<p>There were a namespace &quot;sandbox&quot; on the node which was deleted, but there is still a challenge for a certificate &quot;echo-tls&quot;.
But i can not access anymore sandbox namespace to delete this cert.
Could anyone help me deleting this resource ?</p>
<p>Here are the logs of the cert-manager :</p>
<pre><code>Found status change for Certificate &quot;echo-tls&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to...

cert-manager/controller/CertificateReadiness &quot;msg&quot;=&quot;re-queuing item due to error processing&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \&quot;echo-tls\&quot;: StorageError: invalid object, Code: 4, Key: /cert-manager.io/certificates/sandbox/echo-tls, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: ..., UID in object meta: &quot; &quot;key&quot;=&quot;sandbox/echo-tls&quot;
</code></pre>
<p>After restarting the pod cert-manager here are the logs :</p>
<pre><code>cert-manager/controller/certificaterequests/handleOwnedResource &quot;msg&quot;=&quot;error getting referenced owning resource&quot; &quot;error&quot;=&quot;certificaterequest.cert-manager.io \&quot;echo-tls-bkmm8\&quot; not found&quot; &quot;related_resource_kind&quot;=&quot;CertificateRequest&quot; &quot;related_resource_name&quot;=&quot;echo-tls-bkmm8&quot; &quot;related_resource_namespace&quot;=&quot;sandbox&quot; &quot;resource_kind&quot;=&quot;Order&quot; &quot;resource_name&quot;=&quot;echo-tls-bkmm8-1177139468&quot; &quot;resource_namespace&quot;=&quot;sandbox&quot; &quot;resource_version&quot;=&quot;v1&quot;

cert-manager/controller/orders &quot;msg&quot;=&quot;re-queuing item due to error processing&quot; &quot;error&quot;=&quot;ACME client for issuer not initialised/available&quot; &quot;key&quot;=&quot;sandbox/echo-tls-dwpt4-1177139468&quot;
</code></pre>
<p>And then the same logs as before</p>
<p>The issuer :</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: ***
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress: {}
</code></pre>
<p>The configs for deployment :</p>
<pre><code>---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: &lt;APP_NAME&gt;
  annotations:
    kubernetes.io/tls-acme: &quot;true&quot;
    kubernetes.io/ingress.class: nginx-&lt;ENV&gt;
    acme.cert-manager.io/http01-ingress-class: nginx-&lt;ENV&gt;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
spec:
  tls:
  - hosts:
    - ***.fr
    secretName: &lt;APP_NAME&gt;-tls
  rules:
  - host: ***.fr
    http:
      paths:
      - backend:
          serviceName: &lt;APP_NAME&gt;
          servicePort: 80
</code></pre>
<pre><code>.k8s_config: &amp;k8s_config
  before_script:
    - export HOME=/tmp
    - export K8S_NAMESPACE=&quot;${APP_NAME}&quot;
    - kubectl config set-cluster k8s --server=&quot;${K8S_SERVER}&quot;
    - kubectl config set clusters.k8s.certificate-authority-data ${K8S_CA_DATA}
    - kubectl config set-credentials default --token=&quot;${K8S_USER_TOKEN}&quot;
    - kubectl config set-context default --cluster=k8s --user=default --namespace=default
    - kubectl config set-context ${K8S_NAMESPACE} --cluster=k8s --user=default --namespace=${K8S_NAMESPACE}
    - kubectl config use-context default
    - if [ -z `kubectl get namespace ${K8S_NAMESPACE} --no-headers --output=go-template={{.metadata.name}} 2&gt;/dev/null` ]; then kubectl create namespace ${K8S_NAMESPACE}; fi
    - if [ -z `kubectl --namespace=${K8S_NAMESPACE} get secret *** --no-headers --output=go-template={{.metadata.name}} 2&gt;/dev/null` ]; then kubectl get secret *** --output yaml | sed &quot;s/namespace:\ default/namespace:\ ${K8S_NAMESPACE}/&quot; | kubectl create -f - ; fi
    - kubectl config use-context ${K8S_NAMESPACE}
</code></pre>

Julien SIBILLE
<ol>
<li>Usually certificates are stored inside Kubernete secrets: <a href="https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets</a>. You can retrieve secrets using <code>kubectl get secrets --all-namespaces</code>. You can also check which secrets are used by a given pod by checking its yaml description: <code>kubectl get pods -n &lt;pod-namespace&gt; -o yaml</code> (additional informations: <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod</a>)</li>
<li>A namespace is cluster-wide, it is not located on any node. So deleting a node does not delete any namespace.</li>
<li>If above tracks does not fit your need, could you please provide some yaml files and some command-line instructions which would allow reproducing the problem?</li>
</ol>
