<p>As I work on configuring my infrastructure with Terraform, I am currently attempting to create an ingress and apply Let's Encrypt to enable secure communication. However, despite my best efforts, I have encountered an error with the Nginx controller that is preventing me from successfully implementing the Let's Encrypt certificate. It's been frustrating trying to troubleshoot and resolve the issue, but I am determined to find a solution so that I can ensure secure communication for my infrastructure. With that in mind, I am reaching out to ask for your guidance on how to proceed and fix this issue.</p>
<pre><code>W0318 02:10:06.465217 7 controller.go:1333] Error getting SSL certificate &quot;project/cert-manager-private-key&quot;: local SSL certificate project/cert-manager-private-key was not found. Using default certificate
</code></pre>
<pre><code>module &quot;cert_manager&quot; {
  source = &quot;terraform-iaac/cert-manager/kubernetes&quot;

  cluster_issuer_email                   = &quot;dan.habot@gmail.com&quot;
  cluster_issuer_name                    = &quot;cert-manager-global&quot;
  cluster_issuer_private_key_secret_name = &quot;cert-manager-private-key&quot;
  cluster_issuer_create = true

  # certificates = {
  #   main = {
  #     dns_names = [&quot;api.project.io&quot;]
  #     secret_name = &quot;cert-manager-private-key&quot;
  #   }
  # }

  create_namespace = false
  namespace_name   = kubernetes_namespace.project.metadata[0].name
}

resource &quot;helm_release&quot; &quot;ingress-nginx&quot; {
  repository = &quot;https://kubernetes.github.io/ingress-nginx&quot;
  chart      = &quot;ingress-nginx&quot;
  name       = &quot;ingress-nginx&quot;
  set {
    name  = &quot;controller.publishService.enabled&quot;
    value = true
  }
  set {
    name = &quot;controller.admissionWebhooks.certManager.enabled&quot;
    value = true
  }
  set {
    name = &quot;controller.scope.namespace&quot;
    value = kubernetes_namespace.project.metadata[0].name
  }
  set {
    name = &quot;controller.tcp.configMapNamespace&quot;
    value = kubernetes_namespace.project.metadata[0].name
  }
  set {
    name = &quot;webhook.enabled&quot;
    value = &quot;true&quot;
  }

  set {
    name = &quot;rbac.create&quot;
    value = &quot;true&quot;
  }

  set {
    name = &quot;webhook.enabled&quot;
    value = &quot;true&quot;
  }

  set {
    name = &quot;ingressShim.defaultIssuerKind&quot;
    value = &quot;ClusterIssuer&quot;
  }

  set {
    name = &quot;ingressShim.defaultIssuerName&quot;
    value = module.cert_manager.cluster_issuer_name
  }
}

resource &quot;kubernetes_ingress_v1&quot; &quot;nginx&quot; {
  metadata {
    name      = &quot;nginx&quot;
    namespace = kubernetes_namespace.project.metadata[0].name
    labels = {
      &quot;ingress&quot; = &quot;entrypoint&quot;
      &quot;app.kubernetes.io/name&quot; = &quot;ingress-nginx&quot;
      &quot;app.kubernetes.io/part-of&quot; = &quot;project&quot;

    }
    annotations = {
      &quot;kubernetes.io/ingress.class&quot; = &quot;nginx&quot;
      &quot;cert-manager.io/cluster-issuer&quot; = module.cert_manager.cluster_issuer_private_key_name
    }
  }

  spec {
    tls {
      hosts       = [&quot;api.project.io&quot;]
      secret_name = module.cert_manager.cluster_issuer_private_key_name
    }

    ingress_class_name = &quot;nginx2&quot;

    rule {
      host = &quot;api.project.io&quot;

      http {

        path {
          path = &quot;/alerts&quot;
          backend {
            service {
              name = kubernetes_service.alerts_service.metadata[0].name
              port {
                name = kubernetes_service.alerts_service.spec[0].port[0].name
              }
            }
            # service {
            #   name = kubernetes_service.entrypoint.metadata[0].name
            #   port {
            #     name = &quot;http&quot;
            #   }
            # }
          }
        }
        path {
          path = &quot;/loader&quot;
          backend {
            service {
              name = kubernetes_service.httploader_service.metadata[0].name
              port {
                name = kubernetes_service.httploader_service.spec[0].port[0].name
              }
            }
            # service {
            #   name = kubernetes_service.entrypoint.metadata[0].name
            #   port {
            #     name = &quot;http&quot;
            #   }
            # }
          }
        }
      }
    }
  }
}

module &quot;nginx-ingress-controller&quot; {
  source = &quot;github.com/danhab99/terraform-kubernetes-nginx-ingress-controller&quot;
  # however recommended way is to add this repository as a submodule
  tls_secret_name = module.cert_manager.cluster_issuer_private_key_name


  namespace = kubernetes_namespace.project.metadata[0].name
  # optional
  tcp_services = {
    &quot;loader&quot; = {
      namespace      = kubernetes_namespace.project.metadata[0].name
      service_name   = kubernetes_service.httploader_service.metadata[0].name
      container_port = local.alerts_port
      ingress_port   = kubernetes_service.httploader_service.spec[0].port[0].port
    },
    &quot;alerts&quot; = {
      namespace      = kubernetes_namespace.project.metadata[0].name
      service_name   = kubernetes_service.alerts_service.metadata[0].name
      container_port = local.httploader_port
      ingress_port   = kubernetes_service.alerts_service.spec[0].port[0].port
    },
  }
  # lb_annotations = {
  #   &quot;service.beta.kubernetes.io/aws-load-balancer-type&quot; = &quot;nlb&quot;
  #   &quot;service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout&quot;: 360
  #   &quot;service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags&quot;: &quot;environment=test,name=kubernetes-ingress&quot;
  # }
}

</code></pre>
<p>Right now ingress is using self signed certificates, I'm not sure where this is happening but I want it to use the letsencrypt private key that's stored in the secret.</p>

Dan
<p>looks like not able to request the certificate and due to that it's using the default self singed cert. that one will get overwritten once cert manager get cert in same secret that you have mapped to ingress.</p>
<p>However i also noticed one mistake try changing it and give it try plus make sure if you are terminating &amp; requesting there is also limit to request cert from let's cert might get block for week.</p>
<pre><code>resource &quot;kubernetes_ingress_v1&quot; &quot;nginx&quot; {
  metadata {
    name      = &quot;nginx&quot;
    namespace = kubernetes_namespace.project.metadata[0].name
    labels = {
      &quot;ingress&quot; = &quot;entrypoint&quot;
      &quot;app.kubernetes.io/name&quot; = &quot;ingress-nginx&quot;
      &quot;app.kubernetes.io/part-of&quot; = &quot;project&quot;

    }
    annotations = {
      &quot;kubernetes.io/ingress.class&quot; = &quot;nginx&quot;
      &quot;cert-manager.io/cluster-issuer&quot; = module.cert_manager.cluster_issuer_name
    }
  }
</code></pre>
<p>value will be : <code>cluster_issuer_name = &quot;cert-manager-global&quot;</code></p>
<p>update this line in above block : <code>&quot;cert-manager.io/cluster-issuer&quot; = module.cert_manager.cluster_issuer_name</code></p>
<p><strong>cluster_issuer_private_key_name</strong> is secret name which will store your <strong>cert</strong>.</p>
<p>You can refer to my answer for fields ref :  <a href="https://stackoverflow.com/a/67178626/5525824">https://stackoverflow.com/a/67178626/5525824</a></p>
