<p>I recently updated the nginx-controller in my kubernetes cluster. The current behavior when multiple ingress resources are defined is &quot;choose winner&quot;. Meaning that if there are 2 ingress resources to the same host, nginx will only define one of them, instead of merging the paths.</p>
<p>The way to get around this seems to be documented <a href="https://github.com/nginxinc/kubernetes-ingress/tree/v2.3.0/examples/mergeable-ingress-types" rel="nofollow noreferrer">here</a>, which describes the solution by adding annotations of <code>nginx.org/mergeable-ingress-type</code>.</p>
<p>However, to the best of my knowledge, cert-manager does not create the ingresses with these annotation. Resulting with a 404 for the challenge url (or worse: a 404 to the site I'm trying to create a certificate for)</p>
<p>Here is the ingress serving the site:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: farmers
  annotations:
    nginx.org/mergeable-ingress-type: &quot;master&quot;
spec:
  ingressClassName: nginx
  - host: farmers.klino.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend
            port:
              number: 80
</code></pre>
<p>And the ingress of the challenge:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  generateName: cm-acme-http-solver-
  generation: 3
  labels:
    acme.cert-manager.io/http-domain: &quot;...&quot;
    acme.cert-manager.io/http-token: &quot;...&quot;
    acme.cert-manager.io/http01-solver: &quot;true&quot;
  name: cm-acme-http-solver-7677r
  namespace: staging
spec:
  rules:
  - host: farmers.klino.me
    http:
      paths:
      - backend:
          service:
            name: cm-acme-http-solver-hkx6g
            port:
              number: 8089
        path: /.well-known/acme-challenge/&lt;...reducted...&gt;
        pathType: ImplementationSpecific

</code></pre>
<p>In summary, I have 2 ingress resources to the host <code>farmers.klino.me</code>, on serving the site at <code>/</code>, the other - created automatically by certmanager - serving the challenge at <code>/.well-known/acme-challenge/&lt;...reducted...&gt;</code>.</p>
<p>How should I configure the nginx-ingress and cert-manager to merge the ingresses and work together without human intervention?</p>

Tom Klino
<p><strong>EDIT:</strong> There appears to be two different NGINX Ingress controller deployments. One called <a href="https://artifacthub.io/packages/helm/nginx/nginx-ingress" rel="nofollow noreferrer">nginx-ingress</a> and the other called <a href="https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx" rel="nofollow noreferrer">ingress-nginx</a></p>
<p>The one you want is <a href="https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx" rel="nofollow noreferrer">ingress-nginx</a>. This version automatically merges the ingress rules created by cert-manager and instantly all my certificates renewed. The controller documentation can be found <a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">here</a> and the cert-manager documentation found <a href="https://cert-manager.io/docs/tutorials/acme/nginx-ingress/" rel="nofollow noreferrer">here</a> is applicable.</p>
<p>Hope this helps!</p>
<p><strong>Original Post:</strong>
I'm also experiencing the same issue. I've not yet tried it but it looks like you can configure an ingressTemplate for your given issuer. For example:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: ...
spec:
  acme:
    server: ...
    privateKeySecretRef:
      name: ...
    solvers:
    - http01:
        ingress:
          ingressTemplate:
            metadata:
              labels:
                foo: &quot;bar&quot;
              annotations:
                &quot;nginx.ingress.kubernetes.io/whitelist-source-range&quot;: &quot;0.0.0.0/0,::/0&quot;
                &quot;nginx.org/mergeable-ingress-type&quot;: &quot;minion&quot;
                &quot;traefik.ingress.kubernetes.io/frontend-entry-points&quot;: &quot;http&quot;
</code></pre>
<p>See <a href="https://cert-manager.io/v1.6-docs/configuration/acme/http01/#ingresstemplate" rel="nofollow noreferrer">https://cert-manager.io/v1.6-docs/configuration/acme/http01/#ingresstemplate</a> for more details.</p>
<p>This doesn't seem like the most efficient way to handle this issue though so if anyone has a better solution I'm all ears.</p>
