证书管理器挑战悬而未决的 Kubernetes

Question

我让它在我已经设置的一个站点应用程序上运行，现在我只是想用另一个名称space.[=26= 为不同的 site/domain 复制完全相同的东西]

所以 staging.correct.com 是我的工作 https 域

和 staging.example.com 是我不工作的 https 域（http 工作 - 只是不是 https）

当我执行以下操作时，它会显示 3 个证书，工作中的一个用于正确，然后 2 个用于 example.com，而它应该只有一个，例如：

kubectl get -A 证书

correct         staging-correct-com           True    staging-correct-com-tls   10d
example   staging-example-com           False   staging-example-com-tls   16h
example   staging-example-website-com   False   staging-example-com-tls   17h

当我这样做时： kubectl get -A certificaterequests 它显示了示例的 2 个证书请求

example   staging-example-com-nl46v           False   15h
example   staging-example-website-com-plhqb   False   15h

当我这样做时： kubectl get ingressroute -A

NAMESPACE       NAME                                         AGE
correct         correct-ingress-route                        10d
correct         correct-secure-ingress-route                 6d22h
kube-system     traefik-dashboard                            26d
example   example-website-ingress-route          15h
example   example-website-secure-ingress-route   15h
routing         dashboard                                    29d
routing         traefik-dashboard                            6d21h

当我这样做时： kubectl get secrets -A（只显示相关的）

correct           default-token-bphcm                       kubernetes.io/service-account-token 
correct           staging-correct-com-tls             kubernetes.io/tls 

example     default-token-wx9tx                       kubernetes.io/service-account-token   
example     staging-example-com-tls             Opaque                               
example     staging-example-com-wf224           Opaque                                
example     staging-example-website-com-rzrvw   Opaque

来自证书管理器 pod 的日志：

1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "msg"="found an existing HTTP01 solver ingress" "dnsName"="staging.example.com" "related_resource_kind"= “入口”“related_resource_name”=“cm-acme-http-solver-bqjsj”“related_resource_namespace”=“示例”“related_resource_version”=“v1beta1”“ resource_kind"="挑战""resource_name"="staging-example-com-ltjl6-1661100417-771202110""resource_namespace"="示例""resource_version"="v1" "type"="HTTP-01"

当我这样做时： kubectl 获取挑战-A

example   staging-example-com-nl46v-1661100417-2848337980                   staging.example.com   15h
example   staging-example-website-com-plhqb-26564845-3987262508   pending   staging.example.com

当我这样做时：kubectl get order -A

NAMESPACE       NAME                                               STATE     AGE
example   staging-example-com-nl46v-1661100417         pending   17h
example   staging-example-website-com-plhqb-26564845   pending   17h

我的 yml 文件：

我的入口路线：

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  namespace: example
  name: example-website-ingress-route
annotations:
  kubernetes.io/ingress.class: "traefik"
  cert-manager.io/issuer: example-issuer-staging
  traefik.ingress.kubernetes.io/router.entrypoints: web
  traefik.frontend.redirect.entryPoint: https
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`staging.example.com`)
      middlewares:
        - name: https-only
      kind: Rule
      services:
        - name: example-website
          namespace: example
          port: 80

我的发行人：

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: example-issuer-staging
  namespace: example
spec:
  acme:
    # The ACME server  URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: example@example.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: staging-example-com-tls
    # Enable the HTTP-01 challenge  provider
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - http01:
        ingress:
          class: traefik

我的中间件：

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: https-only
  namespace: example
spec:
  redirectScheme:
    scheme: https
    permanent: true

我的安全入口路线：

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  namespace: example
  name: example-website-secure-ingress-route
annotations:
  kubernetes.io/ingress.class: "traefik"
  cert-manager.io/issuer: example-issuer-staging
  traefik.ingress.kubernetes.io/router.entrypoints: websecure
  traefik.frontend.redirect.entryPoint: https
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`staging.example.com`)
      kind: Rule
      services:
        - name: example-website
          namespace: example
          port: 80
  tls:
    domains:                      
    - main: staging.example.com
    options:
      namespace: example
    secretName: staging-example-com-tls

我的服务：

apiVersion: v1
kind: Service
metadata:
  namespace: example
  name: 'example-website'
spec:
  type: ClusterIP
  ports:
    - protocol: TCP
      name: http
      port: 80
      targetPort: 80
    - protocol: TCP
      name: https
      port: 443
      targetPort: 80
  selector:
    app: 'example-website'

我的求解器：

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: staging-example-com
  namespace: example
spec:
  secretName: staging-example-com-tls
  issuerRef:
    name: example-issuer-staging
    kind: Issuer
  commonName: staging.example.com
  dnsNames:
  - staging.example.com

我的应用程序：

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  namespace: example
  name: 'example-website'
  labels:
    app: 'example-website'
    tier: 'frontend'
spec:
  replicas: 1
  selector:
    matchLabels:
      app: 'example-website'
  template:
    metadata:
      labels:
        app: 'example-website'
    spec:
      containers:
      - name: example-website-container
        image: richarvey/nginx-php-fpm:1.10.3 
        imagePullPolicy: Always
        env:
          - name: SSH_KEY
            value: 'secret'
          - name: GIT_REPO
            value: 'url of source code for site'
          - name: GIT_EMAIL
            value: 'example@example.com'
          - name: GIT_NAME
            value: 'example'
        ports:
        - containerPort: 80

如何删除示例名称space中的所有这些机密、订单、证书和内容，然后重试？ cert-manager 是否允许您在不连续重新启动它们的情况下执行此操作？

编辑：

我删除了名字space重新部署，然后：

kubectl describe certificates staging-example-com -n example

Spec:
  Common Name:  staging.example.com
  Dns Names:
    staging.example.com
  Issuer Ref:
    Kind:       Issuer
    Name:       example-issuer-staging
  Secret Name:  staging-example-com-tls

Status:
  Conditions:
    Last Transition Time:        2020-09-26T21:25:06Z
    Message:                     Issuing certificate as Secret does not contain a certificate
    Reason:                      MissingData
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2020-09-26T21:25:07Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  staging-example-com-gnbl4

Events:
  Type    Reason     Age    From          Message
  ----    ------     ----   ----          -------
  Normal  Issuing    3m10s  cert-manager  Issuing certificate as Secret does not exist
  Normal  Reused     3m10s  cert-manager  Reusing private key stored in existing Secret resource "staging-example-com-tls"
  Normal  Requested  3m9s   cert-manager  Created new CertificateRequest resource "staging-example-com-qrtfx"

然后我做了：

kubectl describe certificaterequest staging-example-com-qrtfx -n example

Status:
  Conditions:
    Last Transition Time:  2020-09-26T21:25:10Z
    Message:               Waiting on certificate issuance from order example/staging-example-com-qrtfx-1661100417: "pending"
    Reason:                Pending
    Status:                False
    Type:                  Ready

Events:
  Type    Reason        Age    From          Message
  ----    ------        ----   ----          -------
  Normal  OrderCreated  8m17s  cert-manager  Created Order resource example/staging-example-com-qrtfx-1661100417
  Normal  OrderPending  8m17s  cert-manager  Waiting on certificate issuance from order example/staging-example-com-qrtfx-1661100417: ""

所以我做了：

kubectl 描述挑战 staging-example-com-qrtfx-1661100417 -n example

Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for HTTP-01 challenge propagation: wrong status code '404', expected '200'
  State:       pending

Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Started    11m   cert-manager  Challenge scheduled for processing
  Normal  Presented  11m   cert-manager  Presented challenge using HTTP-01 challenge mechanism

Answer 1

我明白了。问题似乎是 IngressRoute（在 traefik 中使用）不适用于 cert mananger。我刚刚部署了这个文件，然后http检查确认了，然后我可以再次删除它。希望这对遇到同样问题的其他人有所帮助。

证书管理器似乎支持 Traefik 中的 IngressRoute？我在这里打开了这个问题，让我们看看他们怎么说：https://github.com/jetstack/cert-manager/issues/3325

kubectl apply -f example-ingress.yml

文件：

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  namespace: example
  name: example-ingress
  annotations:
    kubernetes.io/ingress.class: "traefik"
    cert-manager.io/issuer: example-issuer-staging
spec:
  rules:
  - host: staging.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: example-website
          servicePort: 80
  tls:
  - hosts:
    - staging.example.com
    secretName: staging-example-com-tls

证书管理器挑战悬而未决的 Kubernetes

Cert Manager Challenge Pending Kubernetes

ssl-certificate

kubernetes

traefik

cert-manager