<p>I'm simply following the tutorial here: <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#creating_an_ingress_with_a_managed_certificate" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#creating_an_ingress_with_a_managed_certificate</a></p>

<p>Everything works fine until I deploy my certificate and wait 20 minutes for it to show up as:</p>

<pre><code>Status:
  Certificate Name:    daojnfiwlefielwrfn
  Certificate Status:  Provisioning
  Domain Status:
    Domain:  moviedecisionengine.com
    Status:  FailedNotVisible
</code></pre>

<p>That domain clearly works so what am I missing?</p>

<p>EDIT:</p>

<p>Here's the Cert:</p>

<pre><code>apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
    name: moviedecisionengine
spec:
    domains:
        - moviedecisionengine.com
</code></pre>

<p>The Ingress:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.gcp.kubernetes.io/pre-shared-cert: mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
    ingress.kubernetes.io/backends: '{"k8s-be-31721--1cd1f38313af9089":"HEALTHY"}'
    ingress.kubernetes.io/forwarding-rule: k8s-fw-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/https-forwarding-rule: k8s-fws-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/https-target-proxy: k8s-tps-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/ssl-cert: mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
    ingress.kubernetes.io/target-proxy: k8s-tp-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/url-map: k8s-um-default-showcase-mde-ingress--1cd1f38313af9089
    kubernetes.io/ingress.global-static-ip-name: 34.107.208.110
    networking.gke.io/managed-certificates: moviedecisionengine
  creationTimestamp: "2020-01-16T19:44:13Z"
  generation: 4
  name: showcase-mde-ingress
  namespace: default
  resourceVersion: "1039270"
  selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/showcase-mde-ingress
  uid: 92a2f91f-3898-11ea-b820-42010a800045
spec:
  backend:
    serviceName: showcase-mde
    servicePort: 80
  rules:
  - host: moviedecisionengine.com
    http:
      paths:
      - backend:
          serviceName: showcase-mde
          servicePort: 80
  - host: www.moviedecisionengine.com
    http:
      paths:
      - backend:
          serviceName: showcase-mde
          servicePort: 80
status:
  loadBalancer:
    ingress:
    - ip: 34.107.208.110
</code></pre>

<p>And lastly, the load balancer:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2020-01-13T22:41:27Z"
  labels:
    app: showcase-mde
  name: showcase-mde
  namespace: default
  resourceVersion: "2298"
  selfLink: /api/v1/namespaces/default/services/showcase-mde
  uid: d5a77d7b-3655-11ea-af7f-42010a800157
spec:
  clusterIP: 10.31.251.46
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 31721
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: showcase-mde
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 35.232.156.172
</code></pre>

<p>For the full output of <code>kubectl describe managedcertificate moviedecisionengine</code>:</p>

<pre><code>Name:         moviedecisionengine
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"networking.gke.io/v1beta1","kind":"ManagedCertificate","metadata":{"annotations":{},"name":"moviedecisionengine","namespace...
API Version:  networking.gke.io/v1beta1
Kind:         ManagedCertificate
Metadata:
  Creation Timestamp:  2020-01-17T16:47:19Z
  Generation:          3
  Resource Version:    1042869
  Self Link:           /apis/networking.gke.io/v1beta1/namespaces/default/managedcertificates/moviedecisionengine
  UID:                 06c97b69-3949-11ea-b820-42010a800045
Spec:
  Domains:
    moviedecisionengine.com
Status:
  Certificate Name:    mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
  Certificate Status:  Provisioning
  Domain Status:
    Domain:  moviedecisionengine.com
    Status:  FailedNotVisible
Events:      &lt;none&gt;
</code></pre>

<p>I was successful in using <code>Managedcertificate</code> with GKE <code>Ingress</code> resource. </p>

<p>Let me elaborate on that:</p>

<p><strong>Steps to reproduce:</strong></p>

<ul>
<li>Create IP address with <code>gcloud</code></li>
<li>Update the DNS entry</li>
<li>Create a deployment </li>
<li>Create a service</li>
<li>Create a certificate</li>
<li>Create a Ingress resource </li>
</ul>

<h2>Create IP address with gcloud</h2>

<p>Invoke below command to create static ip address:</p>

<p><code>$ gcloud compute addresses create example-address --global</code></p>

<p>Check newly created IP address with below command: </p>

<p><code>$ gcloud compute addresses describe example-address --global</code></p>

<h2>Update the DNS entry</h2>

<p>Go to <code>GCP</code> -> <code>Network Services</code> -> <code>Cloud DNS</code>.</p>

<p>Edit your zone with <code>A record</code> with the same address that was created above.  </p>

<p>Wait for it to apply. </p>

<p><strong>Check with <code>$ nslookup DOMAIN.NAME</code> if the entry is pointing to the appropriate address.</strong></p>

<h2>Create a deployment</h2>

<p>Below is example deployment which will respond to traffic:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  selector:
    matchLabels:
      app: hello
      version: 1.0.0
  replicas: 3
  template:
    metadata:
      labels:
        app: hello
        version: 1.0.0
    spec:
      containers:
      - name: hello
        image: "gcr.io/google-samples/hello-app:1.0"
        env:
        - name: "PORT"
          value: "50001"
</code></pre>

<p>Apply it with command <code>$ kubectl apply -f FILE_NAME.yaml</code></p>

<p>You can change this deployment to suit your application but be aware of the ports that your application will respond to. </p>

<h2>Create a service</h2>

<p>Use the <code>NodePort</code> as it's the same as in the provided link: </p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: hello-service
spec:
  type: NodePort
  selector:
    app: hello
    version: 1.0.0
  ports:
  - name: hello-port
    protocol: TCP
    port: 50001
    targetPort: 50001
</code></pre>

<p>Apply it with command <code>$ kubectl apply -f FILE_NAME.yaml</code></p>

<h2>Create a certificate</h2>

<p>As shown in guide you can use below example to create <code>ManagedCertificate</code>:</p>

<pre><code>apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: example-certificate 
spec:
  domains:
    - DOMAIN.NAME
</code></pre>

<p>Apply it with command <code>$ kubectl apply -f FILE_NAME.yaml</code></p>

<blockquote>
  <p>The status <code>FAILED_NOT_VISIBLE</code> indicates that certificate provisioning failed for a domain because of a problem with DNS or the load balancing configuration. Make sure that DNS is configured so that the certificate's domain resolves to the IP address of the load balancer.
  -- <em> <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates#domain-status" rel="nofollow noreferrer">Google Cloud documentation</a> </em></p>
</blockquote>

<p>Creation of this certificate should be affected by DNS entry that you provided earlier. </p>

<h2>Create a Ingress resource</h2>

<p>Below is example for <code>Ingress</code> resource which will use <code>ManagedCertificate</code>:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: example-address
    networking.gke.io/managed-certificates: example-certificate
spec:
  rules:
  - host: DOMAIN.NAME
    http:
      paths:
      - path: /
        backend:
          serviceName: hello-service
          servicePort: hello-port
</code></pre>

<p>Apply it with command <code>$ kubectl apply -f FILE_NAME.yaml</code></p>

<p><strong>It took about 20-25 minutes for it to fully work.</strong> </p>
