<p>I'm using a kubernetes cluster GCP with gitlab autodevops. Pipeline is running, help triller, ingress and cert-manager area installed. </p>

<p>I already have a domain "xpto.com.br" that already have a ssl cert for all sub domains, but it's configured into iis applications, so i can't use this cert in my gcp apps. So i am using lets encrypt with cert manager to generate certs into k8s cluster.</p>

<p>Everything are setup, but my applications is not responsing using https. The web browser shows "backend 404" if i try to force "https" to execute apps.</p>

<p>After some tries, i decided remove cert-manager from cluster to try setup again. But gitlab doesn't enable option to install cert manager again as below imagem show:</p>

<p><a href="https://i.stack.imgur.com/BKOxq.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BKOxq.jpg" alt="enter image description here"></a></p>

Rodrigo Celebrone
<p>GitLab doesn't provide an <code>uninstall</code> option, so you will either have to manually re-install cert-manager in the <code>gitlab-managed-apps</code> or re-attach your cluster to your GitLab project. If you want to manually do that, run:</p>

<pre><code>helm install \
    --name cert-manager \
    --namespace gitlab-managed-apps \
    stable/cert-manager
</code></pre>

<p>That only takes care of the cert-manager part. Another thing to note is that cert-manager doesn't miraculously recognize your need for a certificate and create one. You will need to create required resources such as an ingress, clusterIssuer and a certificate resource. Also one thing to note is that you can use a single tls wildcard certificate for all of your sub-domains. Do not generate redundant certificates, it will take a toll on your quota. Try with the following simple template (eg assuming you are using route53 for your dns provider):</p>

<p><strong>issuer.yaml</strong></p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: default
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: &lt;your email&gt;
    privateKeySecretRef:
      name: letsencrypt-staging
    dns01:
      providers:
      - name: route53
        route53:
          region: us-east-1
          accessKeyID: &lt;access key id&gt;
          secretAccessKeySecretRef:
            name: &lt;secret name&gt;
            key: secret-access-key
</code></pre>

<p><strong>ingress.yaml</strong></p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: &lt;ingress name&gt;
  annotations:
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    certmanager.k8s.io/cluster-issuer: letsencrypt-staging
spec:
  tls:
  - hosts:
    - "*.example.com"
    secretName: cert-wildcard-secret
  rules:
  - host: "sub.example.com"
    http:
      paths:
      - path: /
        backend:
          serviceName: &lt;service name&gt;
          servicePort: &lt;port number&gt;
</code></pre>

<p><strong>certificate.yaml</strong></p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: cert-wildcard
spec:
  secretName: cert-wildcard-secret
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  dnsNames:
  - '*.example.com'
  acme:
    config:
    - dns01:
        provider: route53
      domains:
      - '*.example.com'
</code></pre>

<p>Once you have verified that this works (with the FAKE staging certificates) change the URL in your issuer to <a href="https://acme-v02.api.letsencrypt.org/directory" rel="nofollow noreferrer">https://acme-v02.api.letsencrypt.org/directory</a> so that you can create legitimate certificates. Once you've made the change, delete the old FAKE cert secret so the new one can replace it.</p>
