<p>I was under the impression that the main point of cluster-issuer is that its namespaced and doesn't have to be recreated across different resources, in general there could be one main cluster-issuer that will manage all ingresses across the cluster.</p>
<p>From what I am seeing the cluster-issuer can only create one secret and if its in use by one ingress the second wont wont be created properly cause its already taken.</p>
<p>Is there anyway to create one cluster-issuer to manage all ingresses across the cluster?</p>
<p>Code included below</p>
<h3>Cluster-issuer.yaml</h3>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-grafana
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: foo@gmail.com
    privateKeySecretRef:
      name: letsencrypt-grafana
    solvers:
    - selector:
        dnsZones:
          - &quot;foo.com&quot;
      dns01:
        route53:
          region: eu-central-1
          hostedZoneID: foo
          accessKeyID: foo
          secretAccessKeySecretRef:
            name: aws-route53-creds
            key: password.txt
</code></pre>
<h3>Ingress.yaml</h3>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grafana-ingress
  namespace: loki
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-grafana
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/proxy-body-size:  &quot;125m&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - grafana.foo.com
    secretName: letsencrypt-grafana # &lt; cert-manager will store the created certificate in this secret.
  rules:
  - host: grafana.foo.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: loki-grafana
            port:
              number: 80
</code></pre>

Elazar
<p>i would recommend creating the <strong>wildcard</strong> <strong>certificate</strong> using <strong>issuer/clusterissuer</strong>.</p>
<p>So you will be having the <strong>single secret</strong> with <strong>wildcard</strong> <strong>cert</strong> so you can use that across all ingress.</p>
<p>As you are already using <strong>DNS</strong> verification it will work well, as <strong>wildcard</strong> not supports the <strong>HTTP</strong></p>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: test123@gmail.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - selector:
        dnsZones:
          - &quot;devops.example.in&quot;
      dns01:
        route53:
          region: us-east-1
          hostedZoneID: Z0152EXAMPLE
          accessKeyID: AKIA5EXAMPLE
          secretAccessKeySecretRef:
            name: route53-secret
            key: secret-access-key
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef: 
    kind: Issuer
    name: letsencrypt-prod
  commonName: &quot;*.devops.example.in&quot;
  dnsNames:
    - &quot;*.devops.example.in&quot;
</code></pre>
<p>Read my full article : <a href="https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2" rel="nofollow noreferrer">https://medium.com/@harsh.manvar111/wild-card-certificate-using-cert-manager-in-kubernetes-3406b042d5a2</a></p>
<p><strong>Ingress</strong> &amp; <strong>secret</strong> example</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
    certmanager.k8s.io/issuer: &quot;letsencrypt-prod&quot;
    certmanager.k8s.io/acme-challenge-type: dns01
    certmanager.k8s.io/acme-dns01-provider: route53
  name: ingress-resource-tls
  namespace: default
spec:
  rules:
  - host: &quot;hello.devops.example.in&quot;
    http:
      paths:
      - backend:
          serviceName: hello-app
          servicePort: 8080
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - &quot;hello.devops.example.in&quot;
    secretName: tls-secret
</code></pre>
