Kubernetes 证书管理器 ssl 错误验证 ACME 帐户

Question

我无法使用证书管理器创建 wilcard ssl，我将我的域添加到 cloudflare，但证书管理器无法验证 ACME 帐户。我如何解决这个问题？

我想为我的域使用 wilcard ssl 并使用任何部署我该怎么做？

我发现错误，但我是如何解决的，错误是我的 k8s 没有解析 dns acme-v02.api.letsencrypt.org

错误是k8s dns找不到我的 k8s 是

Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3-k3s.1", GitCommit:"8343999292c55c807be4406fcaa9f047e8751ffd", GitTreeState:"clean", BuildDate:"2019-06-12T04:56+00:00Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}

错误日志：

I0716 13:06:11.712878       1 controller.go:153] cert-manager/controller/issuers "level"=0 "msg"="syncing item" "key"="default/issuer-letsencrypt" 
I0716 13:06:11.713218       1 setup.go:162] cert-manager/controller/issuers "level"=0 "msg"="ACME server URL host and ACME private key registration host differ. Re-checking ACME account registration" "related_resource_kind"="Secret" "related_resource_name"="issuer-letsencrypt" "related_resource_namespace"="default" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
I0716 13:06:11.713245       1 logger.go:88] Calling GetAccount
E0716 13:06:16.714911       1 setup.go:172] cert-manager/controller/issuers "msg"="failed to verify ACME account" "error"="Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "related_resource_kind"="Secret" "related_resource_name"="issuer-letsencrypt" "related_resource_namespace"="default" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
I0716 13:06:16.715527       1 sync.go:76] cert-manager/controller/issuers "level"=0 "msg"="Error initializing issuer: Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
E0716 13:06:16.715609       1 controller.go:155] cert-manager/controller/issuers "msg"="re-queuing item  due to error processing" "error"="Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "key"="default/issuer-letsencrypt"

我的发行人

apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: issuer-letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: yusufkaan142@gmail.com
    privateKeySecretRef:
      name: issuer-letsencrypt
    dns01:
      providers:
      - name: cf-dns
        cloudflare:
          email: mail@gmail.com
          apiKeySecretRef:
            name: cloudflare-api-key
            key: api-key.txt

秘密：

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-key
  namespace: cert-manager
type: Opaque
data:
  api-key.txt: base64encoded

我的证书：

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: wilcard-theykk-net
  namespace: cert-manager
spec:
  secretName: wilcard-theykk-net
  issuerRef:
    name: issuer-letsencrypt
    kind: Issuer
  commonName: '*.example.net'
  dnsNames:
  - '*.example.net'
  acme:
    config:
    - dns01:
        provider: cf-dns
      domains:
      - '*.example.net'
      - 'example.net'

k8s 的 Dns

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kube-dns
  namespace: kube-system
data:
  upstreamNameservers: |
    ["1.1.1.1","8.8.8.8"]

Answer 1

我将从在您的 K8s 集群中调试 DNS 解析功能开始：

在板上使用基本网络工具启动一些容器：

kubectl run -i -t busybox --image=radial/busyboxplus:curl --restart=Never

从 busybox 容器检查 /etc/resolv.conf 文件并确保您可以解析 Kubernetes DNS service kube-dns:

$ cat /etc/resolv.conf 
nameserver 10.96.0.10
search default.svc.cluster.local svc.cluster.local cluster.local c.org-int.internal google.internal
options ndots:5

向 kubernetes.default 发出查找请求，该请求应该可以毫无问题地使用 DNS 名称服务器获得输出：

$ nslookup kubernetes.default
Server:    10.96.0.10
Address 1: 10.96.0.10 kube-dns.kube-system.svc.cluster.local

Name:      kubernetes.default
Address 1: 10.96.0.1 kubernetes.default.svc.cluster.local

由于你已经在相应的kube-dns ConfigMap中定义了upstreamNameservers，检查你是否可以ping通上游域名服务器：1.1.1.1和8.8.8.8应该可以从 Pod 中访问。

验证每个容器（kubedns、dnsmasq、sidecar）的任何可疑事件的 DNS pod 日志：

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c kubedns

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c dnsmasq

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c sidecar

如果您对所有先例步骤都没有问题，那么 DNS 发现工作正常，因此您还可以检查 Cloudflare DNS firewall configuration in order to exclude potential restrictions. More relevant information about troubleshooting DNS issue you can find in the official K8s documentation.

Kubernetes 证书管理器 ssl 错误验证 ACME 帐户

Kubernetes cert manager ssl error verify ACME account

ssl

kubernetes

certificate

lets-encrypt

cert-manager