<p><a href="https://i.stack.imgur.com/Fbhna.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Fbhna.png" alt="enter image description here" /></a></p>
<p>I encourage an issue regarding setup the TLS Cert-Manager Controller on GKE for WSO2 API Management.</p>
<hr />
<p>I am using WSO2 product Docker images available from WSO2 Private Docker Registry, following the Helm Chart for the deployment of WSO2 API Manager with WSO2 API Manager Analytics on Github (<a href="https://github.com/wso2/kubernetes-apim/blob/master/advanced/am-pattern-1/README.md" rel="nofollow noreferrer">README</a>). And I successfully deployed the WSO2 API Manager with Nginx Ingress Controller (<a href="https://medium.com/bluekiri/deploy-a-nginx-ingress-and-a-certitificate-manager-controller-on-gke-using-helm-3-8e2802b979ec" rel="nofollow noreferrer">deploy-a-nginx-ingress-and-a-certitificate-manager-controller-on-gke</a>).</p>
<hr />
<p>I want to create a Kubernetes cluster on Google Cloud Platform using an Nginx Ingress Controller to integrate with a certificate manager to automate the process of issue and renew the required certificates.</p>
<hr />
<p>I easily replicate the TLS Cert-Manager Controller on GKE for HelloWorld example from the same medium tutorial (<a href="https://medium.com/bluekiri/deploy-a-nginx-ingress-and-a-certitificate-manager-controller-on-gke-using-helm-3-8e2802b979ec" rel="nofollow noreferrer">deploy-a-nginx-ingress-and-a-certitificate-manager-controller-on-gke</a>).</p>
<p><a href="https://i.stack.imgur.com/PFLOs.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PFLOs.jpg" alt="enter image description here" /></a></p>
<p><strong>hello-app-ingress.yaml</strong></p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/issuer: letsencrypt-production
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;networking.k8s.io/v1beta1&quot;,&quot;kind&quot;:&quot;Ingress&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{&quot;cert-manager.io/issuer&quot;:&quot;letsencrypt-production&quot;,&quot;kubernetes.io/ingress.class&quot;:&quot;nginx&quot;,&quot;nginx.ingress.kubernetes.io/ssl-redirect&quot;:&quot;true&quot;},&quot;name&quot;:&quot;hello-app-ingress&quot;,&quot;namespace&quot;:&quot;default&quot;},&quot;spec&quot;:{&quot;rules&quot;:[{&quot;host&quot;:&quot;test.japangly.xyz&quot;,&quot;http&quot;:{&quot;paths&quot;:[{&quot;backend&quot;:{&quot;serviceName&quot;:&quot;hello-app&quot;,&quot;servicePort&quot;:8080},&quot;path&quot;:&quot;/helloworld&quot;}]}}],&quot;tls&quot;:[{&quot;hosts&quot;:[&quot;test.japangly.xyz&quot;],&quot;secretName&quot;:&quot;test-japangly-xyz-tls&quot;}]}}
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
  creationTimestamp: &quot;2020-08-30T04:27:12Z&quot;
  generation: 3
  name: hello-app-ingress
  namespace: default
  resourceVersion: &quot;6478&quot;
  selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/hello-app-ingress
  uid: ea2d8b13-e9b6-4cb0-873d-76ed40253e4f
spec:
  rules:
  - host: test.japangly.xyz
    http:
      paths:
      - backend:
          serviceName: hello-app
          servicePort: 8080
        path: /helloworld
  tls:
  - hosts:
    - test.japangly.xyz
    secretName: test-japangly-xyz-tls
status:
  loadBalancer:
    ingress:
    - ip: 35.239.145.46
</code></pre>
<p>However, not working the WSO2 API Management, all I get is</p>
<blockquote>
<p>Kubernetes Ingress Controller Fake Certificate</p>
</blockquote>
<p><a href="https://i.stack.imgur.com/xx4d5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xx4d5.png" alt="enter image description here" /></a></p>
<p><strong>wso2am-pattern-1-am-ingress.yaml</strong></p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/issuer: letsencrypt-production
    kubernetes.io/ingress.class: nginx
    meta.helm.sh/release-name: wso2am-pattern-1
    meta.helm.sh/release-namespace: wso2-apim
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
    nginx.ingress.kubernetes.io/session-cookie-name: route
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
  creationTimestamp: &quot;2020-08-30T04:41:10Z&quot;
  generation: 4
  labels:
    app.kubernetes.io/managed-by: Helm
  name: wso2am-pattern-1-am-ingress
  namespace: wso2-apim
  resourceVersion: &quot;88840&quot;
  selfLink: /apis/extensions/v1beta1/namespaces/wso2-apim/ingresses/wso2am-pattern-1-am-ingress
  uid: 58f4b549-a565-493b-9f9f-72ad76877819
spec:
  rules:
  - host: am.japangly.xyz
    http:
      paths:
      - backend:
          serviceName: wso2am-pattern-1-am-service
          servicePort: 9443
        path: /
  tls:
  - hosts:
    - am.japangly.xyz
    secretName: am-japangly-xyz-tls
status:
  loadBalancer:
    ingress:
    - ip: 35.239.145.46
</code></pre>

Japang LY
<p>As I said in the comment:</p>
<blockquote>
<p>I ran setup like yours and noticed that the <code>cert-manager</code> was creating the secret but was not provisioning it further. <code>Issuer</code> is namespaced resource and needs to be in namespace where your <code>Ingress</code> resides. Please tell if your namespace <code>wso2-apim</code> have the <code>Issuer</code> needed to provide the certificate. For troubleshooting you can run <code>$ kubectl describe certificate -n namespace</code>. Also the fake Kubernetes certificate is used when there is an issue with a <code>tls: secret</code> part.</p>
</blockquote>
<p>I wanted to give more insight on what the potential issue may be and some other tips working with <code>nginx-ingress</code>.</p>
<hr />
<p>Certificate showing as <code>Kubernetes Ingress Controller Fake Certificate</code> will kick in when there are issues with the actual secret storing the certificate used in the <code>Ingress</code> definition.</p>
<p>One of the possible situations where <code>Fake Certificate</code> will kick in is in the lack of the actual secret with a certificate.</p>
<hr />
<p>As pointed in the part of my comment, <code>Issuer</code> is a namespaced resource and it needs to be in a namespace that <code>Ingress</code> and <code>secret</code> is created. It will create a <code>secret</code> but it will not progress further with signing.</p>
<p>Looking on your setup:</p>
<ul>
<li><code>nginx-ingress</code> controller spawned in <code>nginx</code> namespace (<strong>GOOD</strong>)</li>
<li><code>cert-manager</code> spawned in namespace <code>cert-manager</code> namespace (<strong>GOOD</strong>)</li>
<li><code>Issuer</code> for certificates spawned in <code>default</code> namespace (<strong>POTENTIAL ISSUE</strong>)</li>
<li><code>WSO2</code> application spawned in <code>wso2-apim</code> namespace (<strong>POTENTIAL ISSUE</strong>)</li>
</ul>
<p>To make it work you can either:</p>
<ul>
<li>Run your <code>WSO2</code> application in <code>default</code> namespace same as <code>Issuer</code></li>
<li>Create an <code>Issuer</code> in <code>wso2-apim</code> namespace</li>
<li>Create a <a href="https://docs.cert-manager.io/en/release-0.11/reference/clusterissuers.html" rel="nofollow noreferrer">ClusterIssuer</a></li>
</ul>
<p>As pointed by official documentation:</p>
<blockquote>
<p>An <code>Issuer</code> is a namespaced resource, and it is not possible to issue certificates from an <code>Issuer</code> in a different namespace. This means you will need to create an <code>Issuer</code> in each namespace you wish to obtain <code>Certificates</code> in.</p>
<p><em><a href="https://cert-manager.io/docs/concepts/issuer/" rel="nofollow noreferrer">Cert-manager.io: Docs: Concepts: Issuer</a></em></p>
</blockquote>
<hr />
<p>As for troubleshooting steps you can invoke following commands:</p>
<ul>
<li><code>$ kubectl describe issuer ISSUER_NAME -n namespace</code></li>
<li><code>$ kubectl describe certificate CERTIFICATE_NAME -n namespace</code></li>
<li><code>$ kubectl describe secret SECRET_NAME -n namespace</code></li>
</ul>
<hr />
<p>Assuming that:</p>
<ul>
<li>You have a working Kubernetes cluster</li>
<li>You have spawned <code>nginx-ingress</code> and have the <code>LoadBalancer IP</code> provisioned correctly</li>
<li>You have a domain name pointing to the <code>LoadBalancer IP</code> of your <code>nginx-ingress</code> controller</li>
</ul>
<p>After that you spawned:</p>
<ul>
<li><code>example</code> namespace</li>
<li><code>hello-app</code> as in medium guide:
<ul>
<li><code>$ kubectl create deployment hello-app --image=gcr.io/google-samples/hello-app:1.0 -n example</code></li>
</ul>
</li>
<li>exposed it locally
<ul>
<li><code>$ kubectl expose deployment hello-app --type=NodePort --port=8080 -n example</code></li>
</ul>
</li>
<li>created an <code>Ingress</code> resource like below:</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress
  namespace: example
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/issuer: &quot;letsencrypt-prod&quot;
spec:
  tls:
  - hosts:
    - super.example.com
    secretName: super-example-tls
  rules:
  - host: super.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: hello-app
          servicePort: 8080
</code></pre>
<p>With no <code>Issuer</code> in the <code>example</code> namespace the logs from the certificate will look like that:</p>
<ul>
<li><code>$ kubectl describe certificate super-example-tls -n example</code></li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Issuing    6m33s  cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  6m33s  cert-manager  Stored new private key in temporary Secret resource &quot;super-example-tls-XXXXX&quot;
  Normal  Requested  6m33s  cert-manager  Created new CertificateRequest resource &quot;super-example-tls-XXXXX&quot;
</code></pre>
<p><code>Issuer.yaml</code> used in an example for more reference:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: Issuer
metadata:
  name: letsencrypt-prod
  namespace: example
spec: 
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: PUT_EMAIL_ADDRESS_HERE
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx
</code></pre>
<p>After you create an <code>Issuer</code> you should see a new event in <code>certificate</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>  Normal  Issuing    25s    cert-manager  The certificate has been successfully issued
</code></pre>
