<p>When I try configuring TLS Let's Encrypt certificates for my cluster application with a NGINX Ingress controller and <a href="https://cert-manager.io/" rel="nofollow noreferrer">cert-manager</a>, something goes wrong with the ClusterIssuer.</p>
<p>My ClusterIssuer is defined as followed:</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: user@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
</code></pre>
<p>When I check out the clusterissuer via kubectl, it says that the ClusterIssuer is <code>READY</code>.</p>
<pre><code>$ kubectl get clusterissuer --namespace mynamespace
</code></pre>
<p>Response:</p>
<pre><code>NAME               READY   AGE
letsencrypt-prod   True    13s
</code></pre>
<p>But when I describe the ClusterIssuer I get an error.</p>
<pre><code>$ kubectl describe clusterissuer letsencrypt-prod --namespace mynamespace
</code></pre>
<p>Response:</p>
<pre><code>Error from server: conversion webhook for cert-manager.io/v1alpha2, Kind=ClusterIssuer failed: Post https://cert-manager-webhook.cert-manager.svc:443/convert?timeout=30s: service &quot;cert-manager-webhook&quot; not found
</code></pre>
<p>I installed cert-manager with <a href="https://helm.sh/" rel="nofollow noreferrer">Helm 3</a> with manually adding the CRDs.</p>
<p>How to solve this?</p>

marcuse
<p>The cert-manager chart does not accept different namespacing when the CRDs are applied manually to your cluster. Instead of applying them manually first, <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">install</a> the CRDs as part of the Helm 3 release.</p>
<pre><code>$ helm repo add jetstack https://charts.jetstack.io

$ helm repo update

$ helm install \
  cert-manager jetstack/cert-manager \
  --namespace mynamespace \
  --version v0.15.1 \
  --set installCRDs=true
</code></pre>
