certificate renewal does not work in due to auth issue to privatecaapi end point

[mukesh-mohanan-db]

msg"="Reconciler error" "error"="failed to sign certificate request: casClient.CreateCertificate failed: rpc error: code = Unauthenticated desc = transport: per-RPC creds failed due to error: compute: Received 500 Internal Server Error\n" "certificateRequest"={"name":"ksqldb-int-cert-1-grc97","namespace":"kafka"} "controller"="certificaterequest" "controllerGroup"="cert-manager.io" "controllerKind"="CertificateRequest" "name"="ksqldb-int-cert-1-grc97" "namespace"="kafka" "reconcileID"="ebd0dbfd-5b13-497a-9b18-0c4cc8b0fa1c"

Facing this issue in version 0.6.2 with cert-manager 1.11.0 in GKE version

work around : after restarting the cert-manager-google-cas-issuer pod , things certificate enrollment is fine . But this again reported after couple of days and cert renewals are again affected . Seems like Auth token refresh does not working internally or so . Anyone faced this issue very recently ?

[selvjith]

Faced similar issue in google-cas-issuer version 0.7.1, cert-manager v1.12.3.
unfortunately the above work around didn't work.
it's weird, it has been working fine for the past 6 months but suddenly it stopped renewing certificates one day with this strange error. we restarted google-cas-issuer, cert-manager workloads individually and the whole cert-manager namespace workloads. we were preparing for a node restart since it stopped working for 3 days. out of nowhere, it started renewing certificates after 3 days, it's really strange.