time=2026-10-08T10:13:01.870Z level=INFO msg="successfully loaded default package from filesystem" id=cert-manager-debian-trixie-20250419.2-714d457d580922db path=/packages/cert-manager-package-debian.json time=2026-10-08T10:13:01.870Z level=INFO msg="registering webhook endpoints" time=2026-10-08T10:13:01.870Z level=INFO msg="Registering a validating webhook" logger=controller-runtime/builder GVK="trust.cert-manager.io/v1alpha1, Kind=Bundle" path=/validate-trust-cert-manager-io-v1alpha1-bundle time=2026-10-08T10:13:01.870Z level=INFO msg="Registering webhook" path=/validate-trust-cert-manager-io-v1alpha1-bundle logger=controller-runtime/webhook time=2026-10-08T10:13:01.870Z level=INFO msg="Starting metrics server" logger=controller-runtime/metrics time=2026-10-08T10:13:01.871Z level=INFO msg="Serving metrics server" logger=controller-runtime/metrics bindAddress=0.0.0.0:9402 secure=false time=2026-10-08T10:13:01.871Z level=INFO msg="starting server" name="health probe" addr=[::]:6060 time=2026-10-08T10:13:01.871Z level=INFO msg="Starting webhook server" logger=controller-runtime/webhook time=2026-10-08T10:13:01.871Z level=INFO msg="Attempting to acquire leader lease..." logger=leaderelection lock=cert-manager/trust-manager-leader-election time=2026-10-08T10:13:01.871Z level=INFO msg="Updated current TLS certificate" cert=/tls/tls.crt key=/tls/tls.key logger=controller-runtime/certwatcher time=2026-10-08T10:13:01.871Z level=INFO msg="Serving webhook server" logger=controller-runtime/webhook host=0.0.0.0 port=6443 time=2026-10-08T10:13:01.871Z level=INFO msg="Starting certificate poll+watcher" cert=/tls/tls.crt key=/tls/tls.key logger=controller-runtime/certwatcher interval=10s time=2026-10-08T10:13:01.877Z level=INFO msg="Successfully acquired lease" logger=leaderelection lock=cert-manager/trust-manager-leader-election time=2026-10-08T10:13:01.878Z level=INFO msg="Starting EventSource" controller=bundles source="kind source: *v1.PartialObjectMetadata[v1 ConfigMap]" time=2026-10-08T10:13:01.878Z level=INFO msg="Starting EventSource" controller=bundles source="kind source: *v1alpha1.Bundle" time=2026-10-08T10:13:01.878Z level=INFO msg="Starting EventSource" controller=bundles source="kind source: *v1.Namespace" time=2026-10-08T10:13:01.878Z level=DEBUG+3 msg="trust-manager-57d667d956-84xgn_9bd2e4cf-7e3d-419a-bd0b-85bb451647a5 became leader" logger=events type=Normal object="{Kind:Lease Namespace:cert-manager Name:trust-manager-leader-election UID:f01af120-d2db-4741-b6b2-a3e82050ab23 APIVersion:coordination.k8s.io/v1 ResourceVersion:3759 FieldPath:}" reason=LeaderElection time=2026-10-08T10:13:01.878Z level=INFO msg="Starting EventSource" controller=bundles source="kind source: *v1.Secret" time=2026-10-08T10:13:01.878Z level=INFO msg="Starting EventSource" controller=bundles source="kind source: *v1.ConfigMap" time=2026-10-08T10:13:02.078Z level=INFO msg="Starting Controller" controller=bundles time=2026-10-08T10:13:02.078Z level=INFO msg="Starting workers" controller=bundles "worker count"=1 time=2026-10-08T10:17:32.681Z level=ERROR msg="bundle source was not found" controller=bundles namespace="" name=trusted-ca reconcileID=4db2484b-bff0-4601-a386-1e249ccb2132 bundle=trusted-ca err="failed to get Secret cert-manager/konflux-ca-secret: Secret \"konflux-ca-secret\" not found" time=2026-10-08T10:17:32.681Z level=DEBUG+3 msg="Event occurred" logger=events object.name=trusted-ca kind=Bundle apiVersion=trust.cert-manager.io/v1alpha1 type=Warning reason=SourceNotFound action=SyncFailed note="Bundle source was not found: failed to get Secret cert-manager/konflux-ca-secret: Secret \"konflux-ca-secret\" not found" time=2026-10-08T10:17:34.991Z level=DEBUG+3 msg="Event occurred" logger=events object.name=trusted-ca kind=Bundle apiVersion=trust.cert-manager.io/v1alpha1 type=Normal reason=Synced action=Synced note="Successfully synced Bundle to all namespaces" time=2026-10-08T10:18:06.006Z level=ERROR msg="Error retrieving lease lock" logger=leaderelection err="Get \"https://10.96.0.1:443/apis/coordination.k8s.io/v1/namespaces/cert-manager/leases/trust-manager-leader-election?timeout=5s\": context deadline exceeded" lock=cert-manager/trust-manager-leader-election time=2026-10-08T10:18:06.006Z level=INFO msg="Failed to renew lease" logger=leaderelection lock=cert-manager/trust-manager-leader-election err="context deadline exceeded" Error: leader election lost Usage: trust-manager [flags] App flags: --leader-elect If true, trust-manager will perform leader election between instances to ensure no more than one instance of trust-manager operates at a time (default true) --leader-election-lease-duration duration Lease duration for leader election (default 15s) --leader-election-renew-deadline duration Lease renew deadline for leader election. (default 10s) --metrics-port int Port to expose Prometheus metrics on 0.0.0.0 on path '/metrics'. (default 9402) --readiness-probe-path string HTTP path to expose the readiness probe server. (default "/readyz") --readiness-probe-port int Port to expose the readiness probe. (default 6060) Bundle flags: --default-package-location string Path to a JSON file containing the default certificate package. If set, must be a valid package. --filter-expired-certificates Filter expired certificates from the bundle. --filter-non-ca-certs Filter non-CA certificates, only CAs are used in the resulting Bundle --secret-targets-enabled Controls if secret targets are enabled in the Bundle API. --target-namespaces strings Comma-separated list of namespaces to limit both the manager and target caches. --trust-namespace string Namespace to source trust bundles from. (default "cert-manager") Logging flags: --log-format string Log format (text or json) (default "text") -v, --log-level int Log level (1-5). (default 1) Webhook flags: --webhook-certificate-dir string Directory where the Webhook certificate and private key are located. Certificate and private key must be named 'tls.crt' and 'tls.key' respectively. (default "/tls") --webhook-host string Host to serve webhook. (default "0.0.0.0") --webhook-port int Port to serve webhook. (default 6443) TLSConfig flags: --tls-cipher-suites strings Comma-separated list of cipher suites for the webhook server. If omitted, the default Go cipher suites will be used. Only affects TLS 1.2; TLS 1.3 cipher suites are not configurable in Go. Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256. Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA. --tls-curve-preferences int32Slice Comma-separated list of numeric Go crypto/tls CurveID values, as the allowed key exchange mechanisms for the webhook server. Applies to TLS 1.2 and TLS 1.3. The supported values depend on the Go version used. See https://pkg.go.dev/crypto/tls#CurveID for values supported for each Go version. The order of the list is ignored, and key exchange mechanisms are chosen by Go from this list using an internal preference order. If omitted, the default Go curves will be used. (default []) --tls-min-version string Minimum TLS version supported. If omitted, the default Go minimum version will be used. Possible values: VersionTLS10,VersionTLS11,VersionTLS12,VersionTLS13 Kubernetes flags: --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key. --cache-dir string Default cache directory (default "/home/nonroot/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. -n, --namespace string If present, the namespace scope for this CLI request --proxy-url string Proxy URL to use for requests to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use error: leader election lost