Can't install cert-manager on a Kubernetes managed cluster

Infrastructure as Code & Cloud Native
,
1

I’m trying to use GitLab to install cert-manager on my Kubernetes cluster, but the install-certmanager fails.

This is the image that’s being used: registry.gitlab.com/gitlab-org/cluster-integration/helm-install-image/releases/2.16.6-kube-1.13.12

Here’s the log:

+ s=1
+ sleep 1s
+ echo 'Retrying (62)...'
+ kubectl apply -f /data/helm/certmanager/config/cluster_issuer.yaml
Retrying (62)...
Error from server (InternalError): error when creating "/data/helm/certmanager/config/cluster_issuer.yaml": Internal error occurred: failed calling webhook "webhook.certmanager.k8s.io": the server is currently unable to handle the request

This goes on for something like 90 tries before failing.

This is the output of kubectl get pods -n gitlab-managed-apps:

NAME                                                     READY   STATUS    RESTARTS   AGE
certmanager-cainjector-94548d659-j5pns                   1/1     Running   0          29m
certmanager-cert-manager-69876f799c-mjvtc                1/1     Running   0          29m
certmanager-cert-manager-webhook-7bf65494bd-dzggz        1/1     Running   2          29m
ingress-nginx-ingress-controller-65bdf6b6d5-62lcx        2/2     Running   0          32m
ingress-nginx-ingress-default-backend-76d9f87474-cqhh9   1/1     Running   0          32m
install-certmanager                                      0/1     Error     0          9m51s
tiller-deploy-7f847cb9d9-mwfgz                           1/1     Running   0          36m

This is the output of kubectl get services -n gitlab-managed-apps:

NAME                                    TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
certmanager-cert-manager                ClusterIP      10.243.131.146   <none>        9402/TCP                     31m
certmanager-cert-manager-webhook        ClusterIP      10.243.131.95    <none>        443/TCP                      31m
ingress-nginx-ingress-controller        LoadBalancer   10.243.131.186   <redacted>    80:31643/TCP,443:30157/TCP   34m
ingress-nginx-ingress-default-backend   ClusterIP      10.243.131.149   <none>        80/TCP                       34m
tiller-deploy                           ClusterIP      10.243.131.164   <none>        44134/TCP                    38m

I can’t really understand what’s going on, as everything seems to be running fine besides the install pod.

2

I ran into the same issue, turns out that it was caused by the fact that I was running Kubernetes on a private cluster with Google (GKE).

You’ll run into this issue: https://github.com/jetstack/cert-manager/issues/2109

A resolution is to adjust the Google Firewall, the exact rule is listed here: https://github.com/jetstack/cert-manager/issues/2109#issuecomment-535901422

1 Like