[{"data":1,"prerenderedAt":1273},["ShallowReactive",2],{"navigation_docs":3,"-troubleshooting-install-failures":136,"-troubleshooting-install-failures-surround":1268},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":116,"body":138,"description":1262,"extension":1263,"links":1264,"meta":1265,"navigation":471,"path":117,"seo":1266,"stem":118,"__hash__":1267},"docs\u002F6.troubleshooting\u002F1.install-failures.md",{"type":139,"value":140,"toc":1243},"minimark",[141,145,149,181,192,199,206,216,224,250,279,289,306,312,323,327,339,381,384,390,395,400,527,533,537,549,593,605,622,626,641,644,686,691,703,740,770,774,783,860,866,870,875,921,938,955,972,991,995,1002,1007,1013,1016,1046,1049,1061,1065,1078,1088,1095,1103,1156,1176,1193,1198,1236,1239],[142,143,116],"h1",{"id":144},"install-failures",[146,147,148],"p",{},"Start here, always:",[150,151,156],"pre",{"className":152,"code":153,"language":154,"meta":155,"style":155},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kubectl -n my-mvno get pods\n","bash","",[157,158,159],"code",{"__ignoreMap":155},[160,161,164,168,172,175,178],"span",{"class":162,"line":163},"line",1,[160,165,167],{"class":166},"sBMFI","kubectl",[160,169,171],{"class":170},"sfazB"," -n",[160,173,174],{"class":170}," my-mvno",[160,176,177],{"class":170}," get",[160,179,180],{"class":170}," pods\n",[146,182,183,184,187,188,191],{},"The pod that is not ",[157,185,186],{},"Running"," tells you which section below you are in. Substitute your own release name and namespace for ",[157,189,190],{},"my-mvno"," throughout.",[146,193,194,195,198],{},"If nothing scheduled at all, ",[157,196,197],{},"helm install"," may have failed at render, before Kubernetes saw a single object. The two sections below cover that case.",[200,201,203,205],"h2",{"id":202},"helm-install-fails-with-needs-the-cloudnativepg-operator-or-strimzi",[157,204,197],{}," fails with \"needs the CloudNativePG operator\" (or Strimzi)",[146,207,208,212,213,215],{},[209,210,211],"strong",{},"Symptom."," ",[157,214,197],{}," exits immediately with an error naming an operator, instead of creating any objects:",[150,217,222],{"className":218,"code":220,"language":221},[219],"language-text","Error: INSTALLATION FAILED: execution error at (platform\u002Ftemplates\u002Fdata-postgres.yaml:2:4):\npostgres.mode=operator needs the CloudNativePG operator, and this cluster does not have it. The postgresql.cnpg.io\u002Fv1 CRDs are not registered.\n...\n","text",[157,223,220],{"__ignoreMap":155},[146,225,226,229,230,233,234,237,238,241,242,245,246,249],{},[209,227,228],{},"Cause."," This is the chart's preflight check working as intended, not a bug. ",[157,231,232],{},"postgres.mode"," and ",[157,235,236],{},"kafka.mode"," both default to ",[157,239,240],{},"operator",", which means the chart renders a CNPG ",[157,243,244],{},"Cluster"," or a Strimzi ",[157,247,248],{},"Kafka"," object. If the matching CRDs are not registered in your cluster, that object would just sit there with nothing reconciling it, so the chart refuses to render instead.",[146,251,252,255,256,259,260,263,264,267,268,271,272,275,276,278],{},[209,253,254],{},"Fix."," Either install the missing operator, or switch that service to external mode. The error message names the exact install command for the operator; ",[257,258,18],"a",{"href":19}," has the one-command path (",[157,261,262],{},".\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh",") and the raw commands. To skip the operator instead, set ",[157,265,266],{},"postgres.mode=external"," or ",[157,269,270],{},"kafka.mode=external"," and fill in the matching ",[157,273,274],{},"external.*"," fields; see ",[257,277,53],{"href":54},".",[200,280,282,285,286],{"id":281},"helm-install-wait-times-out-one-pod-crashlooping-with-resend_api_key-is-required",[157,283,284],{},"helm install --wait"," times out, one pod crashlooping with ",[157,287,288],{},"RESEND_API_KEY is required",[146,290,291,212,294,297,298,301,302,305],{},[209,292,293],{},"On the current chart you should not see this.",[157,295,296],{},"ess.enabled"," defaults to ",[157,299,300],{},"true",", and a missing ",[157,303,304],{},"auth.resendAPIKey"," is now caught at render:",[150,307,310],{"className":308,"code":309,"language":221},[219],"Error: INSTALLATION FAILED: execution error at (platform\u002Ftemplates\u002Fess.yaml:18:4):\ness.enabled is true but auth.resendAPIKey is empty. The email sender cannot boot without it and the install will hang on a crashloop. Either set auth.resendAPIKey=\u003Cyour Resend key>, or set ess.enabled=false to run without transactional email.\n",[157,311,309],{"__ignoreMap":155},[146,313,314,315,318,319,322],{},"That message is the fix: either set ",[157,316,317],{},"--set auth.resendAPIKey=\u003Cyour Resend key>",", or ",[157,320,321],{},"--set ess.enabled=false"," to install without transactional email. If you are instead watching a pod actually crashloop on this error (rather than getting the render-time message above), you are on an older chart version; upgrade, or apply the same fix to the values that pod is running with.",[200,324,326],{"id":325},"pods-stuck-on-imagepullbackoff","Pods stuck on ImagePullBackOff",[146,328,329,331,332,267,335,338],{},[209,330,211],{}," One or more pods sit in ",[157,333,334],{},"ErrImagePull",[157,336,337],{},"ImagePullBackOff"," and never start.",[150,340,342],{"className":152,"code":341,"language":154,"meta":155,"style":155},"kubectl -n my-mvno describe pod \u003Cpod-name> | tail -25\n",[157,343,344],{"__ignoreMap":155},[160,345,346,348,350,352,355,358,362,365,369,372,375,378],{"class":162,"line":163},[160,347,167],{"class":166},[160,349,171],{"class":170},[160,351,174],{"class":170},[160,353,354],{"class":170}," describe",[160,356,357],{"class":170}," pod",[160,359,361],{"class":360},"sMK4o"," \u003C",[160,363,364],{"class":170},"pod-nam",[160,366,368],{"class":367},"sTEyZ","e",[160,370,371],{"class":360},">",[160,373,374],{"class":360}," |",[160,376,377],{"class":166}," tail",[160,379,380],{"class":170}," -25\n",[146,382,383],{},"The Events section ends with something like:",[150,385,388],{"className":386,"code":387,"language":221},[219],"Failed to pull image \"ghcr.io\u002Fsolvegio\u002Fmvno-api:latest\": ... denied\n",[157,389,387],{"__ignoreMap":155},[146,391,392,394],{},[209,393,228],{}," Every first-party image ships from GHCR. If the packages you were given access to are private, the cluster has no credentials to pull them and Kubernetes cannot see the difference between \"private\" and \"does not exist\".",[146,396,397,399],{},[209,398,254],{}," Create a pull secret and point the chart at it:",[150,401,403],{"className":152,"code":402,"language":154,"meta":155,"style":155},"kubectl -n my-mvno create secret docker-registry ghcr-pull \\\n  --docker-server=ghcr.io \\\n  --docker-username=\u003Cuser> \\\n  --docker-password=\u003Ctoken>\n\nhelm upgrade my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform \\\n  --version \u003Cversion> --namespace my-mvno -f my-values.yaml \\\n  --set imagePullSecret=ghcr-pull\n",[157,404,405,428,436,452,466,473,489,518],{"__ignoreMap":155},[160,406,407,409,411,413,416,419,422,425],{"class":162,"line":163},[160,408,167],{"class":166},[160,410,171],{"class":170},[160,412,174],{"class":170},[160,414,415],{"class":170}," create",[160,417,418],{"class":170}," secret",[160,420,421],{"class":170}," docker-registry",[160,423,424],{"class":170}," ghcr-pull",[160,426,427],{"class":367}," \\\n",[160,429,431,434],{"class":162,"line":430},2,[160,432,433],{"class":170},"  --docker-server=ghcr.io",[160,435,427],{"class":367},[160,437,439,442,445,448,450],{"class":162,"line":438},3,[160,440,441],{"class":170},"  --docker-username=",[160,443,444],{"class":360},"\u003C",[160,446,447],{"class":170},"user",[160,449,371],{"class":360},[160,451,427],{"class":367},[160,453,455,458,460,463],{"class":162,"line":454},4,[160,456,457],{"class":170},"  --docker-password=",[160,459,444],{"class":360},[160,461,462],{"class":170},"token",[160,464,465],{"class":360},">\n",[160,467,469],{"class":162,"line":468},5,[160,470,472],{"emptyLinePlaceholder":471},true,"\n",[160,474,476,479,482,484,487],{"class":162,"line":475},6,[160,477,478],{"class":166},"helm",[160,480,481],{"class":170}," upgrade",[160,483,174],{"class":170},[160,485,486],{"class":170}," oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform",[160,488,427],{"class":367},[160,490,492,495,497,500,503,505,508,510,513,516],{"class":162,"line":491},7,[160,493,494],{"class":170},"  --version",[160,496,361],{"class":360},[160,498,499],{"class":170},"versio",[160,501,502],{"class":367},"n",[160,504,371],{"class":360},[160,506,507],{"class":170}," --namespace",[160,509,174],{"class":170},[160,511,512],{"class":170}," -f",[160,514,515],{"class":170}," my-values.yaml",[160,517,427],{"class":367},[160,519,521,524],{"class":162,"line":520},8,[160,522,523],{"class":170},"  --set",[160,525,526],{"class":170}," imagePullSecret=ghcr-pull\n",[146,528,529,530,278],{},"If your cluster has no egress to GHCR at all, you are on the mirroring path instead. See ",[257,531,532],{"href":62},"Registry and airgap",[200,534,536],{"id":535},"pods-stuck-pending-with-no-image-error","Pods stuck Pending, with no image error",[146,538,539,212,541,544,545,548],{},[209,540,211],{},[157,542,543],{},"Pending",", and ",[157,546,547],{},"describe pod"," shows no pull attempt at all.",[150,550,552],{"className":152,"code":551,"language":154,"meta":155,"style":155},"kubectl -n my-mvno describe pod \u003Cpod-name> | tail -25\nkubectl -n my-mvno get pvc\n",[157,553,554,580],{"__ignoreMap":155},[160,555,556,558,560,562,564,566,568,570,572,574,576,578],{"class":162,"line":163},[160,557,167],{"class":166},[160,559,171],{"class":170},[160,561,174],{"class":170},[160,563,354],{"class":170},[160,565,357],{"class":170},[160,567,361],{"class":360},[160,569,364],{"class":170},[160,571,368],{"class":367},[160,573,371],{"class":360},[160,575,374],{"class":360},[160,577,377],{"class":166},[160,579,380],{"class":170},[160,581,582,584,586,588,590],{"class":162,"line":430},[160,583,167],{"class":166},[160,585,171],{"class":170},[160,587,174],{"class":170},[160,589,177],{"class":170},[160,591,592],{"class":170}," pvc\n",[146,594,595,597,598,601,602,604],{},[209,596,228],{}," Either the scheduler has nowhere to put the pod (",[157,599,600],{},"0\u002F1 nodes are available: Insufficient memory","), or a PersistentVolumeClaim is ",[157,603,543],{}," because the cluster has no default StorageClass. A fresh k3s or kind cluster usually has one. A stripped-down managed cluster sometimes does not.",[146,606,607,609,610,613,614,617,618,621],{},[209,608,254],{}," For storage, ",[157,611,612],{},"kubectl get storageclass"," and check one is marked ",[157,615,616],{},"(default)",". For capacity, either add a node or lower the requests: every workload's ",[157,619,620],{},"resources.requests"," is a chart value.",[200,623,625],{"id":624},"the-api-never-becomes-ready","The API never becomes Ready",[146,627,628,212,630,633,634,267,637,640],{},[209,629,211],{},[157,631,632],{},"my-mvno-platform-api-..."," sits at ",[157,635,636],{},"Init:0\u002F2",[157,638,639],{},"Init:1\u002F2"," indefinitely. Nothing crashes. Nothing logs an error. It just waits.",[146,642,643],{},"The API is gated behind two init containers, and each one waits for a different thing.",[150,645,647],{"className":152,"code":646,"language":154,"meta":155,"style":155},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-api -c wait-for-auth\nkubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-api -c wait-for-lease\n",[157,648,649,669],{"__ignoreMap":155},[160,650,651,653,655,657,660,663,666],{"class":162,"line":163},[160,652,167],{"class":166},[160,654,171],{"class":170},[160,656,174],{"class":170},[160,658,659],{"class":170}," logs",[160,661,662],{"class":170}," deploy\u002Fmy-mvno-platform-api",[160,664,665],{"class":170}," -c",[160,667,668],{"class":170}," wait-for-auth\n",[160,670,671,673,675,677,679,681,683],{"class":162,"line":430},[160,672,167],{"class":166},[160,674,171],{"class":170},[160,676,174],{"class":170},[160,678,659],{"class":170},[160,680,662],{"class":170},[160,682,665],{"class":170},[160,684,685],{"class":170}," wait-for-lease\n",[687,688,690],"h3",{"id":689},"wait-for-auth-never-releases","wait-for-auth never releases",[146,692,693,695,696,699,700,278],{},[209,694,228],{}," GoTrue has not finished creating the ",[157,697,698],{},"auth.users"," table, usually because the auth pod itself is not healthy. The API's boot migrations have a foreign key onto that table, so starting early would fail with ",[157,701,702],{},"relation \"auth.users\" does not exist",[150,704,706],{"className":152,"code":705,"language":154,"meta":155,"style":155},"kubectl -n my-mvno get pods -l app.kubernetes.io\u002Fcomponent=auth\nkubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-auth\n",[157,707,708,727],{"__ignoreMap":155},[160,709,710,712,714,716,718,721,724],{"class":162,"line":163},[160,711,167],{"class":166},[160,713,171],{"class":170},[160,715,174],{"class":170},[160,717,177],{"class":170},[160,719,720],{"class":170}," pods",[160,722,723],{"class":170}," -l",[160,725,726],{"class":170}," app.kubernetes.io\u002Fcomponent=auth\n",[160,728,729,731,733,735,737],{"class":162,"line":430},[160,730,167],{"class":166},[160,732,171],{"class":170},[160,734,174],{"class":170},[160,736,659],{"class":170},[160,738,739],{"class":170}," deploy\u002Fmy-mvno-platform-auth\n",[146,741,742,744,745,748,749,751,752,755,756,759,760,762,763,766,767,769],{},[209,743,254],{}," In operator mode (",[157,746,747],{},"postgres.mode=operator",", the default) this normally resolves itself within a minute of the CNPG ",[157,750,244],{}," becoming ready, since the chart bootstraps the ",[157,753,754],{},"supabase_auth_admin"," role and the ",[157,757,758],{},"auth"," schema for you as part of that ",[157,761,244],{},". In external mode it usually does not, because GoTrue needs that role and schema to exist already, and the chart only bootstraps them in operator mode. Create them out of band, then set ",[157,764,765],{},"postgres.external.authAdminPassword"," to that role's password and upgrade. ",[257,768,53],{"href":54}," has the details.",[687,771,773],{"id":772},"wait-for-lease-never-releases","wait-for-lease never releases",[146,775,776,778,779,782],{},[209,777,228],{}," The license agent has not written ",[157,780,781],{},"PARENT_LEASE_TOKEN"," into the platform Secret, so the platform is not licensed and refuses to serve. This is by far the more common of the two. The init container is doing its job: an unlicensed platform never comes up.",[150,784,786],{"className":152,"code":785,"language":154,"meta":155,"style":155},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent\nkubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.PARENT_LEASE_TOKEN}' | base64 -d | head -c 20; echo\n",[157,787,788,801,818],{"__ignoreMap":155},[160,789,790,792,794,796,798],{"class":162,"line":163},[160,791,167],{"class":166},[160,793,171],{"class":170},[160,795,174],{"class":170},[160,797,659],{"class":170},[160,799,800],{"class":170}," deploy\u002Fmy-mvno-platform-license-agent\n",[160,802,803,805,807,809,811,813,816],{"class":162,"line":430},[160,804,167],{"class":166},[160,806,171],{"class":170},[160,808,174],{"class":170},[160,810,177],{"class":170},[160,812,418],{"class":170},[160,814,815],{"class":170}," my-mvno-platform-env",[160,817,427],{"class":367},[160,819,820,823,826,829,832,834,836,839,842,844,847,849,853,856],{"class":162,"line":438},[160,821,822],{"class":170},"  -o",[160,824,825],{"class":170}," jsonpath=",[160,827,828],{"class":360},"'",[160,830,831],{"class":170},"{.data.PARENT_LEASE_TOKEN}",[160,833,828],{"class":360},[160,835,374],{"class":360},[160,837,838],{"class":166}," base64",[160,840,841],{"class":170}," -d",[160,843,374],{"class":360},[160,845,846],{"class":166}," head",[160,848,665],{"class":170},[160,850,852],{"class":851},"sbssI"," 20",[160,854,855],{"class":360},";",[160,857,859],{"class":858},"s2Zo4"," echo\n",[146,861,862,863,865],{},"An empty value confirms it. The agent's own log says why, and ",[257,864,120],{"href":121}," matches the line you find to a cause. Do not delete the init container, and do not scale the agent up to make it go faster.",[200,867,869],{"id":868},"the-ingress-has-no-address","The Ingress has no address",[146,871,872,874],{},[209,873,211],{}," DNS resolves, or does not, and nothing answers on your host.",[150,876,878],{"className":152,"code":877,"language":154,"meta":155,"style":155},"kubectl -n my-mvno get ingress\nkubectl -n ingress-nginx get svc ingress-nginx-controller\ndig +short api.acme.com\n",[157,879,880,893,910],{"__ignoreMap":155},[160,881,882,884,886,888,890],{"class":162,"line":163},[160,883,167],{"class":166},[160,885,171],{"class":170},[160,887,174],{"class":170},[160,889,177],{"class":170},[160,891,892],{"class":170}," ingress\n",[160,894,895,897,899,902,904,907],{"class":162,"line":430},[160,896,167],{"class":166},[160,898,171],{"class":170},[160,900,901],{"class":170}," ingress-nginx",[160,903,177],{"class":170},[160,905,906],{"class":170}," svc",[160,908,909],{"class":170}," ingress-nginx-controller\n",[160,911,912,915,918],{"class":162,"line":438},[160,913,914],{"class":166},"dig",[160,916,917],{"class":170}," +short",[160,919,920],{"class":170}," api.acme.com\n",[146,922,923,926,927,930,931,934,935,278],{},[209,924,925],{},"Cause, one."," The ",[157,928,929],{},"ADDRESS"," column on your Ingress is empty. No ingress controller has claimed it. The chart's Ingress objects are nginx-only (",[157,932,933],{},"ingress.className: nginx","); if your cluster runs Traefik (the k3s default) or a GKE Gateway, nothing picks the object up. Install ingress-nginx, or install k3s with ",[157,936,937],{},"--disable traefik",[146,939,940,943,944,946,947,950,951,954],{},[209,941,942],{},"Cause, two."," The Ingress has an address, but ",[157,945,914],{}," returns nothing or the wrong IP. Your DNS A record does not point at the ingress controller's external IP. The chart does not manage DNS: ",[157,948,949],{},"ingress.externalDNS"," is ",[157,952,953],{},"false"," by default, which means the record is yours to create.",[146,956,957,959,960,963,964,967,968,971],{},[209,958,254],{}," Point an A record (or a wildcard ",[157,961,962],{},"*.acme.com",") at the ",[157,965,966],{},"EXTERNAL-IP"," of the ",[157,969,970],{},"ingress-nginx-controller"," Service, then wait for propagation before you go looking at certificates.",[146,973,974,977,978,981,982,233,985,988,989,278],{},[209,975,976],{},"Cause, three."," The API Ingress works but the app or realtime host does not exist. Those two Ingresses only render when the workload is enabled ",[209,979,980],{},"and"," you gave it its own host. Set ",[157,983,984],{},"ingress.hosts.app",[157,986,987],{},"ingress.hosts.realtime",", otherwise the workload stays reachable in-cluster only. See ",[257,990,40],{"href":41},[200,992,994],{"id":993},"cert-manager-never-issues-a-certificate","cert-manager never issues a certificate",[687,996,998,999],{"id":997},"on-gke-autopilot-every-certificate-fails-with-x509-certificate-signed-by-unknown-authority","On GKE Autopilot: every certificate fails with ",[157,1000,1001],{},"x509: certificate signed by unknown authority",[146,1003,1004,1006],{},[209,1005,211],{}," Every cert-manager resource you create fails, cluster-wide, with:",[150,1008,1011],{"className":1009,"code":1010,"language":221},[219],"x509: certificate signed by unknown authority\n",[157,1012,1010],{"__ignoreMap":155},[146,1014,1015],{},"That error looks like a TLS or DNS problem and points nowhere near the real cause. Before you touch DNS or the ClusterIssuer, check cainjector's logs:",[150,1017,1019],{"className":152,"code":1018,"language":154,"meta":155,"style":155},"kubectl -n cert-manager logs deploy\u002Fcert-manager-cainjector | grep -i leader\n",[157,1020,1021],{"__ignoreMap":155},[160,1022,1023,1025,1027,1030,1032,1035,1037,1040,1043],{"class":162,"line":163},[160,1024,167],{"class":166},[160,1026,171],{"class":170},[160,1028,1029],{"class":170}," cert-manager",[160,1031,659],{"class":170},[160,1033,1034],{"class":170}," deploy\u002Fcert-manager-cainjector",[160,1036,374],{"class":360},[160,1038,1039],{"class":166}," grep",[160,1041,1042],{"class":170}," -i",[160,1044,1045],{"class":170}," leader\n",[146,1047,1048],{},"If you see leader election being denied, this is it.",[146,1050,1051,1053,1054,1057,1058,1060],{},[209,1052,228],{}," cert-manager defaults leader election to the ",[157,1055,1056],{},"kube-system"," namespace. GKE Autopilot's Warden admission controller blocks anything from writing to ",[157,1059,1056],{},", so cainjector never wins the election, never becomes leader, and never injects the CA bundle into the webhooks that validate every cert-manager resource. Every certificate created after that point fails, not just the one for your platform host.",[146,1062,1063],{},[209,1064,254],{},[150,1066,1068],{"className":152,"code":1067,"language":154,"meta":155,"style":155},"--set global.leaderElection.namespace=cert-manager\n",[157,1069,1070],{"__ignoreMap":155},[160,1071,1072,1075],{"class":162,"line":163},[160,1073,1074],{"class":166},"--set",[160,1076,1077],{"class":170}," global.leaderElection.namespace=cert-manager\n",[146,1079,1080,1081,1084,1085,1087],{},"on the cert-manager install itself. ",[157,1082,1083],{},"install-prereqs.sh"," sets this unconditionally, for exactly this reason; if you installed cert-manager some other way, add the flag and reinstall it. ",[257,1086,18],{"href":19}," has the full callout.",[687,1089,1091,1092],{"id":1090},"otherwise-the-certificate-stays-ready-false","Otherwise: the certificate stays ",[157,1093,1094],{},"READY: False",[146,1096,1097,1099,1100,1102],{},[209,1098,211],{}," The site loads over HTTPS with a browser warning, or does not load at all. The certificate stays ",[157,1101,1094],{},", and cainjector's logs are clean.",[150,1104,1106],{"className":152,"code":1105,"language":154,"meta":155,"style":155},"kubectl -n my-mvno get certificate\nkubectl -n my-mvno describe certificate \u003Cname>\nkubectl -n my-mvno get certificaterequest,order,challenge\n",[157,1107,1108,1121,1143],{"__ignoreMap":155},[160,1109,1110,1112,1114,1116,1118],{"class":162,"line":163},[160,1111,167],{"class":166},[160,1113,171],{"class":170},[160,1115,174],{"class":170},[160,1117,177],{"class":170},[160,1119,1120],{"class":170}," certificate\n",[160,1122,1123,1125,1127,1129,1131,1134,1136,1139,1141],{"class":162,"line":430},[160,1124,167],{"class":166},[160,1126,171],{"class":170},[160,1128,174],{"class":170},[160,1130,354],{"class":170},[160,1132,1133],{"class":170}," certificate",[160,1135,361],{"class":360},[160,1137,1138],{"class":170},"nam",[160,1140,368],{"class":367},[160,1142,465],{"class":360},[160,1144,1145,1147,1149,1151,1153],{"class":162,"line":438},[160,1146,167],{"class":166},[160,1148,171],{"class":170},[160,1150,174],{"class":170},[160,1152,177],{"class":170},[160,1154,1155],{"class":170}," certificaterequest,order,challenge\n",[146,1157,1158,1160,1161,1164,1165,1168,1169,1172,1173,1175],{},[209,1159,925],{}," No issuer. ",[157,1162,1163],{},"kubectl get clusterissuer"," returns nothing, or nothing named ",[157,1166,1167],{},"letsencrypt-prod",". The chart defaults ",[157,1170,1171],{},"ingress.clusterIssuer"," to ",[157,1174,1167],{}," and expects it to exist. Create it, or point the value at the issuer you already have.",[146,1177,1178,1180,1181,1184,1185,1188,1189,1192],{},[209,1179,942],{}," The HTTP-01 challenge cannot be reached. ",[157,1182,1183],{},"describe challenge"," reports ",[157,1186,1187],{},"Waiting for HTTP-01 challenge propagation"," and the reason is almost always upstream of cert-manager: DNS is not pointing at your cluster yet, or port 80 is closed on the firewall in front of it. Let's Encrypt has to reach ",[157,1190,1191],{},"http:\u002F\u002Fapi.acme.com\u002F.well-known\u002Facme-challenge\u002F..."," from the public internet, over plain HTTP.",[146,1194,1195,1197],{},[209,1196,254],{}," Get DNS and port 80 right first. cert-manager retries with a backoff, so it will pick up a fixed DNS record on its own within a few minutes. To push it, delete the stuck Challenge and let it recreate:",[150,1199,1201],{"className":152,"code":1200,"language":154,"meta":155,"style":155},"kubectl -n my-mvno delete challenge --all\nkubectl -n cert-manager logs deploy\u002Fcert-manager --tail=50\n",[157,1202,1203,1220],{"__ignoreMap":155},[160,1204,1205,1207,1209,1211,1214,1217],{"class":162,"line":163},[160,1206,167],{"class":166},[160,1208,171],{"class":170},[160,1210,174],{"class":170},[160,1212,1213],{"class":170}," delete",[160,1215,1216],{"class":170}," challenge",[160,1218,1219],{"class":170}," --all\n",[160,1221,1222,1224,1226,1228,1230,1233],{"class":162,"line":430},[160,1223,167],{"class":166},[160,1225,171],{"class":170},[160,1227,1029],{"class":170},[160,1229,659],{"class":170},[160,1231,1232],{"class":170}," deploy\u002Fcert-manager",[160,1234,1235],{"class":170}," --tail=50\n",[146,1237,1238],{},"If you hit Let's Encrypt rate limits while debugging (five failed authorizations per hostname per hour), switch to their staging issuer until DNS is settled, then switch back.",[1240,1241,1242],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}",{"title":155,"searchDepth":163,"depth":430,"links":1244},[1245,1247,1249,1250,1251,1255,1256],{"id":202,"depth":430,"text":1246},"helm install fails with \"needs the CloudNativePG operator\" (or Strimzi)",{"id":281,"depth":430,"text":1248},"helm install --wait times out, one pod crashlooping with RESEND_API_KEY is required",{"id":325,"depth":430,"text":326},{"id":535,"depth":430,"text":536},{"id":624,"depth":430,"text":625,"children":1252},[1253,1254],{"id":689,"depth":438,"text":690},{"id":772,"depth":438,"text":773},{"id":868,"depth":430,"text":869},{"id":993,"depth":430,"text":994,"children":1257},[1258,1260],{"id":997,"depth":438,"text":1259},"On GKE Autopilot: every certificate fails with x509: certificate signed by unknown authority",{"id":1090,"depth":438,"text":1261},"Otherwise: the certificate stays READY: False","Pods that will not pull, an API that never goes ready, an Ingress with no address, and certificates that never issue.","md",null,{},{"title":116,"description":1262},"cMa8WlB4uJI5Z6C3cC9eu93GMbam7_QnLp1jBHQtSnY",[1269,1271],{"title":107,"path":108,"stem":109,"description":1270,"children":-1},"Operator-mode data services, multiple API replicas, and the one component that must stay at a single replica.",{"title":120,"path":121,"stem":122,"description":1272,"children":-1},"Spent activation codes, an unreachable parent, 401s on renewal, and a platform that has parked itself.",1783967741116]