<p>I have two ingress controller one with default class <code>nginx</code> in <code>default</code> namespace, while the second ingress controller has a <code>nginx class: nginx-devices</code>.</p>
<p>Cert-manager is already installed using Helm.</p>
<p>I managed to get TLS certificate from Lets Encrypt for the first controller, using <code>ClusterIssuer</code> and ingress resource rules for routing <code>Ingress</code>.</p>
<pre><code>
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  # name: letsencrypt-staging
  name: letsencrypt-prod
spec:
  acme:
    email: xx
    # server: https://acme-staging-v02.api.letsencrypt.org/directory
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # name: letsencrypt-staging
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
</code></pre>
<p>Ingress routing:</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: serviceA-ingress-rules
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
    ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
  - hosts:
    - FirstService.cloudapp.azure.com
    secretName: tls-secret
  rules:
  - host: FirstService.cloudapp.azure.com
    http:
      paths:
      - path: /serviceA
        backend:
          serviceName: serviceA
          servicePort: 80
</code></pre>
<p>However, for creating the second TLS certificate for the second ingress controller, the TLS secret is not created</p>
<p>ClusterIssuer</p>
<pre><code># k8s/cluster-issuer.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  # name: letsencrypt-staging
  name: letsencrypt-prod-devices
  namespace: ingress-nginx-devices # namespace where the second ingress controller is installed
spec:
  acme:
    email: xxx
    # server: https://acme-staging-v02.api.letsencrypt.org/directory
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # name: letsencrypt-staging
      name: letsencrypt-prod-devices
    solvers:
    - http01:
        ingress:
          class: nginx-devices # ingress class of the second ingress controller

</code></pre>
<p>ingress routing</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: devices-ingress-rules
  namespace: default # since all the services are in default namespace
  annotations:
    kubernetes.io/ingress.class: nginx-devices # ingress class of the second ingress controller
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod-devices&quot; 
    ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
  - hosts:
    - secondService.cloudapp.azure.com
    secretName: tls-secret
  rules:
  - host: secondService.cloudapp.azure.com
    http:
      paths:
      - path: /serviceB
        backend:
          serviceName: serviceB
          servicePort: 80
</code></pre>
<p>by looking at the secret I can only see: <code>kubectl get secrets -n ingress-nginx-devices</code></p>
<pre><code>NAME                                          TYPE                                  DATA   AGE
default-token-xzp95                           kubernetes.io/service-account-token   3      92m
nginx-ingress-devices-backend-token-pd4vf     kubernetes.io/service-account-token   3      64m
nginx-ingress-devices-token-qvvps             kubernetes.io/service-account-token   3      64m
sh.helm.release.v1.nginx-ingress-devices.v1   helm.sh/release.v1                    1      64m
</code></pre>
<p>while in default namespace:</p>
<pre><code>tls-secret                                          kubernetes.io/tls                     2      134m
</code></pre>
<p>Why the second tls-secret is not being generated ? what could go wrong here ?</p>
<p>Any help is appreciated :)</p>

<p>your second cluster issuer namespace is : <strong>ingress-nginx-devices</strong> ideally it should be in the <strong>default</strong> namespace as your ingress is in the <strong>default</strong> namespace.</p>
<p>Keep these three in same namespace :</p>
<ol>
<li>Ingress</li>
<li>Clusterissuer</li>
<li>Service</li>
</ol>
<p>if everything will work well you will see the secret in <strong>default</strong> namespace</p>
<p>also in your YAML of clusterissuer</p>
<pre><code>privateKeySecretRef:
      # name: letsencrypt-staging
      name: letsencrypt-prod-devices
</code></pre>
<p>name of your secret is : <strong>letsencrypt-prod-devices</strong></p>
<p>but in ingress it is : <strong>tls-secret</strong></p>
<p>keep it same otherwise wont work</p>
<p>here sharing a full example of <strong>clusterissuer</strong> and <strong>ingress</strong> keep in the same namespace. You can change the secret name, clusterissuer name as per need. Clusterissuer will create the secret automatically just give prover names of secret &amp; clusterissuer in ingress (matching).</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: cluster-issuer-name
  namespace: development
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: harsh@example.com
    privateKeySecretRef:
      name: secret-name
    solvers:
    - http01:
        ingress:
          class: nginx-class-name
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx-class-name
    cert-manager.io/cluster-issuer: cluster-issuer-name
    nginx.ingress.kubernetes.io/rewrite-target: /
  name: example-ingress
spec:
  rules:
  - host: sub.example.com
    http:
      paths:
      - path: /api
        backend:
          serviceName: service-name
          servicePort: 80
  tls:
  - hosts:
    - sub.example.com
    secretName: secret-name
</code></pre>
