As we found out that the nginx ingress as well as the cert-manager were outdated and not compatible with the Kubernetes version of 1.22 anymore. I upgrade the two components: nginx-ingress from 0.26.1 to 1.5.1. and the cert-manager from version 0.12.0 to 1.5.
which lead to the cert-manager pods running
kubectl get pods -n cert-manager
NAME READY STATUS RESTARTS AGE
cert-manager-dfp85b9bd-ptk9l 1/1 Running 0 26h
cert-manager-cainjector-3d65bcdcfd-fktsz 1/1 Running 0 26h
cert-manager-webhook-c596f8c6c-8cx4x 1/1 Running 0 26h
AND
Kubectl get certificates -n default
NAME READY SECRET AGE
alertmanager-tls False alertmanager-tls 1y12d
prometheus-tls False prometheus-tls 1y19d
and cmctl check api -n cert-manager returns: The cert-manager API is ready
Clean orphaned secrets This deleted the automatically created self signed CA certificates of the cert-manager.After a restart the logs looked mainly clean.
Errors still existing:
cert-manager-cainjector: cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io "grafana-tls" not found"
nginx-ingress: SSL_do_handshake() failed (SSL: error:191CF08C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client
