I0821 00:29:03.134557 1 feature_gate.go:249] feature gates: &{map[AdditionalCertificateOutputFormats:true]} I0821 00:29:03.134753 1 start.go:75] cert-manager "msg"="starting controller" "git-commit"="b1d501c85d97afd2adde2e86c2b119ac060caece" "version"="v1.11.5" I0821 00:29:03.134795 1 controller.go:242] cert-manager/controller/build-context "msg"="configured acme dns01 nameservers" "nameservers"=["10.96.0.10:53"] W0821 00:29:03.134868 1 client_config.go:618] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. I0821 00:29:03.136056 1 controller.go:70] cert-manager/controller "msg"="enabled controllers: [certificaterequests-approver certificaterequests-issuer-acme certificaterequests-issuer-ca certificaterequests-issuer-selfsigned certificaterequests-issuer-vault certificaterequests-issuer-venafi certificates-issuing certificates-key-manager certificates-metrics certificates-readiness certificates-request-manager certificates-revision-manager certificates-trigger challenges clusterissuers ingress-shim issuers orders]" I0821 00:29:03.136402 1 controller.go:134] cert-manager/controller "msg"="starting leader election" I0821 00:29:03.136579 1 controller.go:91] cert-manager/controller "msg"="starting metrics server" "address"={"IP":"::","Port":9402,"Zone":""} I0821 00:29:03.138991 1 leaderelection.go:248] attempting to acquire leader lease cert-manager/cert-manager-controller... I0821 00:29:03.151659 1 leaderelection.go:258] successfully acquired lease cert-manager/cert-manager-controller I0821 00:29:03.152848 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-approver" I0821 00:29:03.153627 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-venafi" I0821 00:29:03.154495 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-issuing" I0821 00:29:03.155087 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-acme" I0821 00:29:03.155202 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-revision-manager" I0821 00:29:03.156313 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="challenges" I0821 00:29:03.156953 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="ingress-shim" I0821 00:29:03.157588 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-vault" I0821 00:29:03.158769 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-key-manager" I0821 00:29:03.159523 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-metrics" I0821 00:29:03.159930 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-readiness" I0821 00:29:03.160301 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-selfsigned" I0821 00:29:03.160350 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-request-manager" I0821 00:29:03.160736 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="gateway-shim" I0821 00:29:03.160793 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="orders" I0821 00:29:03.161273 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-vault" I0821 00:29:03.161341 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-selfsigned" I0821 00:29:03.161888 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="clusterissuers" I0821 00:29:03.162250 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-acme" I0821 00:29:03.163005 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-ca" I0821 00:29:03.163406 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-ca" I0821 00:29:03.163425 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-venafi" I0821 00:29:03.163450 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-trigger" I0821 00:29:03.163904 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="issuers" I0821 00:29:28.420344 1 conditions.go:96] Setting lastTransitionTime for Issuer "test-selfsigned" condition "Ready" to 2026-08-21 00:29:28.42031816 +0000 UTC m=+25.319267038 I0821 00:29:28.444053 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="cert-manager-test/selfsigned-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:28.444267 1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Issuing" to 2026-08-21 00:29:28.444261043 +0000 UTC m=+25.343209921 I0821 00:29:28.444327 1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-08-21 00:29:28.444318275 +0000 UTC m=+25.343267143 I0821 00:29:28.464150 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"selfsigned-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="cert-manager-test/selfsigned-cert" I0821 00:29:28.464223 1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-08-21 00:29:28.464191525 +0000 UTC m=+25.363140393 E0821 00:29:28.475898 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"test-selfsigned\" not found" I0821 00:29:28.521790 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-08-21 00:29:28.521775939 +0000 UTC m=+25.420724837 I0821 00:29:28.549605 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:28.549878 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-08-21 00:29:28.549865366 +0000 UTC m=+25.448814264 I0821 00:29:28.550095 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-08-21 00:29:28.550087516 +0000 UTC m=+25.449036414 E0821 00:29:28.568689 1 controller.go:167] cert-manager/certificates-key-manager "msg"="re-queuing item due to error processing" "error"="secrets \"selfsigned-cert-\" is forbidden: unable to create new content in namespace cert-manager-test because it is being terminated" "key"="cert-manager-test/selfsigned-cert" I0821 00:29:28.572326 1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0821 00:29:28.572386 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:28.572403 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-08-21 00:29:28.572397849 +0000 UTC m=+25.471346727 I0821 00:29:28.760504 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-jqbd5" condition "Approved" to 2026-08-21 00:29:28.759748909 +0000 UTC m=+25.658697797 I0821 00:29:28.812553 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-jqbd5" condition "Ready" to 2026-08-21 00:29:28.812543751 +0000 UTC m=+25.711492629 I0821 00:29:28.851880 1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-08-21 00:29:28.851864733 +0000 UTC m=+25.750813631 I0821 00:29:28.882342 1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0821 00:29:28.959992 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0821 00:29:29.243045 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-08-21 00:29:29.243032632 +0000 UTC m=+26.141981540 I0821 00:29:29.265788 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-08-21 00:29:29.265778691 +0000 UTC m=+26.164727569 I0821 00:29:29.266064 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:29.266096 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-08-21 00:29:29.266089404 +0000 UTC m=+26.165038282 I0821 00:29:29.283983 1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0821 00:29:29.284061 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:29.284076 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-08-21 00:29:29.28407254 +0000 UTC m=+26.183021418 I0821 00:29:29.414743 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-88btg" condition "Approved" to 2026-08-21 00:29:29.414734519 +0000 UTC m=+26.313683387 I0821 00:29:29.466285 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-88btg" condition "Ready" to 2026-08-21 00:29:29.466275735 +0000 UTC m=+26.365224603 I0821 00:29:29.541406 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-08-21 00:29:29.541397417 +0000 UTC m=+26.440346285 I0821 00:29:29.568867 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0821 00:29:29.569335 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-08-21 00:29:29.569326137 +0000 UTC m=+26.468275015 I0821 00:29:29.626579 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0821 00:29:29.673288 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-08-21 00:29:29.673276967 +0000 UTC m=+26.572225835 I0821 00:29:29.696988 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:29.697014 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Issuing" to 2026-08-21 00:29:29.697007719 +0000 UTC m=+26.595956597 I0821 00:29:29.697097 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-08-21 00:29:29.697079782 +0000 UTC m=+26.596028690 I0821 00:29:29.718636 1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0821 00:29:29.718716 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:29.718734 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Issuing" to 2026-08-21 00:29:29.718730674 +0000 UTC m=+26.617679542 I0821 00:29:29.882268 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-4qpgm" condition "Approved" to 2026-08-21 00:29:29.882256484 +0000 UTC m=+26.781205362 I0821 00:29:29.921761 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-4qpgm" condition "Ready" to 2026-08-21 00:29:29.921752987 +0000 UTC m=+26.820701855 I0821 00:29:30.013177 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-08-21 00:29:30.013164726 +0000 UTC m=+26.912113604 I0821 00:29:30.092991 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0821 00:29:30.093247 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-08-21 00:29:30.093242455 +0000 UTC m=+26.992191323 I0821 00:29:30.128648 1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-08-21 00:29:30.128628545 +0000 UTC m=+27.027577453 I0821 00:29:30.159981 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-08-21 00:29:30.159967811 +0000 UTC m=+27.058916679 I0821 00:29:30.160142 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:30.160161 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-08-21 00:29:30.160158239 +0000 UTC m=+27.059107107 I0821 00:29:30.281821 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0821 00:29:30.436898 1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0821 00:29:30.437103 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0821 00:29:30.437121 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-08-21 00:29:30.437117697 +0000 UTC m=+27.336066565 I0821 00:29:30.951452 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0821 00:29:30.958744 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-bvcgr" condition "Approved" to 2026-08-21 00:29:30.958726722 +0000 UTC m=+27.857675630 I0821 00:29:31.048862 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-bvcgr" condition "Ready" to 2026-08-21 00:29:31.048853168 +0000 UTC m=+27.947802046 I0821 00:29:31.383899 1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-08-21 00:29:31.383887992 +0000 UTC m=+28.282836870 I0821 00:29:31.552477 1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0821 00:29:31.629975 1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0821 00:29:31.930479 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" E0821 00:30:37.702268 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-selfsigned-issuer\" not found" I0821 00:30:37.736166 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-08-21 00:30:37.73613524 +0000 UTC m=+94.635084118 I0821 00:30:37.754684 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-08-21 00:30:37.754672913 +0000 UTC m=+94.653621811 E0821 00:30:39.964943 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-bootstrap-selfsigned-issuer\" not found" I0821 00:30:40.007904 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-08-21 00:30:40.007890609 +0000 UTC m=+96.906839507 I0821 00:30:40.030242 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-08-21 00:30:40.030233096 +0000 UTC m=+96.929181954 E0821 00:30:41.797917 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-control-plane-selfsigned-issuer\" not found" I0821 00:30:41.847171 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-08-21 00:30:41.847152159 +0000 UTC m=+98.746101077 I0821 00:30:41.862164 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-08-21 00:30:41.86215711 +0000 UTC m=+98.761105978 E0821 00:30:43.515237 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capo-selfsigned-issuer\" not found" I0821 00:30:43.552527 1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-08-21 00:30:43.552505295 +0000 UTC m=+100.451454173 I0821 00:30:43.573504 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-08-21 00:30:43.573490072 +0000 UTC m=+100.472438950