<p>I get this error after waiting for a while ~1 min</p>
<pre><code>Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://jenkins.xyz.in/.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I': Get &quot;http://jenkins.xyz.in/.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I&quot;: dial tcp 103.66.96.201:80: connect: connection timed out
</code></pre>
<p>I am able to access this url in the browser from anywhere (internet)</p>
<pre><code>curl -v http://jenkins.xyz.in/.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I
*   Trying 103.66.96.201:80...
* Connected to jenkins.xyz.in (103.66.96.201) port 80 (#0)
&gt; GET /.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I HTTP/1.1
&gt; Host: jenkins.xyz.in
&gt; User-Agent: curl/7.71.1
&gt; Accept: */*
&gt; 
* Mark bundle as not supporting multiuse
&lt; HTTP/1.1 200 OK
&lt; cache-control: no-cache, no-store, must-revalidate
&lt; date: Wed, 13 Jan 2021 08:54:23 GMT
&lt; content-length: 87
&lt; content-type: text/plain; charset=utf-8
&lt; x-envoy-upstream-service-time: 1
&lt; server: istio-envoy
&lt; 
* Connection #0 to host jenkins.xyz.in left intact
AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_VfT4I.EZvkP5Fpi6EYc_-tWTQgvaQxrrbSr2MEJkuXJaywatk
</code></pre>
<p>my setup is:</p>
<pre><code>1. Istio Ingress load balancer running on node (192.168.14.118)
2. I am pointing my external IP and domain jenkins.xyz.in 
to 192.168.14.118 through an another load balancer

request -&gt; public IP -&gt; load balancer -&gt; 192.168.14.118 

</code></pre>
<p>From outside it works fine.
but when I try this from node itself / from pod inside cluster I get :</p>
<pre><code>$ curl -v http://jenkins.xyz.in/
* About to connect() to jenkins.xyz.in port 80 (#0)
*   Trying 103.66.96.201...
</code></pre>
<p>I have read somewhere about <strong>hairpinning</strong></p>
<p>Since my kubernetes node IP and the istio ingress loadbalacer external IPs are same, request might be looping.</p>
<p>EXTRA: I am running k8s on bare metal</p>
<p>is there any solution to get around this?</p>

Arfat Binkileb
<p>I found a work around.</p>
<p>As my node was not able to access the URL (loop),
I added another node to cluster and set Cert-Manager pods affinity to new node.</p>
<p>Cert-Manager was able to access the URL from new node. Although not a good solution, but worked for me.</p>
