<p>It's been a while and I cant get it to work. Basically I have a K8s Cluster on AWS EKS, ExternalDNS is set and works and now I'm trying to add TLS/SSL certificates with cert-manager.</p>
<p>Those are my configs:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: my-email
    privateKeySecretRef:
      name: letsencrypt-cluster-issuer-key
    solvers:
      - selector:
          dnsZones:
            - &quot;example.it&quot;
            - &quot;*.example.it&quot;
        dns01:
          route53:
            region: eu-central-1
            hostedZoneID: HOSTEDZONEID
            accessKeyID: ACCESSKEYID
            secretAccessKeySecretRef:
              name: route53-secret
              key: secretkey
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-cluster-issuer
  commonName: &quot;*.example.it&quot;
  dnsNames:
    - &quot;*.example.it&quot;

</code></pre>
<p>ExternalDNS:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: external-dns
  labels:
    app.kubernetes.io/name: external-dns
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;services&quot;, &quot;endpoints&quot;, &quot;pods&quot;, &quot;nodes&quot;]
    verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
  - apiGroups: [&quot;extensions&quot;, &quot;networking.k8s.io&quot;]
    resources: [&quot;ingresses&quot;]
    verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: external-dns-viewer
  labels:
    app.kubernetes.io/name: external-dns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns
subjects:
  - kind: ServiceAccount
    name: external-dns
    namespace: externaldns # change to desired namespace: externaldns, kube-addons
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns
  labels:
    app.kubernetes.io/name: external-dns
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: external-dns
  template:
    metadata:
      labels:
        app.kubernetes.io/name: external-dns
    spec:
      serviceAccountName: external-dns
      containers:
        - name: external-dns
          image: k8s.gcr.io/external-dns/external-dns:v0.11.0
          args:
            - --source=service
            - --source=ingress
            - --domain-filter=example.it # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
            - --provider=aws
            - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
            - --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
            - --registry=txt
            - --txt-owner-id=external-dns
          env:
            - name: AWS_DEFAULT_REGION
              value: eu-central-1 # change to region where EKS is installed

</code></pre>
<p>Cert-manager is deployed in the <code>cert-manager</code> namespace, while ExternalDNS is in its <code>externaldns</code> namespace. AWS ALB is in <code>kube-system</code>.</p>
<p>Finally, my ingress deployed in <code>default</code> ns:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: master
  namespace: default
  labels:
    name: master
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/backend-protocol: HTTP
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTPS&quot;:443}, {&quot;HTTP&quot;:80}]'
    alb.ingress.kubernetes.io/group.name: &quot;alta&quot;
    alb.ingress.kubernetes.io/group.order: &quot;0&quot;
    alb.ingress.kubernetes.io/ssl-redirect: &quot;443&quot;
    cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer
spec:
  ingressClassName: alb
  tls:
    - hosts:
        - &quot;example.it&quot;
      secretName: &quot;tls-secret&quot;
  rules:
    - host: example.it
      http:
        paths:
          - pathType: Prefix
            path: /
            backend:
              service:
                name: echoserver # random test service, returns some page w/some info
                port:
                  number: 80
</code></pre>
<p>With all this config, i still get &quot;no certificate found for host: example.it&quot; in my ingress. Certificate is being issued and all looks ok. Do you have an idea? I'm going insane over this.</p>

Abel Hristodor
<p>Posting this in case someone encounters the same problem.</p>
<p>Basically AWS ALB does not support cert-manager, you have to go to AWS ACM, get yourself a certificate there and then add it through the <code>certificate-arn</code> annotation on your ingress. Then everything should start working. Thx reddit for this.</p>
