New fleet application: HTTPS does not respond, the certificate has been stuck in “Provisioning” since yesterday

Sebou Flotte, a utility vehicle rental company in Kenitra, is migrating its fleet tracking application to GKE. Yesterday, the team deleted the old test Ingress, reserved the global static IP ip-app-flotte and deployed the new Ingress app-flotte with a ManagedCertificate cert-app for app.sebouflotte.ma.

This morning, the branch managers in Kenitra and Sidi Kacem cannot access the application: the browser gets no response. The certificate has been “Provisioning” for 19 hours. The contractor wants to delete and recreate the certificate; a colleague thinks a CAA record is blocking Google's certificate authority.

You are on your workstation with gcloud (project sebou-flotte-prod-2468, number 836104927351) and kubectl on the cluster gke-flotte-ew1, namespace flotte. The public DNS zone sebouflotte.ma is hosted in Cloud DNS (zone-sebouflotte).