I0608 07:49:39.613480       1 feature_gate.go:249] feature gates: &{map[AdditionalCertificateOutputFormats:true]}
I0608 07:49:39.613680       1 start.go:75] cert-manager "msg"="starting controller" "git-commit"="b1d501c85d97afd2adde2e86c2b119ac060caece" "version"="v1.11.5"
I0608 07:49:39.613773       1 controller.go:242] cert-manager/controller/build-context "msg"="configured acme dns01 nameservers" "nameservers"=["10.96.0.10:53"]
W0608 07:49:39.613888       1 client_config.go:618] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0608 07:49:39.615419       1 controller.go:70] cert-manager/controller "msg"="enabled controllers: [certificaterequests-approver certificaterequests-issuer-acme certificaterequests-issuer-ca certificaterequests-issuer-selfsigned certificaterequests-issuer-vault certificaterequests-issuer-venafi certificates-issuing certificates-key-manager certificates-metrics certificates-readiness certificates-request-manager certificates-revision-manager certificates-trigger challenges clusterissuers ingress-shim issuers orders]" 
I0608 07:49:39.615972       1 controller.go:134] cert-manager/controller "msg"="starting leader election" 
I0608 07:49:39.616304       1 controller.go:91] cert-manager/controller "msg"="starting metrics server" "address"={"IP":"::","Port":9402,"Zone":""}
I0608 07:49:39.616666       1 leaderelection.go:248] attempting to acquire leader lease cert-manager/cert-manager-controller...
I0608 07:49:39.630248       1 leaderelection.go:258] successfully acquired lease cert-manager/cert-manager-controller
I0608 07:49:39.632792       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-vault"
I0608 07:49:39.634387       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-venafi"
I0608 07:49:39.636474       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-request-manager"
I0608 07:49:39.636490       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-acme"
I0608 07:49:39.636523       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-selfsigned"
I0608 07:49:39.636542       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-vault"
I0608 07:49:39.637504       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="clusterissuers"
I0608 07:49:39.639859       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-acme"
I0608 07:49:39.640052       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-ca"
I0608 07:49:39.640670       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-key-manager"
I0608 07:49:39.640902       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="issuers"
I0608 07:49:39.642746       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="orders"
I0608 07:49:39.643625       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-readiness"
I0608 07:49:39.644946       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="certificatesigningrequests-issuer-venafi"
I0608 07:49:39.645000       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-revision-manager"
I0608 07:49:39.646134       1 controller.go:182] cert-manager/controller "msg"="not starting controller as it's disabled" "controller"="gateway-shim"
I0608 07:49:39.646200       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="challenges"
I0608 07:49:39.646912       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="ingress-shim"
I0608 07:49:39.647535       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-approver"
I0608 07:49:39.648442       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-ca"
I0608 07:49:39.649225       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificaterequests-issuer-selfsigned"
I0608 07:49:39.650000       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-issuing"
I0608 07:49:39.650605       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-metrics"
I0608 07:49:39.652260       1 controller.go:205] cert-manager/controller "msg"="starting controller" "controller"="certificates-trigger"
I0608 07:50:47.893066       1 conditions.go:96] Setting lastTransitionTime for Issuer "test-selfsigned" condition "Ready" to 2026-06-08 07:50:47.893012705 +0000 UTC m=+68.317194473
I0608 07:50:47.905991       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Ready" to 2026-06-08 07:50:47.905982025 +0000 UTC m=+68.330163753
I0608 07:50:47.906404       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="cert-manager-test/selfsigned-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:47.906450       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Issuing" to 2026-06-08 07:50:47.90644556 +0000 UTC m=+68.330627288
I0608 07:50:47.917821       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"selfsigned-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="cert-manager-test/selfsigned-cert"
I0608 07:50:47.917906       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="cert-manager-test/selfsigned-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:47.917935       1 conditions.go:203] Setting lastTransitionTime for Certificate "selfsigned-cert" condition "Issuing" to 2026-06-08 07:50:47.917928423 +0000 UTC m=+68.342110181
E0608 07:50:47.925310       1 controller.go:137] cert-manager/issuers "msg"="issuer in work queue no longer exists" "error"="issuer.cert-manager.io \"test-selfsigned\" not found" 
E0608 07:50:47.927193       1 event.go:267] Server rejected event '&v1.Event{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ObjectMeta:v1.ObjectMeta{Name:"selfsigned-cert.18b70bb4984f4fd2", GenerateName:"", Namespace:"cert-manager-test", SelfLink:"", UID:"", ResourceVersion:"", Generation:0, CreationTimestamp:time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC), DeletionTimestamp:<nil>, DeletionGracePeriodSeconds:(*int64)(nil), Labels:map[string]string(nil), Annotations:map[string]string(nil), OwnerReferences:[]v1.OwnerReference(nil), Finalizers:[]string(nil), ManagedFields:[]v1.ManagedFieldsEntry(nil)}, InvolvedObject:v1.ObjectReference{Kind:"Certificate", Namespace:"cert-manager-test", Name:"selfsigned-cert", UID:"b4472b37-3ea0-4450-a5c8-eca3660f9e86", APIVersion:"cert-manager.io/v1", ResourceVersion:"1531", FieldPath:""}, Reason:"Issuing", Message:"Issuing certificate as Secret does not exist", Source:v1.EventSource{Component:"cert-manager-certificates-trigger", Host:""}, FirstTimestamp:time.Date(2026, time.June, 8, 7, 50, 47, 925673938, time.Local), LastTimestamp:time.Date(2026, time.June, 8, 7, 50, 47, 925673938, time.Local), Count:1, Type:"Normal", EventTime:time.Date(1, time.January, 1, 0, 0, 0, 0, time.UTC), Series:(*v1.EventSeries)(nil), Action:"", Related:(*v1.ObjectReference)(nil), ReportingController:"", ReportingInstance:""}': 'events "selfsigned-cert.18b70bb4984f4fd2" is forbidden: unable to create new content in namespace cert-manager-test because it is being terminated' (will not retry!)
I0608 07:50:47.955339       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-selfsigned-issuer" condition "Ready" to 2026-06-08 07:50:47.955323222 +0000 UTC m=+68.379504950
I0608 07:50:47.967510       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Ready" to 2026-06-08 07:50:47.967496293 +0000 UTC m=+68.391678031
I0608 07:50:47.967621       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:47.967649       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-06-08 07:50:47.967643714 +0000 UTC m=+68.391825452
I0608 07:50:47.991244       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0608 07:50:47.991343       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-system/capi-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:47.991368       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-serving-cert" condition "Issuing" to 2026-06-08 07:50:47.991360557 +0000 UTC m=+68.415542295
E0608 07:50:48.189766       1 controller.go:167] cert-manager/certificates-key-manager "msg"="re-queuing item due to error processing" "error"="secrets \"selfsigned-cert-\" is forbidden: unable to create new content in namespace cert-manager-test because it is being terminated" "key"="cert-manager-test/selfsigned-cert"
I0608 07:50:48.245999       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-s2llb" condition "Approved" to 2026-06-08 07:50:48.245982262 +0000 UTC m=+68.670164000
I0608 07:50:48.313449       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-serving-cert-s2llb" condition "Ready" to 2026-06-08 07:50:48.31343779 +0000 UTC m=+68.737619528
I0608 07:50:48.360627       1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:48.360618069 +0000 UTC m=+68.784799797
I0608 07:50:48.389421       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0608 07:50:48.389784       1 conditions.go:192] Found status change for Certificate "capi-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:48.389778648 +0000 UTC m=+68.813960366
I0608 07:50:48.402006       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0608 07:50:48.414279       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-system/capi-serving-cert"
I0608 07:50:48.592367       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-bootstrap-selfsigned-issuer" condition "Ready" to 2026-06-08 07:50:48.592349593 +0000 UTC m=+69.016531361
I0608 07:50:48.607052       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready" to 2026-06-08 07:50:48.607039354 +0000 UTC m=+69.031221082
I0608 07:50:48.607074       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:48.607146       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-06-08 07:50:48.607104615 +0000 UTC m=+69.031286343
I0608 07:50:48.626561       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0608 07:50:48.626687       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:48.626730       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Issuing" to 2026-06-08 07:50:48.626723476 +0000 UTC m=+69.050905204
I0608 07:50:49.033096       1 conditions.go:96] Setting lastTransitionTime for Issuer "capi-kubeadm-control-plane-selfsigned-issuer" condition "Ready" to 2026-06-08 07:50:49.033086842 +0000 UTC m=+69.457268570
I0608 07:50:49.052616       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-06-08 07:50:49.052606122 +0000 UTC m=+69.476787850
I0608 07:50:49.052849       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:49.052914       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Issuing" to 2026-06-08 07:50:49.052903125 +0000 UTC m=+69.477084863
I0608 07:50:49.076915       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0608 07:50:49.077019       1 conditions.go:203] Setting lastTransitionTime for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready" to 2026-06-08 07:50:49.077010949 +0000 UTC m=+69.501192687
I0608 07:50:49.152838       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-wvsc6" condition "Approved" to 2026-06-08 07:50:49.152812918 +0000 UTC m=+69.576994646
I0608 07:50:49.183570       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-bootstrap-serving-cert-wvsc6" condition "Ready" to 2026-06-08 07:50:49.183559964 +0000 UTC m=+69.607741682
I0608 07:50:49.318063       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-bootstrap-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:49.318052929 +0000 UTC m=+69.742234657
I0608 07:50:49.355121       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0608 07:50:49.383095       1 controller.go:162] cert-manager/certificates-issuing "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0608 07:50:49.422830       1 conditions.go:96] Setting lastTransitionTime for Issuer "capo-selfsigned-issuer" condition "Ready" to 2026-06-08 07:50:49.42281986 +0000 UTC m=+69.847001588
I0608 07:50:49.438728       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:49.438755       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-06-08 07:50:49.438750085 +0000 UTC m=+69.862931803
I0608 07:50:49.440037       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Ready" to 2026-06-08 07:50:49.440031611 +0000 UTC m=+69.864213329
I0608 07:50:49.440370       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-72jsz" condition "Approved" to 2026-06-08 07:50:49.440366525 +0000 UTC m=+69.864548253
I0608 07:50:49.470418       1 controller.go:162] cert-manager/certificates-trigger "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0608 07:50:49.470878       1 trigger_controller.go:200] cert-manager/certificates-trigger "msg"="Certificate must be re-issued" "key"="capo-system/capo-serving-cert" "message"="Issuing certificate as Secret does not exist" "reason"="DoesNotExist"
I0608 07:50:49.471019       1 conditions.go:203] Setting lastTransitionTime for Certificate "capo-serving-cert" condition "Issuing" to 2026-06-08 07:50:49.47101169 +0000 UTC m=+69.895193418
I0608 07:50:49.478822       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capi-kubeadm-control-plane-serving-cert-72jsz" condition "Ready" to 2026-06-08 07:50:49.478814655 +0000 UTC m=+69.902996393
I0608 07:50:49.563190       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-bootstrap-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-bootstrap-system/capi-kubeadm-bootstrap-serving-cert"
I0608 07:50:49.863946       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:49.863932216 +0000 UTC m=+70.288113944
I0608 07:50:50.002010       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0608 07:50:50.002332       1 conditions.go:192] Found status change for Certificate "capi-kubeadm-control-plane-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:50.002322219 +0000 UTC m=+70.426503947
I0608 07:50:50.304661       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0608 07:50:50.366993       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-7m7m8" condition "Approved" to 2026-06-08 07:50:50.366981475 +0000 UTC m=+70.791163203
I0608 07:50:50.403569       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capi-kubeadm-control-plane-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capi-kubeadm-control-plane-system/capi-kubeadm-control-plane-serving-cert"
I0608 07:50:50.624378       1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "capo-serving-cert-7m7m8" condition "Ready" to 2026-06-08 07:50:50.624355913 +0000 UTC m=+71.048537651
I0608 07:50:51.058746       1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:51.058722815 +0000 UTC m=+71.482904553
I0608 07:50:51.155928       1 controller.go:162] cert-manager/certificates-readiness "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"
I0608 07:50:51.156225       1 conditions.go:192] Found status change for Certificate "capo-serving-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2026-06-08 07:50:51.156218489 +0000 UTC m=+71.580400227
I0608 07:50:51.360735       1 controller.go:162] cert-manager/certificates-key-manager "msg"="re-queuing item due to optimistic locking on resource" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"capo-serving-cert\": the object has been modified; please apply your changes to the latest version and try again" "key"="capo-system/capo-serving-cert"