxOTU5NTg=","avatar_url":"https://avatars2.githubusercontent.com/u/8195958?v=4","gravatar_id":"","url":"https://api.github.com/users/sneko","html_url":"https://github.com/sneko","followers_url":"https://api.github.com/users/sneko/followers","following_url":"https://api.github.com/users/sneko/following{/other_user}","gists_url":"https://api.github.com/users/sneko/gists{/gist_id}","starred_url":"https://api.github.com/users/sneko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sneko/subscriptions","organizations_url":"https://api.github.com/users/sneko/orgs","repos_url":"https://api.github.com/users/sneko/repos","events_url":"https://api.github.com/users/sneko/events{/privacy}","received_events_url":"https://api.github.com/users/sneko/received_events","type":"User","site_admin":false},"created_at":"2018-09-04T17:30:38Z","updated_at":"2018-09-04T17:30:38Z","author_association":"NONE","body":"I decided to switch from HTTP01 to DNS01:\r\n\r\n```\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: ClusterIssuer\r\nmetadata:\r\n  name: letsencrypt-prod\r\nspec:\r\n  acme:\r\n    server: https://acme-v02.api.letsencrypt.org/directory\r\n    email: aaaaaaaa@aaaaaaaa.com\r\n    privateKeySecretRef:\r\n      name: letsencrypt-prod-secret\r\n    dns01:\r\n      providers:\r\n      - name: prod-clouddns\r\n        clouddns:\r\n          serviceAccountSecretRef:\r\n            name: prod-clouddns-svc-acct-secret\r\n            key: service-account.json\r\n```\r\n\r\nBut I get these errors:\r\n```\r\nI0904 17:27:24.479828       1 controller.go:181] certificates controller: syncing item 'istio-system/www-tls'\r\nI0904 17:27:24.479916       1 sync.go:89] Issuer letsencrypt-prod not ready\r\nE0904 17:27:24.479972       1 controller.go:190] certificates controller: Re-queuing item \"istio-system/www-tls\" due to error processing: Issuer letsencrypt-prod not ready\r\nI0904 17:27:45.163974       1 controller.go:181] certificates controller: syncing item 'istio-system/bb-cert-prod'\r\nI0904 17:27:45.164043       1 sync.go:89] Issuer letsencrypt-prod not ready\r\nE0904 17:27:45.164093       1 controller.go:190] certificates controller: Re-queuing item \"istio-system/bb-cert-prod\" due to error processing: Issuer letsencrypt-prod not ready\r\nI0904 17:28:24.453437       1 controller.go:181] certificates controller: syncing item 'istio-system/app-tls'\r\nI0904 17:28:24.453515       1 sync.go:89] Issuer letsencrypt-prod not ready\r\nE0904 17:28:24.453551       1 controller.go:190] certificates controller: Re-queuing item \"istio-system/app-tls\" due to error processing: Issuer letsencrypt-prod not ready\r\nI0904 17:28:24.456064       1 controller.go:181] certificates controller: syncing item 'istio-system/api-tls'\r\nI0904 17:28:24.456111       1 sync.go:89] Issuer letsencrypt-prod not ready\r\nE0904 17:28:24.456142       1 controller.go:190] certificates controller: Re-queuing item \"istio-system/api-tls\" due to error processing: Issuer letsencrypt-prod not ready\r\nI0904 17:28:24.480300       1 controller.go:181] certificates controller: syncing item 'istio-system/www-tls'\r\nI0904 17:28:24.480353       1 sync.go:89] Issuer letsencrypt-prod not ready\r\nE0904 17:28:24.480387       1 controller.go:190] certificates controller: Re-queuing item \"istio-system/www-tls\" due to error processing: Issuer letsencrypt-prod not ready\r\n```\r\n\r\nI don't understand why my ClusterIssuer is not ready...\r\n\r\nPS: Since I switched to DNS01 and that I don't have previous errors, the memory usage doesn't increase and it is stable around 15MB"}}
{"actor":{"display_login":"sneko"}}