I0317 20:04:16.985733       1 feature_gate.go:249] feature gates: &{map[AdditionalCertificateOutputFormats:true]}
I0317 20:04:16.985883       1 start.go:75] cert-manager "msg"="starting controller" "git-commit"="b1d501c85d97afd2adde2e86c2b119ac060caece" "version"="v1.11.5"
I0317 20:04:16.985926       1 controller.go:242] cert-manager/controller/build-context "msg"="configured acme dns01 nameservers" "nameservers"=["10.96.0.10:53"]
W0317 20:04:16.986003       1 client_config.go:618] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0317 20:04:16.987173       1 controller.go:70] cert-manager/controller "msg"="enabled controllers: [certificaterequests-approver certificaterequests-issuer-acme certificaterequests-issuer-ca certificaterequests-issuer-selfsigned certificaterequests-issuer-vault certificaterequests-issuer-venafi certificates-issuing certificates-key-manager certificates-metrics certificates-readiness certificates-request-manager certificates-revision-manager certificates-trigger challenges clusterissuers ingress-shim issuers orders]" 
I0317 20:04:16.987500       1 controller.go:134] cert-manager/controller "msg"="starting leader election" 
I0317 20:04:16.987712       1 controller.go:91] cert-manager/controller "msg"="starting metrics server" "address"={"IP":"::","Port":9402,"Zone":""}
I0317 20:04:16.987976       1 leaderelection.go:248] attempting to acquire leader lease cert-manager/cert-manager-controller...
I0317 20:04:17.002140       1 leaderelection.go:258] successfully acquired lease cert-manager/cert-manager-controller
I0317 20:04:17.003812       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-selfsigned"
I0317 20:04:17.004625       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-vault"
I0317 20:04:17.005603       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-issuing"
I0317 20:04:17.006282       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-metrics"
I0317 20:04:17.006914       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-revision-manager"
I0317 20:04:17.008858       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-ca"
I0317 20:04:17.008900       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-approver"
I0317 20:04:17.009589       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-ca"
I0317 20:04:17.009963       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-selfsigned"
I0317 20:04:17.009986       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-vault"
I0317 20:04:17.010005       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-venafi"
I0317 20:04:17.010023       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-trigger"
I0317 20:04:17.010486       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="clusterissuers"
I0317 20:04:17.010738       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="challenges"
I0317 20:04:17.011309       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="orders"
I0317 20:04:17.011691       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="gateway-shim"
I0317 20:04:17.013264       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="ingress-shim"
I0317 20:04:17.013356       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-acme"
I0317 20:04:17.013418       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-venafi"
I0317 20:04:17.014240       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-key-manager"
I0317 20:04:17.014570       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-readiness"
I0317 20:04:17.014951       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-acme"
I0317 20:04:17.015049       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-request-manager"
I0317 20:04:17.015585       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="issuers"
I0317 20:04:38.427566       1 conditions.go:96] Setting lastTransitionTime for Issuer "test-selfsigned" condition "Ready" to 2026-03-17 20:04:38.427533894 +0000 UTC m=+21.481141327
I0317 20:04:38.441630       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="cert-manager-test/selfsigned-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:38.441657       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Issuing" to 2026-03-17 20:04:38.441651803 +0000 UTC m=+21.495259216
I0317 20:04:38.442012       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-03-17 20:04:38.441999283 +0000 UTC m=+21.495606726
E0317 20:04:38.465068       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"test-selfsigned\" not found" 
E0317 20:04:38.478294       1 controller.go:167] cert-manager/certificates-trigger "msg"="re-queuing item due to error processing" "error"="certificates.cert-manager.io \"selfsigned-cert\" not found" "key"="cert-manager-test/selfsigned-cert"
I0317 20:04:38.492537       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-03-17 20:04:38.492526179 +0000 UTC m=+21.546133592
I0317 20:04:38.505023       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:38.505045       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-03-17 20:04:38.505040972 +0000 UTC m=+21.558648385
I0317 20:04:38.505710       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-03-17 20:04:38.505698691 +0000 UTC m=+21.559306134
I0317 20:04:38.521670       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0317 20:04:38.521756       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-03-17 20:04:38.521749564 +0000 UTC m=+21.575356967
I0317 20:04:38.620458       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0317 20:04:38.696074       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-2ddgk" condition "Approved" to 2026-03-17 20:04:38.696062995 +0000 UTC m=+21.749670398
I0317 20:04:38.739221       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-2ddgk" condition "Ready" to 2026-03-17 20:04:38.739206432 +0000 UTC m=+21.792813865
I0317 20:04:38.794843       1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:38.794834943 +0000 UTC m=+21.848442356
I0317 20:04:38.877572       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0317 20:04:38.885554       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0317 20:04:38.887418       1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:38.887411516 +0000 UTC m=+21.941018929
I0317 20:04:39.041648       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-03-17 20:04:39.041633069 +0000 UTC m=+22.095240482
I0317 20:04:39.055092       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-03-17 20:04:39.055082806 +0000 UTC m=+22.108690239
I0317 20:04:39.055108       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:39.055552       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-03-17 20:04:39.055545068 +0000 UTC m=+22.109152511
I0317 20:04:39.071321       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0317 20:04:39.071443       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:39.071481       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-03-17 20:04:39.071475474 +0000 UTC m=+22.125082887
I0317 20:04:39.386310       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-03-17 20:04:39.38629901 +0000 UTC m=+22.439906433
I0317 20:04:39.404504       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-03-17 20:04:39.404493549 +0000 UTC m=+22.458100952
I0317 20:04:39.404630       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:39.404655       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Issuing" to 2026-03-17 20:04:39.404647853 +0000 UTC m=+22.458255256
I0317 20:04:39.431521       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0317 20:04:39.431604       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-03-17 20:04:39.431598966 +0000 UTC m=+22.485206369
I0317 20:04:39.791349       1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-03-17 20:04:39.791337738 +0000 UTC m=+22.844945151
I0317 20:04:39.808875       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-03-17 20:04:39.808862878 +0000 UTC m=+22.862470291
I0317 20:04:39.809172       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:39.809186       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-03-17 20:04:39.809183688 +0000 UTC m=+22.862791101
I0317 20:04:39.828183       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0317 20:04:39.828273       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0317 20:04:39.828319       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-03-17 20:04:39.828312513 +0000 UTC m=+22.881919956
I0317 20:04:39.850784       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0317 20:04:39.848984       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0317 20:04:39.867493       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-xv5d9" condition "Approved" to 2026-03-17 20:04:39.867482018 +0000 UTC m=+22.921089431
I0317 20:04:39.891366       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-znq2d" condition "Approved" to 2026-03-17 20:04:39.891354616 +0000 UTC m=+22.944962029
I0317 20:04:39.894874       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-xv5d9" condition "Ready" to 2026-03-17 20:04:39.894864764 +0000 UTC m=+22.948472167
I0317 20:04:39.913508       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-znq2d" condition "Ready" to 2026-03-17 20:04:39.913498655 +0000 UTC m=+22.967106068
I0317 20:04:39.924184       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:39.924171104 +0000 UTC m=+22.977778517
I0317 20:04:39.970086       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0317 20:04:39.970423       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:39.970415177 +0000 UTC m=+23.024022580
I0317 20:04:39.988318       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:39.988307028 +0000 UTC m=+23.041914431
I0317 20:04:40.237655       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0317 20:04:40.311931       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0317 20:04:40.754121       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-mnvs7" condition "Approved" to 2026-03-17 20:04:40.754102026 +0000 UTC m=+23.807709509
I0317 20:04:41.296918       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0317 20:04:41.303267       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-mnvs7" condition "Ready" to 2026-03-17 20:04:41.30325922 +0000 UTC m=+24.356866633
I0317 20:04:41.441463       1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:41.441449205 +0000 UTC m=+24.495056608
I0317 20:04:41.547271       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0317 20:04:41.547490       1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-03-17 20:04:41.547486338 +0000 UTC m=+24.601093741
I0317 20:04:41.737741       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
E0317 20:05:49.565055       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-selfsigned-issuer\" not found" 
I0317 20:05:49.615157       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-03-17 20:05:49.615140665 +0000 UTC m=+92.668748108
I0317 20:05:49.634365       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-03-17 20:05:49.634290912 +0000 UTC m=+92.687898325
E0317 20:05:51.613371       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-bootstrap-selfsigned-issuer\" not found" 
I0317 20:05:51.657113       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-03-17 20:05:51.657100499 +0000 UTC m=+94.710707912
I0317 20:05:51.676736       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-03-17 20:05:51.676727961 +0000 UTC m=+94.730335374
E0317 20:05:53.086193       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-control-plane-selfsigned-issuer\" not found" 
I0317 20:05:53.116956       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-03-17 20:05:53.116944995 +0000 UTC m=+96.170552408
I0317 20:05:53.135954       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-03-17 20:05:53.135944373 +0000 UTC m=+96.189551776
E0317 20:05:54.582668       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capo-selfsigned-issuer\" not found" 
I0317 20:05:54.641999       1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-03-17 20:05:54.641979604 +0000 UTC m=+97.695587027
I0317 20:05:54.664986       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-03-17 20:05:54.664976098 +0000 UTC m=+97.718583501