LetsEncrypt 未通过 AWS EKS 中的 Kubernetes 入口和负载均衡器进行验证

Question

客户端发行者

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: my@email.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    # Enable the HTTP-01 challenge provider
    solvers:
      - http01:
          ingress:
            class:  nginx

Ingress.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: echo-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-staging"
spec:
  tls:
  - hosts:
    - echo0.site.com
    secretName: echo-tls
  rules:
    - host: echo0.site.com
      http:
        paths:
        - backend:
            serviceName: echo0
            servicePort: 80

活动

12m         Normal    IssuerNotReady         certificaterequest/echo-tls-3171246787   Referenced issuer does not have a Ready status condition
12m         Normal    GeneratedKey           certificate/echo-tls                     Generated a new private key
12m         Normal    Requested              certificate/echo-tls                     Created new CertificateRequest resource "echo-tls-3171246787"
4m29s       Warning   ErrVerifyACMEAccount   clusterissuer/letsencrypt-staging        Failed to verify ACME account: context deadline exceeded
4m29s       Warning   ErrInitIssuer          clusterissuer/letsencrypt-staging        Error initializing issuer: context deadline exceeded

kubectl 描述证书

Name:         echo-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha3
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-04-04T23:57:22Z
  Generation:          1
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  echo-ingress
    UID:                   1018290f-d7bc-4f7c-9590-b8924b61c111
  Resource Version:        425968
  Self Link:               /apis/cert-manager.io/v1alpha3/namespaces/default/certificates/echo-tls
  UID:                     0775f965-22dc-4053-a6c2-a87b46b3967c
Spec:
  Dns Names:
    echo0.site.com
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt-staging
  Secret Name:  echo-tls
Status:
  Conditions:
    Last Transition Time:  2020-04-04T23:57:22Z
    Message:               Waiting for CertificateRequest "echo-tls-3171246787" to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  GeneratedKey  18m   cert-manager  Generated a new private key
  Normal  Requested     18m   cert-manager  Created new CertificateRequest resource "echo-tls-3171246787"

这几天一直在做这件事。我尝试过不同的域，但结果相同。我错过了什么吗 here/steps。它基于本教程 here

如有任何帮助，我们将不胜感激。

Answer 1

通常对于 golang 应用程序，错误 context deadline exceeded 表示连接超时。这听起来像是 cert-manager pod 无法到达 ACME API，如果您的集群有出站防火墙，and/or 没有 NAT 或 Internet 网关连接到子网

Answer 2

这可能值得一看。我遇到了类似的问题。

在 ingress-nginx 服务中更改 LoadBalancer。

Add/Change externalTrafficPolicy: Cluster.

原因是，带有证书颁发者的 pod 与负载均衡器在不同的节点上结束，因此它无法通过入口与自己对话。

以下是取自 https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.26.1/deploy/static/provider/cloud-generic.yaml

的完整块

kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  #CHANGE/ADD THIS
  externalTrafficPolicy: Cluster
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https

---

LetsEncrypt 未通过 AWS EKS 中的 Kubernetes 入口和负载均衡器进行验证

LetsEncrypt not verifying via Kubernetes ingress and loadbalancer in AWS EKS

amazon-web-services

kubernetes

lets-encrypt

kubernetes-ingress

amazon-eks