Cert-manager various versions ( 15 and 16 ) installed on both k3s version v1.18.8+k3s1 and docker-desktop version v1.16.6-beta.0 using the following command:

helm install cert-manager \
--namespace cert-manager jetstack/cert-manager \
--version v0.16.1 \
--set installCRDs=true \
--set 'extraArgs={--dns01-recursive-nameservers=1.1.1.1:53}'

I applied the following test yaml file:

apiVersion: v1
kind: Namespace
metadata:
  name: test
---
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: test
type: Opaque
stringData:
  api-token: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt
  namespace: test
spec:
  acme:
    email: user@example.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - dns01:
        cloudflare:
          email: user@example.com
          apiTokenSecretRef:
            name: cloudflare-api-token-secret
            key: api-token
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: example.com
  namespace: test
spec:
  secretName: example.com-tls
  issuerRef:
    name: letsencrypt
  dnsNames:
  - example.com

Result (I have waited even hours):

kubectl -n test get certs,certificaterequests,order,challenges,ingress -o wide
NAME                                      READY   SECRET            ISSUER        STATUS                                         AGE
certificate.cert-manager.io/example.com   False   example.com-tls   letsencrypt   Issuing certificate as Secret does not exist   57s

NAME                                                   READY   ISSUER        STATUS                                                                                   AGE
certificaterequest.cert-manager.io/example.com-rx7jg   False   letsencrypt   Waiting on certificate issuance from order test/example.com-rx7jg-273779930: "pending"   56s

NAME                                                     STATE     ISSUER        REASON   AGE
order.acme.cert-manager.io/example.com-rx7jg-273779930   pending   letsencrypt            55s

NAME                                                                   STATE     DOMAIN        REASON                                                                                AGE
challenge.acme.cert-manager.io/example.com-rx7jg-273779930-625151916   pending   example.com   Cloudflare API error for POST "/zones/xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx/dns_records"   53s

Cloudflare setting are the ones from: https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/ and i have tried with both token and key.

Cert-manager pod logs:

I0828 08:34:51.370299       1 dns.go:102] cert-manager/controller/challenges/Present "msg"="presenting DNS01 challenge for domain" "dnsName"="example.com" "domain"="example.com" "resource_kind"="Challenge" "resource_name"="example.com-m72dq-3139291111-641020922" "resource_namespace"="test" "type"="dns-01"
E0828 08:34:55.251730       1 controller.go:158] cert-manager/controller/challenges "msg"="re-queuing item  due to error processing" "error"="Cloudflare API error for POST \"/zones/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/dns_records\"" "key"="test/example.com-m72dq-3139291111-641020922"
I0828 08:35:35.251982       1 controller.go:152] cert-manager/controller/challenges "msg"="syncing item" "key"="test/example.com-m72dq-3139291111-641020922"
I0828 08:35:35.252131       1 dns.go:102] cert-manager/controller/challenges/Present "msg"="presenting DNS01 challenge for domain" "dnsName"="example.com" "domain"="example.com" "resource_kind"="Challenge" "resource_name"="example.com-m72dq-3139291111-641020922" "resource_namespace"="test" "type"="dns-01"
E0828 08:35:38.797954       1 controller.go:158] cert-manager/controller/challenges "msg"="re-queuing item  due to error processing" "error"="Cloudflare API error for POST \"/zones/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/dns_records\"" "key"="test/example.com-m72dq-3139291111-641020922"

What's wrong?

Thank you!