title: Cert-Manager k8s, Renewing certificate process
body: <p>I have installed cert manager on a k8s cluster:</p>
  <pre><code>helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.5.3 --set installCRDs=true
  </code></pre>
  <p>My objective is to do mtls communication between micro-services running in same name-space.</p>
  <p>For this purpose I have created a ca issuer .i.e..</p>
  <pre><code>kubectl get issuer -n sandbox -o yaml
  apiVersion: v1
  items:
  - apiVersion: cert-manager.io/v1
    kind: Issuer
    metadata:
      annotations:
        kubectl.kubernetes.io/last-applied-configuration: |
          {&quot;apiVersion&quot;:&quot;cert-manager.io/v1&quot;,&quot;kind&quot;:&quot;Issuer&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;ca-issuer&quot;,&quot;namespace&quot;:&quot;sandbox&quot;},&quot;spec&quot;:{&quot;ca&quot;:{&quot;secretName&quot;:&quot;tls-internal-ca&quot;}}}
      creationTimestamp: &quot;2021-09-16T17:24:58Z&quot;
      generation: 1
      managedFields:
      - apiVersion: cert-manager.io/v1
        fieldsType: FieldsV1
        fieldsV1:
          f:metadata:
            f:annotations:
              .: {}
              f:kubectl.kubernetes.io/last-applied-configuration: {}
          f:spec:
            .: {}
            f:ca:
              .: {}
              f:secretName: {}
        manager: HashiCorp
        operation: Update
        time: &quot;2021-09-16T17:24:58Z&quot;
      - apiVersion: cert-manager.io/v1
        fieldsType: FieldsV1
        fieldsV1:
          f:status:
            .: {}
            f:conditions: {}
        manager: controller
        operation: Update
        time: &quot;2021-09-16T17:24:58Z&quot;
      name: ca-issuer
      namespace: sandbox
      resourceVersion: &quot;3895820&quot;
      selfLink: /apis/cert-manager.io/v1/namespaces/sandbox/issuers/ca-issuer
      uid: 90f0c811-b78d-4346-bb57-68bf607ee468
    spec:
      ca:
        secretName: tls-internal-ca
    status:
      conditions:
        message: Signing CA verified
        observedGeneration: 1
        reason: KeyPairVerified
        status: &quot;True&quot;
        type: Ready
  kind: List
  metadata:
    resourceVersion: &quot;&quot;
    selfLink: &quot;&quot;
  </code></pre>
  <p>Using this ca issuer, I have created certificates for my two micro-service .i.e.</p>
  <pre><code>kubectl get certificate -n sandbox      
  NAME                       READY         SECRET             Age
  service1-certificate        True    service1-certificate     3d     
  service2-certificate        True    service2-certificate     2d23h
  </code></pre>
  <p>which is configured as</p>
  <pre><code>apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    annotations:
      meta.helm.sh/release-name: service1
      meta.helm.sh/release-namespace: sandbox
    creationTimestamp: &quot;2021-09-17T10:20:21Z&quot;
    generation: 1
    labels:
      app.kubernetes.io/managed-by: Helm
    managedFields:
    - apiVersion: cert-manager.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/managed-by: {}
        f:spec:
          .: {}
          f:commonName: {}
          f:dnsNames: {}
          f:duration: {}
          f:issuerRef:
            .: {}
            f:kind: {}
            f:name: {}
          f:renewBefore: {}
          f:secretName: {}
          f:subject:
            .: {}
            f:organizations: {}
          f:usages: {}
      manager: Go-http-client
      operation: Update
      time: &quot;2021-09-17T10:20:21Z&quot;
    - apiVersion: cert-manager.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:spec:
          f:privateKey: {}
        f:status:
          .: {}
          f:conditions: {}
          f:notAfter: {}
          f:notBefore: {}
          f:renewalTime: {}
          f:revision: {}
      manager: controller
      operation: Update
      time: &quot;2021-09-20T05:14:12Z&quot;
    name: service1-certificate
    namespace: sandbox
    resourceVersion: &quot;5177051&quot;
    selfLink: /apis/cert-manager.io/v1/namespaces/sandbox/certificates/service1-certificate
    uid: 0cf1ea65-92a1-4b03-944e-b847de2c80d9
  spec:
    commonName: example.com
    dnsNames:
    - service1
    duration: 24h0m0s
    issuerRef:
      kind: Issuer
      name: ca-issuer
    renewBefore: 12h0m0s
    secretName: service1-certificate
    subject:
      organizations:
      - myorg
    usages:
    - client auth
    - server auth
  status:
    conditions:
    - lastTransitionTime: &quot;2021-09-20T05:14:13Z&quot;
      message: Certificate is up to date and has not expired
      observedGeneration: 1
      reason: Ready
      status: &quot;True&quot;
      type: Ready
    notAfter: &quot;2021-09-21T05:14:13Z&quot;
    notBefore: &quot;2021-09-20T05:14:13Z&quot;
    renewalTime: &quot;2021-09-20T17:14:13Z&quot;
    revision: 5
  </code></pre>
  <p>Now as you could see in the configuration I have configured to renew them in 12 hours. However, the secrets created via this custom certificate resource are still aged to two days (the first it was created). I was thinking this tls secret will be renewed via cert manager each day) .i.e.</p>
  <pre><code>kubectl get secrets service1-certificate service2-certificate -n sandbox -o wide
  NAME                        TYPE                DATA   AGE
  service1-certificate        kubernetes.io/tls   3      2d23h
  service2-certificate        kubernetes.io/tls   3      3d1h
  </code></pre>
  <p>Is there is some wrong in my understanding? In the <code>certmangager</code> pod logs I do see some error around renewing .i.e.</p>
  <pre><code>I0920 05:14:04.649158       1 trigger_controller.go:181] cert-manager/controller/certificates-trigger &quot;msg&quot;=&quot;Certificate must be re-issued&quot; &quot;key”=“sandbox/service1-certificate&quot; &quot;message&quot;=&quot;Renewing certificate as renewal was scheduled at 2021-09-19 08:24:13 +0000 UTC&quot; &quot;reason&quot;=&quot;Renewing&quot;     
  I0920 05:14:04.649235       1 conditions.go:201] Setting lastTransitionTime for Certificate “service1-certificate&quot; condition &quot;Issuing&quot; to 2021-09-20 05:14:04.649227766 +0000 UTC m=+87949.327215532     
  I0920 05:14:04.652174       1 trigger_controller.go:181] cert-manager/controller/certificates-trigger &quot;msg&quot;=&quot;Certificate must be re-issued&quot; &quot;key&quot;=&quot;sandbox/service2 &quot;message&quot;=&quot;Renewing certificate as renewal was scheduled at 2021-09-19 10:20:22 +0000 UTC&quot; &quot;reason&quot;=&quot;Renewing&quot;     
  I0920 05:14:04.652231       1 conditions.go:201] Setting lastTransitionTime for Certificate “service2-certificate&quot; condition &quot;Issuing&quot; to 2021-09-20 05:14:04.652224302 +0000 UTC m=+87949.330212052     
  I0920 05:14:04.671111       1 conditions.go:190] Found status change for Certificate “service2-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:04.671094596 +0000 UTC m=+87949.349082328
  I0920 05:14:04.671344       1 conditions.go:190] Found status change for Certificate “service1-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:04.671332206 +0000 UTC m=+87949.349319948          
  I0920 05:14:12.703039       1 controller.go:161] cert-manager/controller/certificates-readiness &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox/service2-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service2-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;          
  I0920 05:14:12.703896       1 conditions.go:190] Found status change for Certificate “service2-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:12.7038803 +0000 UTC m=+87957.381868045          
  I0920 05:14:12.749502       1 controller.go:161] cert-manager/controller/certificates-readiness &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox/service1-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service1-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;          
  I0920 05:14:12.750096       1 conditions.go:190] Found status change for Certificate “service1-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:12.750082572 +0000 UTC m=+87957.428070303     
  I0920 05:14:13.009032       1 controller.go:161] cert-manager/controller/certificates-key-manager &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key&quot;=&quot;sandbox/service1-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service1-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;     
  I0920 05:14:13.117843       1 controller.go:161] cert-manager/controller/certificates-readiness &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox/service2-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service2-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;     
  I0920 05:14:13.119366       1 conditions.go:190] Found status change for Certificate “service2-certificate&quot; condition &quot;Ready&quot;: &quot;True&quot; -&gt; &quot;False&quot;; setting lastTransitionTime to 2021-09-20 05:14:13.119351795 +0000 UTC m=+87957.797339520     
  I0920 05:14:13.122820       1 controller.go:161] cert-manager/controller/certificates-key-manager &quot;msg&quot;=&quot;re-queuing item due to optimistic locking on resource&quot; &quot;key”=“sandbox\service2-certificate&quot; &quot;error&quot;=&quot;Operation cannot be fulfilled on certificates.cert-manager.io \”service-certificate\&quot;: the object has been modified; please apply your changes to the latest version and try again&quot;     
  I0920 05:14:13.123907       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “service2-certificate-t92qh&quot; condition &quot;Approved&quot; to 2021-09-20 05:14:13.123896104 +0000 UTC m=+87957.801883833
  I0920 05:14:13.248082       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “service1-certificate-p9stz&quot; condition &quot;Approved&quot; to 2021-09-20 05:14:13.248071551 +0000 UTC m=+87957.926059296
  I0920 05:14:13.253488       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “serivce2-certificate-t92qh&quot; condition &quot;Ready&quot; to 2021-09-20 05:14:13.253474153 +0000 UTC m=+87957.931461871
  I0920 05:14:13.388001       1 conditions.go:261] Setting lastTransitionTime for CertificateRequest “service1-certificate-p9stz&quot; condition &quot;Ready&quot; to 2021-09-20 05:14:13.387983783 +0000 UTC m=+87958.065971525     
  </code></pre>