Scenario
A cluster-wide ingress annotation cleanup lands and certificate issuance later fails only for new HTTP01 challenges.
A cert-manager Certificate stays Pending (http01-solver-ingress-forced-to-https-by-global-annotation)
Issuance config looks valid, yet the challenge never completes because the temporary ingress path is altered by a cluster-wide redirect behavior.
What to check first
- Identify the primary failure signal in the The Challenge Path Inherited a Redirect the Solver Never Asked For scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inspect the rendered temporary solver ingress before changing DNS or ACME account settings.
Questions worth viewing together
Community-field Kubernetes problem inspired by cert-manager and ingress community patterns where HTTP01 solver ingresses inherited an unwanted HTTPS red... Temporary ingress objects can inherit global behaviors that break challenge semantics.
Teams often blame ACME endpoints when the local ingress path is redirecting challenge traffic away.
Global ingress annotations should be reviewed for how they affect short-lived solver objects.
Similar cases seen in the field