{"action":"created","issue":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/571","repository_url":"https://api.github.com/repos/jetstack/cert-manager","labels_url":"https://api.github.com/repos/jetstack/cert-manager/issues/571/labels{/name}","comments_url":"https://api.github.com/repos/jetstack/cert-manager/issues/571/comments","events_url":"https://api.github.com/repos/jetstack/cert-manager/issues/571/events","html_url":"https://github.com/jetstack/cert-manager/issues/571","id":324905348,"number":571,"title":"Unable to get wildcard cert working","user":{"login":"pms1969","id":2762128,"avatar_url":"https://avatars2.githubusercontent.com/u/2762128?v=4","gravatar_id":"","url":"https://api.github.com/users/pms1969","html_url":"https://github.com/pms1969","followers_url":"https://api.github.com/users/pms1969/followers","following_url":"https://api.github.com/users/pms1969/following{/other_user}","gists_url":"https://api.github.com/users/pms1969/gists{/gist_id}","starred_url":"https://api.github.com/users/pms1969/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pms1969/subscriptions","organizations_url":"https://api.github.com/users/pms1969/orgs","repos_url":"https://api.github.com/users/pms1969/repos","events_url":"https://api.github.com/users/pms1969/events{/privacy}","received_events_url":"https://api.github.com/users/pms1969/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-05-21T12:53:05Z","updated_at":"2018-05-29T20:18:44Z","closed_at":null,"author_association":"NONE","body":"**Is this a BUG REPORT or FEATURE REQUEST?**:\r\n/kind bug\r\nalthough it could just be me not understanding how the dns provider works with route53\r\n\r\n\r\n**What happened**:\r\ntrying to update cert-manager to 0.3.0-alpha2 in order to enable wildcard certificate support.\r\n\r\nNB: names changed to protect the innocent in all samples and logs.\r\n\r\nI directed `example.com` to the kubernetes ingress, as well as `*.example.com`\r\n\r\n**What you expected to happen**:\r\nCertificate to show up in secrets.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\nClusterIssuer:\r\n```yaml\r\napiVersion: certmanager.k8s.io/v1alpha1\r\nkind: ClusterIssuer\r\nmetadata:\r\n  name: letsencrypt-staging-v2\r\n  namespace: ingress\r\nspec:\r\n  acme:\r\n    server: https://acme-staging-v02.api.letsencrypt.org/directory\r\n    email: engineering@example.com\r\n    privateKeySecretRef:\r\n      name: letsencrypt-staging\r\n    dns01:\r\n      providers:\r\n      - name: route53\r\n        route53:\r\n          region: us-east-1\r\n```\r\n\r\nIngress:\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  name: redirect-wildcard-ingress\r\n  namespace: prod-tools\r\n  annotations:\r\n    certmanager.k8s.io/cluster-issuer: letsencrypt-staging-v2\r\n    kubernetes.io/ingress.class: nginx\r\n    kubernetes.io/tls-acme: \"true\"\r\nspec:\r\n  tls:\r\n  - hosts:\r\n    - \"*.example.com\"\r\n    secretName: redirect-wildcard-tls\r\n  rules:\r\n  - host: \"*.example.com\"\r\n    http:\r\n      paths:\r\n      - path: /\r\n        backend:\r\n          serviceName: redirector\r\n          servicePort: 80\r\n\r\n```\r\n\r\n**Anything else we need to know?**:\r\n\r\nlog output:\r\n\r\n```log\r\nI0521 11:09:42.363687       1 controller.go:177] certificates controller: syncing item 'tools/redirect-wildcard-tls'\r\nI0521 11:09:42.363778       1 sync.go:239] Preparing certificate tools/redirect-wildcard-tls with issuer\r\nI0521 11:09:42.363788       1 acme.go:159] getting private key (letsencrypt-staging-&gt;tls.key) for acme issuer ingress/letsencrypt-staging-v2\r\nI0521 11:09:42.364123       1 prepare.go:247] Cleaning up previous order for certificate tools/redirect-wildcard-tls\r\nI0521 11:09:42.364132       1 prepare.go:263] Cleaning up old/expired challenges for Certificate tools/redirect-wildcard-tls\r\nI0521 11:09:42.364138       1 logger.go:22] Calling CreateOrder\r\nI0521 11:09:43.193474       1 acme.go:193] Created order for domains: [{dns *.example.com}]\r\nI0521 11:09:43.193525       1 logger.go:52] Calling GetAuthorization\r\nI0521 11:09:43.390599       1 prepare.go:263] Cleaning up old/expired challenges for Certificate tools/redirect-wildcard-tls\r\nI0521 11:09:43.390622       1 sync.go:241] Error preparing issuer for certificate tools/redirect-wildcard-tls: ACME server does not allow selected challenge type for domain \"example.com\"\r\nI0521 11:09:43.396717       1 controller.go:152] ingress-shim controller: syncing item 'tools/redirect-wildcard-ingress'\r\nI0521 11:09:43.396738       1 sync.go:123] Certificate \"redirect-wildcard-tls\" for ingress \"redirect-wildcard-ingress\" already exists\r\nI0521 11:09:43.396746       1 sync.go:126] Certificate \"redirect-wildcard-tls\" for ingress \"redirect-wildcard-ingress\" is up to date\r\nI0521 11:09:43.396776       1 controller.go:166] ingress-shim controller: Finished processing work item \"tools/redirect-wildcard-ingress\"\r\nE0521 11:09:43.397085       1 sync.go:168] [tools/redirect-wildcard-tls] Error getting certificate 'redirect-wildcard-tls': secret \"redirect-wildcard-tls\" not found\r\nE0521 11:09:43.397106       1 controller.go:186] certificates controller: Re-queuing item \"tools/redirect-wildcard-tls\" due to error processing: ACME server does not allow selected challenge type for domain \"example.com\"\r\nI0521 11:09:47.013317       1 controller.go:138] clusterissuers controller: syncing item 'letsencrypt-staging-v2'\r\nI0521 11:09:47.013370       1 acme.go:159] getting private key (letsencrypt-staging-&gt;tls.key) for acme issuer ingress/letsencrypt-staging-v2\r\nI0521 11:09:47.013699       1 logger.go:67] Calling GetAccount\r\nI0521 11:09:47.909386       1 setup.go:66] letsencrypt-staging-v2: verified existing registration with ACME server\r\nI0521 11:09:47.909411       1 helpers.go:119] Found status change for ClusterIssuer \"letsencrypt-staging-v2\" condition \"Ready\": \"False\" -&gt; \"True\"; setting lastTransitionTime to 2018-05-21 11:09:47.909405087 +0000 UTC m=+2729.243859956\r\nI0521 11:09:47.916043       1 controller.go:152] clusterissuers controller: Finished processing work item \"letsencrypt-staging-v2\"\r\nI0521 11:09:47.921378       1 controller.go:138] clusterissuers controller: syncing item 'letsencrypt-staging-v2'\r\nI0521 11:09:47.921413       1 acme.go:159] getting private key (letsencrypt-staging-&gt;tls.key) for acme issuer ingress/letsencrypt-staging-v2\r\nI0521 11:09:47.921747       1 logger.go:67] Calling GetAccount\r\nI0521 11:09:48.720910       1 setup.go:66] letsencrypt-staging-v2: verified existing registration with ACME server\r\nI0521 11:09:48.725106       1 controller.go:152] clusterissuers controller: Finished processing work item \"letsencrypt-staging-v2\"\r\n```\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`): \r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.2\", GitCommit:\"81753b10df112992bf51bbc2c2f85208aad78335\", GitTreeState:\"clean\", BuildDate:\"2018-04-27T09:22:21Z\", GoVersion:\"go1.9.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.2\", GitCommit:\"81753b10df112992bf51bbc2c2f85208aad78335\", GitTreeState:\"clean\", BuildDate:\"2018-04-27T09:10:24Z\", GoVersion:\"go1.9.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n- Cloud provider or hardware configuration**: AWS\r\n- Install tools: terraform / kubectl / helm\r\n- Others:\r\n"},"comment":{"url":"https://api.github.com/repos/jetstack/cert-manager/issues/comments/392929539","html_url":"https://github.com/jetstack/cert-manager/issues/571#issuecomment-392929539","issue_url":"https://api.github.com/repos/jetstack/cert-manager/issues/571","id":392929539,"user":{"login":"tanner-bruce","id":21345430,"avatar_url":"https://avatars1.githubusercontent.com/u/21345430?v=4","gravatar_id":"","url":"https://api.github.com/users/tanner-bruce","html_url":"https://github.com/tanner-bruce","followers_url":"https://api.github.com/users/tanner-bruce/followers","following_url":"https://api.github.com/users/tanner-bruce/following{/other_user}","gists_url":"https://api.github.com/users/tanner-bruce/gists{/gist_id}","starred_url":"https://api.github.com/users/tanner-bruce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tanner-bruce/subscriptions","organizations_url":"https://api.github.com/users/tanner-bruce/orgs","repos_url":"https://api.github.com/users/tanner-bruce/repos","events_url":"https://api.github.com/users/tanner-bruce/events{/privacy}","received_events_url":"https://api.github.com/users/tanner-bruce/received_events","type":"User","site_admin":false},"created_at":"2018-05-29T20:18:44Z","updated_at":"2018-05-29T20:18:44Z","author_association":"NONE","body":"@munnerz, when doing a wildcard challenge with both a wildcard domain, e.g *.domain.com, and the ingress also has `domain.com`, what is the expected behaviour? Is that proper?"}}
{"actor":{"display_login":"tanner-bruce"}}