<p>Cert-manager/secret-for-certificate-mapper &quot;msg&quot;=&quot;unable to fetch certificate that owns the secret&quot; &quot;error&quot;=&quot;Certificate.cert-manager.io &quot;grafanaps-tls&quot; not found&quot;</p>
<p>So , from the investigation , I’m not able to find the grafanaps-tls</p>
<blockquote>
<pre><code>Kubectl get certificates
NAME               READY   SECRET             AGE
Alertmanagerdf-tls   False   alertmanagerdf-tls   1y61d
Prometheusps-tls     False   prometheusps-tls     1y58
</code></pre>
</blockquote>
<p>We have do this followings : The nginx ingress and cert-manager were outdated and not compatible with the Kubernetes version of 1.22 anymore. As a result, an upgrade of those components was initiated in order to restore pod operation.</p>
<p>The cmctl check api -n cert-manager command now returns: The cert-manager API has been upgraded to version 1.7 and orphaned secrets have been cleaned up</p>
<p>Cert-manager/webhook &quot;msg&quot;=&quot;Detected root CA rotation - regenerating serving certificates&quot;</p>
<p>After a restart the logs looked mainly clean.</p>
<p>For my finding , the issue is  integration of cert-manager with the Kubernetes ingress controlle .
So I was interest in cert-manager configuration mostly on  <code>ingressshim</code> configuration and <code>args</code> section</p>
<p>It appears that the SSL certificate for several servers has expired and looks like the issue with the certificate resources or the integration of cert-manager with the Kubernetes ingress controller.</p>
<p><strong>Config:</strong></p>
<pre><code>C:\Windows\system32&gt;kubectl describe deployment cert-manager-cabictor -n cert-manager
Name:                   cert-manager-cabictor 
Namespace:              cert-manager
CreationTimestamp:      Thu, 01 Dec 2022 18:31:02 +0530
Labels:                 app=cabictor 
                        app.kubernetes.io/component=cabictor 
                        app.kubernetes.io/instance=cert-manager
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=cabictor 
                        app.kubernetes.io/version=v1.7.3
                        helm.sh/chart=cert-manager-v1.7.3
Annotations:            deployment.kubernetes.io/revision: 2
                        meta.helm.sh/release-name: cert-manager
                        meta.helm.sh/release-namespace: cert-manager
Selector:               app.kubernetes.io/component=cabictor ,app.kubernetes.io/instance=cert-manager,app.kubernetes.io/name=cabictor 
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app=cabictor 
                    app.kubernetes.io/component=cabictor 
                    app.kubernetes.io/instance=cert-manager
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=cabictor 
                    app.kubernetes.io/version=v1.7.3
                    helm.sh/chart=cert-manager-v1.7.3
  Service Account:  cert-manager-cabictor 
  Containers:
   cert-manager:
    Image:      quay.io/jetstack/cert-manager-cabictor :v1.7.3
    Port:       &lt;none&gt;
    Host Port:  &lt;none&gt;
    Args:
      --v=2
      --leader-election-namespace=kube-system
    Environment:
      POD_NAMESPACE:   (v1:metadata.namespace)
    Mounts:           &lt;none&gt;
  Volumes:            &lt;none&gt;
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  &lt;none&gt;
NewReplicaSet:   cert-manager-cabictor -5b65bcdbbd (1/1 replicas created)
Events:          &lt;none&gt;
</code></pre>
<p>I was not able to identify and fix the root cause here ..</p>
<p>What is the problem here, and how can it be resolved? Any help would be greatly appreciated</p>

sam23
<p><strong>Error message:</strong></p>
<p><strong>Cert-manager/secret-for-certificate-mapper &quot;msg&quot;=&quot;unable to fetch certificate that owns the secret&quot; &quot;error&quot;=&quot;Certificate.cert-manager.io &quot;grafanaps-tls&quot; not found&quot;</strong></p>
<p>The above error message says that the certificate corresponding to the certificate file cannot be found in some namespaces</p>
<p>To view the secrets and certificates execute the below command:</p>
<p>kubectl get secrets -n monitoring</p>
<p>kubectl get certificate -n monitoring</p>
<p>The output will show the missing secret and certificate.</p>
<p>As per the GitHub link you can also use the solution.</p>
<p><a href="https://github.com/cert-manager/cert-manager/issues/1944" rel="nofollow noreferrer">https://github.com/cert-manager/cert-manager/issues/1944</a></p>
<blockquote>
<blockquote>
<p>Script to clean up/fix this issue</p>
</blockquote>
<p>&quot;unable to fetch a certificate that owns the secret&quot;</p>
<p>This script will find TLS secrets in a given namespace which have no
matching certificate resource and delete them.</p>
<blockquote>
<p>Usage</p>
</blockquote>
<p>./clean-orphans.sh </p>
<p>Specifying no namespace will check the default. You will be prompted
before anything is deleted.</p>
</blockquote>
<p>For more information refer to the document <a href="https://cert-manager.io/docs/usage/certificate/#cleaning-up-secrets-when-certificates-are-deleted" rel="nofollow noreferrer">cer-manager</a>. You can also refer to the blog by <a href="https://blog.alexellis.io/expose-grafana-dashboards/" rel="nofollow noreferrer">Alex Ellis</a> on Grafana dashboard with TLS.</p>
