Scenario
A global ingress annotation cleanup lands and later new certificates stop issuing only for HTTP01 validations.
A cert-manager HTTP01 challenge fails (http01-solver-ingress-inherited-global-https-redirect)
The issuer and DNS are correct, yet issuance fails because the temporary solver route inherited a cluster-wide redirect behavior.
What to check first
- Identify the primary failure signal in the The Challenge Path Borrowed a Redirect Policy It Could Not Survive scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inspect the rendered temporary solver ingress before changing DNS or ACME account settings.
Questions worth viewing together
Community-field Kubernetes problem inspired by cert-manager and ingress community patterns where HTTP01 solver ingresses inherited an unwanted redirect. Temporary challenge routes can inherit cluster-wide ingress behavior that breaks validation.
Teams often blame the CA or DNS when the local ingress is redirecting the challenge away.
Global ingress annotations should be checked against short-lived solver objects and challenge routes.
Similar cases seen in the field