title: Creating a ManagedCertificate results in "Status: FailedNotVisible"
body: <p>Using Kubernetes 1.12.6-gke.7 or higher it is possible to create a ManagedCertificate which is then referenced from an Ingress Resource exposing a Service to the Internet. </p>
  
  <p>Running kubectl describe managedcertificate certificate-name first indicates the certificate is in a Provisioning state but eventually goes to FailedNotVisible.</p>
  
  <p>Despite using a Static IP and DNS that resolves fine to the http version of said service all ManagedCertificate's end up in a "Status:  FailedNotVisible" state.</p>
  
  <p>Outline of what I am doing:</p>
  
  <ol>
  <li><p>Generating a reserved (static) external IP Address</p></li>
  <li><p>Configuring DNS A record in CloudDNS to subdomain.domain.com to generated IP address from step 1.</p></li>
  <li>Creating a ManagedCertificate named "subdomain-domain-certificate" with kubectl apply -f with spec:domains containing a single domain corresponding to subdomain.domain.com DNS record in step 2.</li>
  <li>Creating a simple deployment and service exposing it</li>
  <li>Creating Ingress resource referring to default backend of service in step 4 as well as annotations for static ip created in step 1 and managed certificate generated in step 3.</li>
  <li>Confirm that Ingress is created and is assigned static IP</li>
  <li>Visiting <a href="http://subdomain.domain.com" rel="noreferrer">http://subdomain.domain.com</a> serves the output from pod created in deployment in step 4</li>
  </ol>
  
  <p>After a little while </p>
  
  <blockquote>
    <p>kubectl describe managedcertificate subdomain-domain-certificate</p>
  </blockquote>
  
  <p>results in "Status:  FailedNotVisible".</p>
  
  <pre><code>Name:         subdomain-domain-certificate
  Namespace:    default
  Labels:       &lt;none&gt;
  Annotations:  &lt;none&gt;
  API Version:  networking.gke.io/v1beta1
  Kind:         ManagedCertificate
  Metadata:
    Creation Timestamp:  2019-04-15T17:35:22Z
    Generation:          1
    Resource Version:    52637
    Self Link:           /apis/networking.gke.io/v1beta1/namespaces/default/managedcertificates/subdomain-domain-certificate
    UID:                 d8e5a0a4-5fa4-11e9-984e-42010a84001c
  Spec:
    Domains:
      subdomain.domain.com
  Status:
    Certificate Name:    mcrt-ac63730e-c271-4826-9154-c198d654f9f8
    Certificate Status:  Provisioning
    Domain Status:
      Domain:  subdomain.domain.com
      Status:  FailedNotVisible
  Events:
    Type    Reason  Age   From                            Message
    ----    ------  ----  ----                            -------
    Normal  Create  56m   managed-certificate-controller  Create SslCertificate mcrt-ac63730e-c271-4826-9154-c198d654f9f8
  </code></pre>
  
  <p>From what I understand if the Load Balancer is configured correctly (done under the hood in the ManagedCertificate resource) and the DNS (which resolves fine to the non https endpoint) checks out the certificate should go in to a Status: Active state?</p>