<p>I can`t create wilcard ssl with cert manager, I add my domain to cloudflare but cert manager can`t verify ACME account. How i resolve this problem?</p>

<p>i want wilcard ssl for my domain and use any deployments how could i do?</p>

<p><strong>I find error but how i resolve,  error is my k8s doesnt resolve dns  acme-v02.api.letsencrypt.org</strong></p>

<p>error is k8s dns can't find 
My k8s is </p>

<pre><code>Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3-k3s.1", GitCommit:"8343999292c55c807be4406fcaa9f047e8751ffd", GitTreeState:"clean", BuildDate:"2019-06-12T04:56+00:00Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}

</code></pre>

<p>Error log:</p>

<pre><code>I0716 13:06:11.712878       1 controller.go:153] cert-manager/controller/issuers "level"=0 "msg"="syncing item" "key"="default/issuer-letsencrypt" 
I0716 13:06:11.713218       1 setup.go:162] cert-manager/controller/issuers "level"=0 "msg"="ACME server URL host and ACME private key registration host differ. Re-checking ACME account registration" "related_resource_kind"="Secret" "related_resource_name"="issuer-letsencrypt" "related_resource_namespace"="default" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
I0716 13:06:11.713245       1 logger.go:88] Calling GetAccount
E0716 13:06:16.714911       1 setup.go:172] cert-manager/controller/issuers "msg"="failed to verify ACME account" "error"="Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "related_resource_kind"="Secret" "related_resource_name"="issuer-letsencrypt" "related_resource_namespace"="default" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
I0716 13:06:16.715527       1 sync.go:76] cert-manager/controller/issuers "level"=0 "msg"="Error initializing issuer: Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
E0716 13:06:16.715609       1 controller.go:155] cert-manager/controller/issuers "msg"="re-queuing item  due to error processing" "error"="Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "key"="default/issuer-letsencrypt" 

</code></pre>

<p>my Issuer</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: issuer-letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: yusufkaan142@gmail.com
    privateKeySecretRef:
      name: issuer-letsencrypt
    dns01:
      providers:
      - name: cf-dns
        cloudflare:
          email: mail@gmail.com
          apiKeySecretRef:
            name: cloudflare-api-key
            key: api-key.txt
</code></pre>

<p>Secret:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-key
  namespace: cert-manager
type: Opaque
data:
  api-key.txt: base64encoded
</code></pre>

<p>My Certificate:</p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: wilcard-theykk-net
  namespace: cert-manager
spec:
  secretName: wilcard-theykk-net
  issuerRef:
    name: issuer-letsencrypt
    kind: Issuer
  commonName: '*.example.net'
  dnsNames:
  - '*.example.net'
  acme:
    config:
    - dns01:
        provider: cf-dns
      domains:
      - '*.example.net'
      - 'example.net'
</code></pre>

<p>Dns for k8s</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kube-dns
  namespace: kube-system
data:
  upstreamNameservers: |
    ["1.1.1.1","8.8.8.8"]
</code></pre>

Kaan
<p>I would start with debugging DNS resolution function within your K8s cluster:</p>

<p>Spin up some container with basic network tools on a board:</p>

<p><code>kubectl run -i -t busybox --image=radial/busyboxplus:curl --restart=Never</code></p>

<p>From within <code>busybox</code> container check <code>/etc/resolv.conf</code> file and ensure that you can resolve Kubernetes DNS <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/" rel="noreferrer">service</a> <code>kube-dns</code>:</p>

<pre><code>$ cat /etc/resolv.conf 
nameserver 10.96.0.10
search default.svc.cluster.local svc.cluster.local cluster.local c.org-int.internal google.internal
options ndots:5
</code></pre>

<p>Make a lookup request to <code>kubernetes.default</code> which should get output with a DNS nameserver without any issues:</p>

<pre><code>$ nslookup kubernetes.default
Server:    10.96.0.10
Address 1: 10.96.0.10 kube-dns.kube-system.svc.cluster.local

Name:      kubernetes.default
Address 1: 10.96.0.1 kubernetes.default.svc.cluster.local
</code></pre>

<p>Due to the fact that you've defined <code>upstreamNameservers</code> in the corresponded <code>kube-dns</code> ConfigMap, check whether you can ping upstream nameservers: <code>1.1.1.1</code> and <code>8.8.8.8</code> that should be accessible from within a Pod. </p>

<p>Verify DNS pod logs for any suspicious events for each container(kubedns, dnsmasq, sidecar):</p>

<pre><code>kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c kubedns

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c dnsmasq

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c sidecar
</code></pre>

<p>If you are fine with all precedent steps then DNS discovery is working properly, thus you can also inspect <a href="https://www.cloudflare.com/dns/dns-firewall/" rel="noreferrer">Cloudflare</a> DNS firewall configuration in order to exclude potential restrictions. More relevant information about troubleshooting DNS issue you can find in the official K8s <a href="https://kubernetes.io/docs/tasks/administer-cluster/dns-debugging-resolution/" rel="noreferrer">documentation</a>.</p>
