Pods in the svc-metrics-aggregator-domain-#### namespace fail to start. This issue occurs when the ClusterIssuer responsible for certificate generation cannot access its required CA secret.

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• Pods in svc-metrics-aggregator-domain-#### remain in PendingorProviderFailed status.
• Running kubectl describe pod shows the following error: MountVolume.SetUp failed for volume "metrics-endpoint-downstream-tls-config" : secret "metrics-endpoint-downstream-server-cert" not found
• Running kubectl describe clusterissuer metrics-aggregator-ca-issuer shows: Message: Error getting keypair for CA issuer: secrets "metrics-aggregator-ca-secret" not found Reason: ErrGetKeyPair Status: False

Environment

VCF 9.1

metrics-aggregator 0.1.0

Cause

The metrics-aggregator-ca-issuer is a ClusterIssuer, which is cluster-scoped. By design, a ClusterIssuer looks for its referenced CA secret within the namespace where the cert-manager controller is installed (typically vmware-system-cert-manager). If the metrics-aggregator-ca-secret only exists in the local service namespace (svc-metrics-aggregator-domain-####), the issuer fails to initialize.

Resolution

To resolve this issue, replicate the CA secret into the cert-manager namespace:

1. Identify the target namespace for cert-manager (usually vmware-system-cert-manager).
2. Export the secret from the service namespace: kubectl get secret metrics-aggregator-ca-secret -n svc-metrics-aggregator-domain-#### -o yaml > ca-secret.yaml
3. Edit ca-secret.yaml to change the namespace to vmware-system-cert-manager and remove the uid, resourceVersion, and creationTimestamp fields.
4. Apply the modified secret: kubectl apply -f ca-secret.yaml
5. The ClusterIssuer should automatically reconcile and sign the missing metrics-endpoint-downstream-server-cert secret.
6. Verify the pods are running: kubectl get pods -n svc-metrics-aggregator-domain-####