<p>I setup a kubernetes cluster with currently two nodes and metallb as a loadbalancer.</p>

<p>Currently I would like to use an Ingress and secure it via ssl. For this I decided to use nginx ingress with cert-manager and put it on their site after the tutorial.</p>

<p>But now I get the error " Waiting for http-01 challenge propagation: failed to perform self check GET request '<a href="http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs" rel="nofollow noreferrer">http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs</a>': Get "<a href="http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs" rel="nofollow noreferrer">http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs</a>": dial tcp 94.130.150.125:80: connect: connection timed out
"</p>

<p>My current ClusterIssuer looks like this:</p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt-prod
 namespace: cert-manager
spec:
 acme:
   # The ACME server URL
   server: https://acme-v02.api.letsencrypt.org/directory
   # Email address used for ACME registration
   email: letsencrypt@mymail.de
   # Name of a secret used to store the ACME account private key
   privateKeySecretRef:
     name: letsencrypt-prod
   # Enable the HTTP-01 challenge provider
   solvers:
   - http01:
       ingress:
         class:  nginx
</code></pre>

<p>And I am trying to automatically provide a certificate for</p>

<pre><code>---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    cert-manager.io/acme-challenge-type: http01
spec:
  tls:
  - hosts:
    - example.....zone
    secretName: example-...-zone-tls
  rules:
  - host: example.....zone
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-service
          servicePort: 80
</code></pre>

<p>Manually I can reach any address perfectly.</p>

<p>This one worked for me.</p>

<p>Change <code>LoadBalancer</code> in <code>ingress-nginx</code> service.</p>

<p>Add/Change <code>externalTrafficPolicy: Cluster</code>.</p>

<p>Reason being, pod with the certificate-issuer wound up on a different node than the load balancer did, so it couldn’t talk to itself through the ingress.</p>

<p>Below is complete block taken from <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.26.1/deploy/static/provider/cloud-generic.yaml" rel="noreferrer">https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.26.1/deploy/static/provider/cloud-generic.yaml</a></p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  #CHANGE/ADD THIS
  externalTrafficPolicy: Cluster
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https

---
</code></pre>
