<p>I have installed cert-manager 0.12.0 for SSL certificate. </p>

<p>My Issuer file is</p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: my@email.com
    privateKeySecretRef:
      name: letsencrypt-prod
    http01: {}
</code></pre>

<p>My certificate file</p>

<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: tls-secret
spec:
  secretName: tls-secret-prod
  dnsNames:
  - mydomain.com
  acme:
    config:
    - http01:
        ingressClass: nginx
      domains:
      - mydomain.com
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
</code></pre>

<p>Ingress configuration is</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: cms
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/tls-acme: "true"
spec:
  tls:
  - hosts:
    - mydomain.com
    secretName: tls-secret-prod
  rules:
  - host: mydomain.com
    http:
      paths:
      - backend:
          serviceName: apostrophe
          servicePort: 80
        path: /
</code></pre>

<p>But still, SSL certificated is not valid. And Common name is “Kubernetes Ingress Controller Fake Certificate”.</p>

<p>The following result to show orders and challenges</p>

<pre><code>kubectl get orders, challenges -o wide
NAME                                                  STATE     DOMAIN            REASON                                                                                                        AGE
challenge.certmanager.k8s.io/tls-secret-155743219-0   pending   mydomain.com   pods "cm-acme-http-solver-gk2zx" is forbidden: minimum cpu usage per Container is 100m, but request is 10m.   26m
</code></pre>

<p>I have updated the resources limit the range and reinstalled cert-manager with helm. I am still getting this error. 
I am not sure what goes wrong or show how to fix this.</p>

<p>Please let me know if you need anything. Thanks in advance!</p>

Ramesh Murugesan
<p>The problem lays in cpu limits defined for specific pod. 
You have to change minimum CPU limit in deployment configuration file. As you can see pod  (<strong>cm-acme-http-solver</strong>) is requesting  <strong>100m</strong> CPU usage while minimum CPU usage defined for specific pod is *10m**. So change CPU limits in deployment configuration file from <strong>100m</strong> to <strong>10m</strong> or less or you can also increase CPU requests. </p>

<p>Take a look here: <a href="https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace/" rel="nofollow noreferrer">cert-manager-kubernetes</a>, <a href="https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace/#attempt-to-create-a-pod-that-does-not-meet-the-minimum-cpu-request" rel="nofollow noreferrer">pod-min-cpu-request</a>.</p>

<p>Useful article: <a href="https://medium.com/@betz.mark/understanding-resource-limits-in-kubernetes-cpu-time-9eff74d3161b" rel="nofollow noreferrer">resources-limits-kubernetes</a>.</p>
