I0417 00:55:23.230603 1 feature_gate.go:249] feature gates: &{map[AdditionalCertificateOutputFormats:true]} I0417 00:55:23.230898 1 start.go:75] cert-manager "msg"="starting controller" "git-commit"="b1d501c85d97afd2adde2e86c2b119ac060caece" "version"="v1.11.5" I0417 00:55:23.230964 1 controller.go:242] cert-manager/controller/build-context "msg"="configured acme dns01 nameservers" "nameservers"=["10.96.0.10:53"] W0417 00:55:23.231075 1 client_config.go:618] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. I0417 00:55:23.233879 1 controller.go:70] cert-manager/controller "msg"="enabled controllers: [certificaterequests-approver certificaterequests-issuer-acme certificaterequests-issuer-ca certificaterequests-issuer-selfsigned certificaterequests-issuer-vault certificaterequests-issuer-venafi certificates-issuing certificates-key-manager certificates-metrics certificates-readiness certificates-request-manager certificates-revision-manager certificates-trigger challenges clusterissuers ingress-shim issuers orders]" I0417 00:55:23.234626 1 controller.go:134] cert-manager/controller "msg"="starting leader election" I0417 00:55:23.234912 1 controller.go:91] cert-manager/controller "msg"="starting metrics server" "address"={"IP":"::","Port":9402,"Zone":""} I0417 00:55:23.235370 1 leaderelection.go:248] attempting to acquire leader lease cert-manager/cert-manager-controller... I0417 00:55:23.251212 1 leaderelection.go:258] successfully acquired lease cert-manager/cert-manager-controller I0417 00:55:23.252718 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="orders" I0417 00:55:23.253783 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-acme" I0417 00:55:23.254517 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-ca" I0417 00:55:23.255875 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-vault" I0417 00:55:23.256586 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-issuing" I0417 00:55:23.256735 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-key-manager" I0417 00:55:23.257087 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-readiness" I0417 00:55:23.257592 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-request-manager" I0417 00:55:23.258137 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="issuers" I0417 00:55:23.258508 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-ca" I0417 00:55:23.258570 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-metrics" I0417 00:55:23.259229 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="clusterissuers" I0417 00:55:23.259633 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="gateway-shim" I0417 00:55:23.260437 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="challenges" I0417 00:55:23.260471 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="ingress-shim" I0417 00:55:23.260587 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-approver" I0417 00:55:23.263706 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-selfsigned" I0417 00:55:23.264551 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-venafi" I0417 00:55:23.265336 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-acme" I0417 00:55:23.265373 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-selfsigned" I0417 00:55:23.265478 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-revision-manager" I0417 00:55:23.266125 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-vault" I0417 00:55:23.266161 1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-trigger" I0417 00:55:23.266164 1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-venafi" I0417 00:55:52.653574 1 conditions.go:96] Setting lastTransitionTime for Issuer "test-selfsigned" condition "Ready" to 2026-04-17 00:55:52.65354677 +0000 UTC m=+29.457883879 I0417 00:55:52.667734 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="cert-manager-test/selfsigned-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0417 00:55:52.667759 1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Issuing" to 2026-04-17 00:55:52.66775412 +0000 UTC m=+29.472091229 I0417 00:55:52.668021 1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-04-17 00:55:52.668008827 +0000 UTC m=+29.472345956 E0417 00:55:52.696806 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"test-selfsigned\" not found" E0417 00:55:52.708591 1 controller.go:167] cert-manager/certificates-readiness "msg"="re-queuing item due to error processing" "error"="certificates.cert-manager.io \"selfsigned-cert\" not found" "key"="cert-manager-test/selfsigned-cert" E0417 00:55:52.719257 1 controller.go:167] cert-manager/certificates-trigger "msg"="re-queuing item due to error processing" "error"="certificates.cert-manager.io \"selfsigned-cert\" not found" "key"="cert-manager-test/selfsigned-cert" I0417 00:55:52.741407 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-04-17 00:55:52.741394031 +0000 UTC m=+29.545731130 I0417 00:55:52.756082 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0417 00:55:52.756108 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-04-17 00:55:52.756104495 +0000 UTC m=+29.560441604 I0417 00:55:52.756088 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-04-17 00:55:52.756081475 +0000 UTC m=+29.560418584 I0417 00:55:52.776217 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0417 00:55:52.776263 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-04-17 00:55:52.776257785 +0000 UTC m=+29.580594894 I0417 00:55:53.073726 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0417 00:55:53.138018 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-q4xdl" condition "Approved" to 2026-04-17 00:55:53.138010127 +0000 UTC m=+29.942347226 I0417 00:55:53.181514 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-q4xdl" condition "Ready" to 2026-04-17 00:55:53.181500177 +0000 UTC m=+29.985837316 I0417 00:55:53.229101 1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:53.229089997 +0000 UTC m=+30.033427096 I0417 00:55:53.273310 1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0417 00:55:53.399730 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert" I0417 00:55:53.414280 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-04-17 00:55:53.414258998 +0000 UTC m=+30.218596107 I0417 00:55:53.429422 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-04-17 00:55:53.429408592 +0000 UTC m=+30.233745701 I0417 00:55:53.429647 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0417 00:55:53.429696 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-04-17 00:55:53.42968723 +0000 UTC m=+30.234024339 I0417 00:55:53.452065 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0417 00:55:53.452200 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-04-17 00:55:53.452121398 +0000 UTC m=+30.256458497 I0417 00:55:53.750842 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-04-17 00:55:53.750829568 +0000 UTC m=+30.555166677 I0417 00:55:53.769472 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0417 00:55:53.769671 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Issuing" to 2026-04-17 00:55:53.76966345 +0000 UTC m=+30.574000569 I0417 00:55:53.771618 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-04-17 00:55:53.770116813 +0000 UTC m=+30.574453922 I0417 00:55:53.788237 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0417 00:55:53.788286 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-04-17 00:55:53.788281107 +0000 UTC m=+30.592618206 I0417 00:55:54.122246 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0417 00:55:54.172713 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-9zcvh" condition "Approved" to 2026-04-17 00:55:54.172702158 +0000 UTC m=+30.977039267 I0417 00:55:54.185068 1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-04-17 00:55:54.185051267 +0000 UTC m=+30.989388366 I0417 00:55:54.187625 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0417 00:55:54.197735 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-9zcvh" condition "Ready" to 2026-04-17 00:55:54.197723823 +0000 UTC m=+31.002060932 I0417 00:55:54.331646 1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist" I0417 00:55:54.331695 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-04-17 00:55:54.331686846 +0000 UTC m=+31.136023985 I0417 00:55:54.334099 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-04-17 00:55:54.334085419 +0000 UTC m=+31.138422548 I0417 00:55:54.373001 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-6gzl7" condition "Approved" to 2026-04-17 00:55:54.372985765 +0000 UTC m=+31.177322904 I0417 00:55:54.378297 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0417 00:55:54.378380 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-04-17 00:55:54.378374728 +0000 UTC m=+31.182711837 I0417 00:55:54.391652 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:54.39163376 +0000 UTC m=+31.195970859 I0417 00:55:54.416781 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-6gzl7" condition "Ready" to 2026-04-17 00:55:54.416765918 +0000 UTC m=+31.221103017 I0417 00:55:54.421243 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0417 00:55:54.421589 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:54.421582406 +0000 UTC m=+31.225919505 I0417 00:55:54.453942 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" I0417 00:55:54.459342 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:54.459269798 +0000 UTC m=+31.263606907 I0417 00:55:54.567486 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0417 00:55:54.567766 1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:54.567761273 +0000 UTC m=+31.372098372 I0417 00:55:54.820708 1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0417 00:55:54.863831 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" I0417 00:55:55.071269 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0417 00:55:55.271581 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-bw5xd" condition "Approved" to 2026-04-17 00:55:55.271569334 +0000 UTC m=+32.075906463 I0417 00:55:55.639736 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-bw5xd" condition "Ready" to 2026-04-17 00:55:55.639723721 +0000 UTC m=+32.444060860 I0417 00:55:55.870665 1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:55.870642761 +0000 UTC m=+32.674979900 I0417 00:55:55.972926 1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" I0417 00:55:55.973362 1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-04-17 00:55:55.973353653 +0000 UTC m=+32.777690742 I0417 00:55:56.167574 1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert" E0417 00:57:06.685562 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-selfsigned-issuer\" not found" I0417 00:57:06.742800 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-04-17 00:57:06.742781251 +0000 UTC m=+103.547118380 I0417 00:57:06.765999 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-04-17 00:57:06.765986149 +0000 UTC m=+103.570323248 E0417 00:57:15.064719 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-bootstrap-selfsigned-issuer\" not found" I0417 00:57:15.189954 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-04-17 00:57:15.189937993 +0000 UTC m=+111.994275132 I0417 00:57:15.215663 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-04-17 00:57:15.215643961 +0000 UTC m=+112.019981080 E0417 00:57:16.903933 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-control-plane-selfsigned-issuer\" not found" I0417 00:57:16.940284 1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-04-17 00:57:16.940272534 +0000 UTC m=+113.744609643 I0417 00:57:16.962061 1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-04-17 00:57:16.962045534 +0000 UTC m=+113.766382673 E0417 00:57:18.990779 1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capo-selfsigned-issuer\" not found" I0417 00:57:19.019500 1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-04-17 00:57:19.019489266 +0000 UTC m=+115.823826375 I0417 00:57:19.043220 1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-04-17 00:57:19.043211548 +0000 UTC m=+115.847548657