Repeated secret sync to Cloudflare causes IP quota exhaustion (error 1221)

[stokbaek]

When syncing a secret to Cloudflare, the process retries multiple times within seconds, leading to the creation of duplicate TLS certificates.

This exhausts Cloudflare’s custom certificate IP quota for the zone (error code 1221), blocking further updates.

  {
    "action": "Sync",
    "id": "[REDACTED]",
    "level": "info",
    "msg": "certificate synced",
    "secretName": "[REDACTED]",
    "secretNamespace": "cert-manager",
    "store": "cloudflare",
    "time": "2026-05-26T13:33:23Z"
  },
  {
    "action": "HandleSecret",
    "level": "info",
    "msg": "Secret synced to 1 store",
    "name": "[REDACTED]",
    "namespace": "ingress-nginx",
    "time": "2026-05-26T13:33:23Z"
  },
  {
    "action": "Sync",
    "id": "[REDACTED]",
    "level": "info",
    "msg": "certificate synced",
    "secretName": "[REDACTED]",
    "secretNamespace": "cert-manager",
    "store": "cloudflare",
    "time": "2026-05-26T13:33:24Z"
  },
  {
    "action": "HandleSecret",
    "level": "info",
    "msg": "Secret synced to 1 store",
    "name": "[REDACTED]",
    "namespace": "ingress-nginx",
    "time": "2026-05-26T13:33:24Z"
  },
  {
    "action": "Sync",
    "id": "[REDACTED]",
    "level": "info",
    "msg": "certificate synced",
    "secretName": "[REDACTED]",
    "secretNamespace": "cert-manager",
    "store": "cloudflare",
    "time": "2026-05-26T13:33:25Z"
  },
  {
    "action": "HandleSecret",
    "level": "error",
    "msg": "failed to sync secret to 1 store",
    "error": "Custom certificate IP quota exceeded for this zone (Cloudflare API error code: 1221)",
    "name": "[REDACTED]",
    "namespace": "ingress-nginx",
    "store": "cloudflare",
    "error_count": 1,
    "time": "2026-05-26T13:33:25Z"
  },
  {
    "fn": "main",
    "level": "error",
    "msg": "errors syncing secret ingress-nginx/[REDACTED]: [store cloudflare sync failed: Custom certificate IP quota exceeded for this zone (Cloudflare API error code: 1221)]",
    "time": "2026-05-26T13:33:25Z"
  }
]

[robertlestak]

Quick question to confirm the root cause: are these secrets managed by a GitOps tool (ArgoCD, Flux, etc.), and does the applied manifest set an empty write-back annotation — e.g. cert-manager-sync.lestak.sh/cloudflare-cert-id: ""?

If so, that would explain the loop: the operator fills in the cert id after a sync, the GitOps tool reverts it back to empty on its next reconcile, and the operator — seeing an empty id — takes the create path again and mints a brand-new certificate. Repeat until the zone's IP quota (1221) is exhausted.

The latest tag (v1.5.3) should address this: operator write-back annotations are now excluded from change detection, so a GitOps tool resetting them no longer triggers a re-sync. Upgrading should stop the duplicate cert creation.

Could you confirm whether that matches your setup?

[stokbaek]

We do not use GitOps, ArgoCD, or any other management tool for this secret, only cert-manager.

While the 1.5.3 update resolved the multiple sync issue, it still leaves old TLS certificates in the Cloudflare store.

Is this the intended behavior, and we need to manually delete the old synced TLS certificates?