[e2e] Error: "tls: failed to verify certificate: x509: certificate signed by unknown authority"

Which jobs are flaking?

periodic-cluster-api-e2e-mink8s-release-1-11
periodic-cluster-api-e2e-latestk8s-main
periodic-cluster-api-e2e-release-1-11

Which tests are flaking?

• capi-e2e [It] When following the Cluster API quick-start with dualstack and ipv4 primary [IPv6] Should create a workload cluster [IPv6]
• capi-e2e [It] When following the Cluster API quick-start Should create a workload cluster
• capi-e2e [It] When following the Cluster API quick-start with v1beta1 ClusterClass [ClusterClass] Should create a workload cluster [ClusterClass]
• When testing Cluster API working on self-hosted clusters using ClusterClass with a HA control plane [ClusterClass] Should pivot the bootstrap cluster to a self-hosted cluster [ClusterClass]
• capi-e2e [It] When testing Cluster API working on self-hosted clusters using ClusterClass [ClusterClass] Should pivot the bootstrap cluster to a self-hosted cluster [ClusterClass]

Since when has it been flaking?

Jan 23 2026

Testgrid link

https://storage.googleapis.com/k8s-triage/index.html?text=tls%3A%20failed%20to%20verify%20certificate&job=.*cluster-api&xjob=.*-provider-

Reason for failure (if possible)

Failure to call webhook because of tls: failed to verify certificate: x509: certificate signed by unknown authority

Anything else we need to know?

First occurrence is Jan 23 2026 but the error peaked Jan 28 and Feb 3 with multiple errors per day

I noticed cert-manager bump was merged around the time the first peak happened
https://github.com/kubernetes-sigs/cluster-api/pull/13279
https://github.com/kubernetes-sigs/cluster-api/pull/13278
https://github.com/kubernetes-sigs/cluster-api/pull/13277

Label(s) to be applied

/kind flake
One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels.

Start by reproducing the listed capi-e2e workload-cluster and self-hosted-cluster tests in the affected Testgrid jobs, then inspect the cert-manager changes in PRs #13277, #13278, and #13279. Done means the affected jobs no longer fail with the unknown-authority webhook error and the identified tests stop flaking.