<p>I manage my DNS using GoDaddy and I was hoping to have Lets Encrypt certificates generated for my kubernetes deployment. However, trying to generate a certificate generates the error</p>
<pre><code>I0728 17:31:12.123952       1 dns.go:88] cert-manager/controller/challenges/Present &quot;msg&quot;=&quot;presenting DNS01 challenge for domain&quot; &quot;dnsName&quot;=&quot;XXXX&quot; &quot;domain&quot;=&quot;XXX&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;letsencrypt-staging-bflxn-153714257-3821133841&quot; &quot;resource_namespace&quot;=&quot;default&quot; &quot;resource_version&quot;=&quot;v1&quot; &quot;type&quot;=&quot;DNS-01&quot; 
E0728 17:31:12.129511       1 controller.go:163] cert-manager/controller/challenges &quot;msg&quot;=&quot;re-queuing item due to error processing&quot; &quot;error&quot;=&quot;godaddy.acme.mycompany.com is forbidden: User \&quot;system:serviceaccount:cert-manager:cert-manager\&quot; cannot create resource \&quot;godaddy\&quot; in API group \&quot;acme.mycompany.com\&quot; at the cluster scope&quot; &quot;key&quot;=&quot;default/letsencrypt-staging-bflxn-153714257-3821133841&quot; 
</code></pre>
<p>At the core of this problem, I believe, is what the <code>groupName</code> and <code>solver</code> should be for my <code>ClusterIssuer</code>.</p>
<p><code>secret.yml</code></p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: godaddy-api-key
  namespace: cert-manager
type: Opaque
stringData:
  token: GO_DADDY_KEY:GO_DADDY_SECRET
</code></pre>
<p><code>issuer.yml</code></p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: XXXX
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - selector:
          dnsNames:
          - '*.company.com'
        dns01:
          webhook:
            config:
              apiKeySecretRef:
                name: godaddy-api-key
                key: token
              production: true
              ttl: 600
            groupName: acme.mycompany.com
            solverName: godaddy
</code></pre>
<p><em>NB: I've tried different permutations of groupName including using a unique domain with no success</em></p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: letsencrypt-staging
spec:
  secretName: letsencrypt-staging
  renewBefore: 240h
  dnsNames:
    - &quot;*.company.com&quot;
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
</code></pre>
<p>But the certificate is never generated</p>
<pre><code>$ k get certificate letsencrypt-staging 
NAME                  READY   SECRET                AGE
letsencrypt-staging   False   letsencrypt-staging   8m27s
</code></pre>
<p>I'm using this webhook <a href="https://github.com/snowdrop/godaddy-webhook" rel="nofollow noreferrer">https://github.com/snowdrop/godaddy-webhook</a></p>

<p>I also encountered this issue. I got it fixed by adding a missing <code>ClusterRole</code> and <code>ClusterRolebinding</code>. This is the manifest that fixed the issue for me.</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dns-challenge-missing-role
rules:
- apiGroups: [&quot;acme.mycompany.com&quot;] # &quot;&quot; indicates the core API group
  resources: [&quot;godaddy&quot;]
  verbs: [&quot;*&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dns-challenge-missing-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dns-challenge-missing-role
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager
</code></pre>
