I0617 20:45:12.131105       1 feature_gate.go:249] feature gates: &{map[AdditionalCertificateOutputFormats:true]}
I0617 20:45:12.131255       1 start.go:75] cert-manager "msg"="starting controller" "git-commit"="b1d501c85d97afd2adde2e86c2b119ac060caece" "version"="v1.11.5"
I0617 20:45:12.131304       1 controller.go:242] cert-manager/controller/build-context "msg"="configured acme dns01 nameservers" "nameservers"=["10.96.0.10:53"]
W0617 20:45:12.131389       1 client_config.go:618] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0617 20:45:12.132457       1 controller.go:70] cert-manager/controller "msg"="enabled controllers: [certificaterequests-approver certificaterequests-issuer-acme certificaterequests-issuer-ca certificaterequests-issuer-selfsigned certificaterequests-issuer-vault certificaterequests-issuer-venafi certificates-issuing certificates-key-manager certificates-metrics certificates-readiness certificates-request-manager certificates-revision-manager certificates-trigger challenges clusterissuers ingress-shim issuers orders]" 
I0617 20:45:12.132808       1 controller.go:134] cert-manager/controller "msg"="starting leader election" 
I0617 20:45:12.132947       1 controller.go:91] cert-manager/controller "msg"="starting metrics server" "address"={"IP":"::","Port":9402,"Zone":""}
I0617 20:45:12.133732       1 leaderelection.go:248] attempting to acquire leader lease cert-manager/cert-manager-controller...
I0617 20:45:12.146704       1 leaderelection.go:258] successfully acquired lease cert-manager/cert-manager-controller
I0617 20:45:12.148266       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-request-manager"
I0617 20:45:12.149527       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-trigger"
I0617 20:45:12.151314       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="issuers"
I0617 20:45:12.152865       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="gateway-shim"
I0617 20:45:12.153841       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-venafi"
I0617 20:45:12.154285       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="orders"
I0617 20:45:12.154626       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-acme"
I0617 20:45:12.154642       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-ca"
I0617 20:45:12.154650       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-selfsigned"
I0617 20:45:12.154675       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-venafi"
I0617 20:45:12.154802       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-metrics"
I0617 20:45:12.155506       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-approver"
I0617 20:45:12.155949       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-vault"
I0617 20:45:12.156363       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-revision-manager"
I0617 20:45:12.156677       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="clusterissuers"
I0617 20:45:12.156876       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-ca"
I0617 20:45:12.157245       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-selfsigned"
I0617 20:45:12.157450       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-acme"
I0617 20:45:12.157900       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-issuing"
I0617 20:45:12.158284       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-key-manager"
I0617 20:45:12.158938       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-vault"
I0617 20:45:12.159011       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-readiness"
I0617 20:45:12.159988       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="challenges"
I0617 20:45:12.161830       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="ingress-shim"
I0617 20:45:38.535796       1 conditions.go:96] Setting lastTransitionTime for Issuer "test-selfsigned" condition "Ready" to 2026-06-17 20:45:38.535724075 +0000 UTC m=+26.439122541
I0617 20:45:38.552523       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="cert-manager-test/selfsigned-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:38.552551       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Issuing" to 2026-06-17 20:45:38.552545822 +0000 UTC m=+26.455944248
I0617 20:45:38.553822       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-06-17 20:45:38.553811672 +0000 UTC m=+26.457210108
I0617 20:45:38.571637       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"selfsigned-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="cert-manager-test/selfsigned-cert"
I0617 20:45:38.571743       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-06-17 20:45:38.571736157 +0000 UTC m=+26.475134583
E0617 20:45:38.581346       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"test-selfsigned\" not found" 
I0617 20:45:38.634810       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-06-17 20:45:38.634794737 +0000 UTC m=+26.538193163
I0617 20:45:38.651698       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:38.651728       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-06-17 20:45:38.651722396 +0000 UTC m=+26.555120832
I0617 20:45:38.652031       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-06-17 20:45:38.652020734 +0000 UTC m=+26.555419170
I0617 20:45:38.682192       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0617 20:45:38.682267       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-06-17 20:45:38.682260742 +0000 UTC m=+26.585659168
E0617 20:45:38.737290       1 controller.go:167] cert-manager/certificates-key-manager "msg"="re-queuing item due to error processing" "error"="secrets \"selfsigned-cert-\" is forbidden: unable to create new content in namespace cert-manager-test because it is being terminated" "key"="cert-manager-test/selfsigned-cert"
I0617 20:45:38.929828       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0617 20:45:38.980440       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-fc4gm" condition "Approved" to 2026-06-17 20:45:38.980432864 +0000 UTC m=+26.883831290
I0617 20:45:39.018684       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-fc4gm" condition "Ready" to 2026-06-17 20:45:39.018670007 +0000 UTC m=+26.922068443
I0617 20:45:39.163828       1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-17 20:45:39.163814329 +0000 UTC m=+27.067212755
I0617 20:45:39.190851       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0617 20:45:39.197138       1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-17 20:45:39.197129986 +0000 UTC m=+27.100528402
I0617 20:45:39.220109       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0617 20:45:39.457141       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-06-17 20:45:39.457128967 +0000 UTC m=+27.360527393
I0617 20:45:39.478697       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-06-17 20:45:39.478686595 +0000 UTC m=+27.382085021
I0617 20:45:39.478863       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:39.478903       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-06-17 20:45:39.478894551 +0000 UTC m=+27.382293017
I0617 20:45:39.520509       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0617 20:45:39.520572       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:39.520591       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-06-17 20:45:39.520586553 +0000 UTC m=+27.423984989
I0617 20:45:39.795392       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0617 20:45:39.814763       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-xb9ps" condition "Approved" to 2026-06-17 20:45:39.814753112 +0000 UTC m=+27.718151538
I0617 20:45:39.856617       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-xb9ps" condition "Ready" to 2026-06-17 20:45:39.856607239 +0000 UTC m=+27.760005675
I0617 20:45:39.897341       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-06-17 20:45:39.897330299 +0000 UTC m=+27.800728715
I0617 20:45:39.915675       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-17 20:45:39.915664238 +0000 UTC m=+27.819062664
I0617 20:45:39.933307       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:39.933330       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Issuing" to 2026-06-17 20:45:39.933325022 +0000 UTC m=+27.836723448
I0617 20:45:39.933681       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-06-17 20:45:39.933676991 +0000 UTC m=+27.837075417
I0617 20:45:39.960494       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0617 20:45:39.968429       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0617 20:45:39.968486       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-06-17 20:45:39.968482354 +0000 UTC m=+27.871880770
I0617 20:45:40.199540       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0617 20:45:40.292793       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-8j85s" condition "Approved" to 2026-06-17 20:45:40.292782991 +0000 UTC m=+28.196181427
I0617 20:45:40.329949       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-8j85s" condition "Ready" to 2026-06-17 20:45:40.329937614 +0000 UTC m=+28.233336030
I0617 20:45:40.388076       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-17 20:45:40.388062588 +0000 UTC m=+28.291461014
I0617 20:45:40.414109       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0617 20:45:40.424218       1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-06-17 20:45:40.424206948 +0000 UTC m=+28.327605374
I0617 20:45:40.452539       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-06-17 20:45:40.452528567 +0000 UTC m=+28.355926993
I0617 20:45:40.452673       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:40.452685       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-06-17 20:45:40.45268252 +0000 UTC m=+28.356080946
I0617 20:45:40.652289       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0617 20:45:40.652361       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0617 20:45:40.652378       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-06-17 20:45:40.652374778 +0000 UTC m=+28.555773204
I0617 20:45:40.999257       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0617 20:45:41.058441       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-54tp7" condition "Approved" to 2026-06-17 20:45:41.058425623 +0000 UTC m=+28.961824059
I0617 20:45:41.366834       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-54tp7" condition "Ready" to 2026-06-17 20:45:41.36680874 +0000 UTC m=+29.270207166
I0617 20:45:41.602277       1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-17 20:45:41.602260168 +0000 UTC m=+29.505658634
I0617 20:45:41.749216       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
E0617 20:46:54.242701       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-selfsigned-issuer\" not found" 
I0617 20:46:54.276402       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-06-17 20:46:54.276385735 +0000 UTC m=+102.179784171
I0617 20:46:54.298162       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-06-17 20:46:54.298146483 +0000 UTC m=+102.201544929
E0617 20:46:56.605837       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-bootstrap-selfsigned-issuer\" not found" 
I0617 20:46:56.654933       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-06-17 20:46:56.654921239 +0000 UTC m=+104.558319675
I0617 20:46:56.680916       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-06-17 20:46:56.680895877 +0000 UTC m=+104.584294353
E0617 20:46:58.624091       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capi-kubeadm-control-plane-selfsigned-issuer\" not found" 
I0617 20:46:58.673299       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-06-17 20:46:58.673286064 +0000 UTC m=+106.576684500
I0617 20:46:58.695991       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-06-17 20:46:58.69592149 +0000 UTC m=+106.599319926
E0617 20:47:00.427991       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"capo-selfsigned-issuer\" not found" 
I0617 20:47:00.493086       1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-06-17 20:47:00.493072069 +0000 UTC m=+108.396470505
I0617 20:47:00.515304       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-06-17 20:47:00.515294616 +0000 UTC m=+108.418693042