<p>I was under the impression that the main point of cluster-issuer is that its namespaced and doesn't have to be recreated across different resources, in general there could be one main cluster-issuer that will manage all ingresses across the cluster.</p>
<p>From what I am seeing the cluster-issuer can only create one secret and if its in use by one ingress the second wont wont be created properly cause its already taken.</p>
<p>Is there anyway to create one cluster-issuer to manage all ingresses across the cluster?</p>
<p>Code included below</p>
<h3>Cluster-issuer.yaml</h3>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-grafana
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: foo@gmail.com
    privateKeySecretRef:
      name: letsencrypt-grafana
    solvers:
    - selector:
        dnsZones:
          - &quot;foo.com&quot;
      dns01:
        route53:
          region: eu-central-1
          hostedZoneID: foo
          accessKeyID: foo
          secretAccessKeySecretRef:
            name: aws-route53-creds
            key: password.txt
</code></pre>
<h3>Ingress.yaml</h3>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grafana-ingress
  namespace: loki
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-grafana
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/proxy-body-size:  &quot;125m&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - grafana.foo.com
    secretName: letsencrypt-grafana # &lt; cert-manager will store the created certificate in this secret.
  rules:
  - host: grafana.foo.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: loki-grafana
            port:
              number: 80
</code></pre>

<p>@Harsh Manvar while I do appreciate your anwser I found something that is a better suit for my needs.</p>
<p><a href="https://cert-manager.io/docs/tutorials/syncing-secrets-across-namespaces/" rel="nofollow noreferrer">Cert-manager documentation</a> contains multiple options to sync secrets across namespaces</p>
<p>The one I chose was <a href="https://github.com/emberstack/kubernetes-reflector" rel="nofollow noreferrer">reflector</a>. The steps to install are included in the documentation but just for the sake of service i'll post here aswell</p>
<h5>Requirements: <a href="https://helm.sh/docs/helm/helm_install/" rel="nofollow noreferrer">Helm</a></h5>
<h4>Installation:</h4>
<pre><code>helm repo add emberstack https://emberstack.github.io/helm-charts
helm repo update
helm upgrade --install reflector emberstack/reflector
</code></pre>
<h3>Setup:</h3>
<p>Add the following annotation to your secret <code>reflector.v1.k8s.emberstack.com/reflection-allowed: &quot;true&quot;</code>, it should look like the following</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
 name: source-secret
 annotations:
   reflector.v1.k8s.emberstack.com/reflection-allowed: &quot;true&quot;
</code></pre>
<p>Done! Your secret should be replicated within all namespaces. For multiple ingress configurations within the same namespace you could edit your ingress.yaml like this</p>
<h4>Ingress.yaml</h4>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jenkins-ingress
  namespace: jenkins
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-global
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/proxy-body-size:  &quot;125m&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - jenkins.foo.com
    - nginx.foo.com
    secretName: letsencrypt-global # &lt; cert-manager will store the created certificate in this secret.
  rules:
  - host: jenkins.foo.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: jenkins
            port:
              number: 80
  - host: nginx.foo.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx
            port:
              number: 80
</code></pre>
