Can't install cert-manager on a Kubernetes managed cluster

I’m trying to use GitLab to install cert-manager on my Kubernetes cluster, but the install-certmanager fails.

This is the image that’s being used:

Here’s the log:

+ s=1
+ sleep 1s
+ echo 'Retrying (62)...'
+ kubectl apply -f /data/helm/certmanager/config/cluster_issuer.yaml
Retrying (62)...
Error from server (InternalError): error when creating "/data/helm/certmanager/config/cluster_issuer.yaml": Internal error occurred: failed calling webhook "": the server is currently unable to handle the request

This goes on for something like 90 tries before failing.

This is the output of kubectl get pods -n gitlab-managed-apps:

NAME                                                     READY   STATUS    RESTARTS   AGE
certmanager-cainjector-94548d659-j5pns                   1/1     Running   0          29m
certmanager-cert-manager-69876f799c-mjvtc                1/1     Running   0          29m
certmanager-cert-manager-webhook-7bf65494bd-dzggz        1/1     Running   2          29m
ingress-nginx-ingress-controller-65bdf6b6d5-62lcx        2/2     Running   0          32m
ingress-nginx-ingress-default-backend-76d9f87474-cqhh9   1/1     Running   0          32m
install-certmanager                                      0/1     Error     0          9m51s
tiller-deploy-7f847cb9d9-mwfgz                           1/1     Running   0          36m

This is the output of kubectl get services -n gitlab-managed-apps:

NAME                                    TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
certmanager-cert-manager                ClusterIP   <none>        9402/TCP                     31m
certmanager-cert-manager-webhook        ClusterIP    <none>        443/TCP                      31m
ingress-nginx-ingress-controller        LoadBalancer   <redacted>    80:31643/TCP,443:30157/TCP   34m
ingress-nginx-ingress-default-backend   ClusterIP   <none>        80/TCP                       34m
tiller-deploy                           ClusterIP   <none>        44134/TCP                    38m

I can’t really understand what’s going on, as everything seems to be running fine besides the install pod.

I ran into the same issue, turns out that it was caused by the fact that I was running Kubernetes on a private cluster with Google (GKE).

You’ll run into this issue:

A resolution is to adjust the Google Firewall, the exact rule is listed here:

1 Like