title: Google Managed SSL Certificate Stuck on FAILED_NOT_VISIBLE
body: <p>I'm trying to configure an HTTPS/Layer 7 Load Balancer with GKE. I'm following <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates" rel="nofollow noreferrer">SSL certificates overview</a> and <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">GKE Ingress for HTTP(S) Load Balancing</a>.</p>
  <p>My config. has worked for some time.  I wanted to test Google's managed service.</p>
  <p>This is how I've set it up so far:</p>
  <p><code>k8s/staging/staging-ssl.yml</code>:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: my-staging-lb-ingress
    annotations:
      kubernetes.io/ingress.global-static-ip-name: &quot;my-staging-global&quot;
      ingress.gcp.kubernetes.io/pre-shared-cert: &quot;staging-google-managed-ssl&quot;
      kubernetes.io/ingress.allow-http: &quot;false&quot;
  spec:
    rules:
    - host: staging.my-app.no
      http:
        paths:
        - path: /*
          backend:
            serviceName: my-svc
            servicePort: 3001
  </code></pre>
  <pre class="lang-shell prettyprint-override"><code>gcloud compute addresses list
  
  #=&gt;
  
  NAME                   REGION  ADDRESS          STATUS
  my-staging-global              35.244.160.NNN  RESERVED
  </code></pre>
  <pre class="lang-shell prettyprint-override"><code>host staging.my-app.no 
  
  #=&gt;
  
  35.244.160.NNN
  </code></pre>
  <p>but it is stuck on <code>FAILED_NOT_VISIBLE</code>:</p>
  <pre class="lang-shell prettyprint-override"><code>gcloud beta compute ssl-certificates describe staging-google-managed-ssl
  
  #=&gt;
  
  creationTimestamp: '2018-12-20T04:59:39.450-08:00'
  id: 'NNNN'
  kind: compute#sslCertificate
  managed:
    domainStatus:
      staging.my-app.no: FAILED_NOT_VISIBLE
    domains:
    - staging.my-app.no
    status: PROVISIONING
  name: staging-google-managed-ssl
  selfLink: https://www.googleapis.com/compute/beta/projects/my-project/global/sslCertificates/staging-google-managed-ssl
  type: MANAGED
  </code></pre>
  <p>Any idea on how I can fix or debug this further?</p>
  <hr />
  <p>I found a section in the doc I linked to at the beginning of the post
  <strong>Associating SSL certificate resources with a target proxy:</strong></p>
  <blockquote>
  <p>Use the following gcloud command to associate SSL certificate resources with a target proxy, whether the SSL certificates are self-managed or Google-managed.</p>
  </blockquote>
  <pre class="lang-shell prettyprint-override"><code>gcloud compute target-https-proxies create [NAME] \
  --url-map=[URL_MAP] \
  --ssl-certificates=[SSL_CERTIFICATE1][,[SSL_CERTIFICATE2], [SSL_CERTIFICATE3],...]
  </code></pre>
  <p>Is that necessary when I have this line in <code>k8s/staging/staging-ssl.yml</code>?</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      . . .
      ingress.gcp.kubernetes.io/pre-shared-cert: &quot;staging-google-managed-ssl&quot;
      . . .
  </code></pre>