<p>I configured automated SSL certificate management few months ago as described here: <a href="http://docs.cert-manager.io/en/latest/tutorials/acme/dns-validation.html" rel="nofollow noreferrer">http://docs.cert-manager.io/en/latest/tutorials/acme/dns-validation.html</a>
for domains: <code>&lt;myhost&gt;.com</code> and <code>dev.&lt;myhost&gt;.com</code>.
So I have two namespaces: <code>prod</code> for <code>&lt;myhost&gt;.com</code> and
<code>dev</code> for <code>dev.&lt;myhost&gt;.com</code>. In each namespace I have ingress controller
and <code>Certificate</code> resource to store certificate to secret.
It's working fine and <code>ClusterIssuer</code> automatically updates certificates.</p>

<p>But few days ago I tried to add new domain: <code>test.&lt;myhost&gt;.com</code> in <code>test</code> namespace with absolutely same configuration of ingress and certificate
as in <code>prod</code> or <code>dev</code> namespace (expect host name and namespace):</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    kubernetes.io/tls-acme: 'true'
  name: app-ingress
  namespace: test
spec:
  tls:
  - hosts:
    - test.&lt;myhost&gt;.com
    secretName: letsencrypt-tls
  rules:
    - host: test.&lt;myhost&gt;.com
      http:
        paths:
        - backend:
            serviceName: web
            servicePort: 80
          path: /
---
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: cert-letsencrypt
  namespace: test
spec:
  secretName: letsencrypt-tls
  issuerRef:
    name: letsencrypt-prod-dns
    kind: ClusterIssuer
  commonName: 'test.&lt;myhost&gt;.com'
  dnsNames:
  - test.&lt;myhost&gt;.com
  acme:
    config:
    - dns01:
        provider: dns
      domains:
      - test.&lt;myhost&gt;.com
</code></pre>

<p>and this configuration doesnt work: certificate can't be found in secret, ingress is using "app-ingress-fake-certificate".</p>

<p><code>cert-manager</code> pod shows a lot of similar errors:</p>

<pre><code>pkg/client/informers/externalversions/factory.go:72: Failed to list *v1alpha1.Challenge: challenges.certmanager.k8s.io is forbidden: User "system:serviceaccount:kube-system:cert-manager" cannot list challenges.certmanager.k8s.io at the cluster scope
pkg/client/informers/externalversions/factory.go:72: Failed to list *v1alpha1.Order: orders.certmanager.k8s.io is forbidden: User "system:serviceaccount:kube-system:cert-manager" cannot list orders.certmanager.k8s.io at the cluster scope
</code></pre>

<p>and <code>certificate</code> is not trying to get certificate (<code>kubectl describe -ntest cert-letsencrypt</code>):</p>

<pre><code>API Version:  certmanager.k8s.io/v1alpha1
Kind:         Certificate
Metadata: ...
Spec:
  Acme:
    Config:
      Dns 01:
        Provider:  dns
      Domains:
        test.&lt;myhost&gt;.com
  Common Name:  test.&lt;myhost&gt;.com
  Dns Names:
    test.&lt;myhost&gt;.com
  Issuer Ref:
    Kind:       ClusterIssuer
    Name:       letsencrypt-prod-dns
  Secret Name:  letsencrypt-tls
Events:         &lt;none&gt;
</code></pre>

<p>It should have any status as certificates on other namespaces.</p>

<p>I can't understand why this configuration worked before but can't work now.</p>

<p>I'm not sure it's related, but I updated kubernetes using kops few weeks ago, current version is:</p>

<pre><code>Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.0", GitCommit:"0ed33881dc4355495f623c6f22e7dd0b7632b7c0", GitTreeState:"archive", BuildDate:"2018-10-12T16:56:06Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.6", GitCommit:"a21fdbd78dde8f5447f5f6c331f7eb6f80bd684e", GitTreeState:"clean", BuildDate:"2018-07-26T10:04:08Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>The cause of this issue was Kubernetes upgrade from <code>1.9</code> to <code>1.10</code>. To fix it you need to upgrade cert-manager to <code>0.5.x</code> version.</p>

<p>It may be not possible to upgrade from <code>0.4.x</code> to <code>0.5.x</code> using <code>helm</code> because of bug <a href="https://github.com/jetstack/cert-manager/issues/1134" rel="nofollow noreferrer">https://github.com/jetstack/cert-manager/issues/1134</a>
in such case you need to store all issuers and certificates configurations then delete cert-manager <code>0.4.x</code> and install <code>0.5.x</code>, then apply all issuers and certificates configurations from first step.</p>
