<p>I'm trying to use <code>wildcard</code> on kubernetes. But i have not success.
My idea is configure wildcard, so my application to use dynamic subdomains. I'm doing that locally, but when i tried to do deploy i got this problem. I'm using Digital Ocean Cluster.</p>
<p>I configured my k8s file like that.</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: myemail@mycompany.com.br
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: apps
  name: menu-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: menu
  template:
    metadata:
      labels:
        app: menu
    spec:
      containers:
        - name: menu
          image: company/company-menu:$VERSION
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
          env:
            - name: VERSION
              value: $VERSION

      imagePullSecrets:
        - name: hub
---
apiVersion: v1
kind: Service
metadata:
  namespace: apps
  name: menu-service
spec:
  selector:
    app: menu
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: apps
  name: menu-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: 'nginx'
    ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
    - hosts:
        - menu.mydomain.dev
        - '*.menu.mydomain.dev'
      secretName: menuwild-tls
  rules:
    - host: menu.mydomain.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: menu-service
                port:
                  number: 80
</code></pre>
<p>But i'm getting this</p>
<pre><code>menuwild-tls       False   menuwild-tls       27m
</code></pre>
<p>I tried a lot of things, but nothing works</p>

Rafael Augusto
<p>The issue is, you cannot issue certificates for wildcard DNS names using <code>HTTP-01</code> acme-challenge. You need to prove a <em>stronger challenge</em>. You need <code>DNS-01</code> challenge setup which in turn creates some DNS records to validate your authority of the DNS name. For that cert-manager needs your DNS server access to do some authorized REST calls.</p>
<p>You need to get an access token from the digital ocean and create a secret named <code>digitalocean-dns</code> with data key <code>access-token</code> and refer to it in the <code>Issuer</code> config as below. Have a look at the <a href="https://cert-manager.io/docs/configuration/acme/dns01/digitalocean/" rel="nofollow noreferrer">docs</a> too.</p>
<h3>Issuer</h3>
<pre><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-digital-ocean-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: user@abc.org
    privateKeySecretRef:
      name: letsencrypt-cloudlfare-prod
    solvers:
    - dns01:
        digitalocean:
          tokenSecretRef:
            name: digitalocean-dns
            key: access-token
</code></pre>
<h3>Ingress</h3>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/issuer: letsencrypt-digital-ocean-prod
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
  name: test-ing
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: '*.menu.mydomain.dev'
    http:
      paths:
      - backend:
          service:
            name: test
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - '*.menu.mydomain.dev'
    secretName: wild-menu-tls
</code></pre>
<p>When you debug it, check the logs of cert-manager pods:</p>
<pre><code>k logs -f cert-manager-3f43v34f34-fg3 -n cert-manager
</code></pre>
<p>If you check <code>Certificate</code> status, they are not getting updated with the errors.</p>
<p>NOTE:
You also need two <code>DNS</code> <code>A</code> records for your Load Balancer IP for names <code>menu</code> and <code>*.menu</code>.</p>
<p>I have validated this in a real environment. Let me know if you need further guidance.</p>
