等待 HTTP-01 挑战传播：执行自检 GET 请求失败 - ISTIO

Question

我等了 ~1 分钟后收到此错误

Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://jenkins.xyz.in/.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I': Get "http://jenkins.xyz.in/.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I": dial tcp 103.66.96.201:80: connect: connection timed out

我可以从任何地方（互联网）在浏览器中访问此 url

curl -v http://jenkins.xyz.in/.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I
*   Trying 103.66.96.201:80...
* Connected to jenkins.xyz.in (103.66.96.201) port 80 (#0)
> GET /.well-known/acme-challenge/AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_Vfe4I HTTP/1.1
> Host: jenkins.xyz.in
> User-Agent: curl/7.71.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< cache-control: no-cache, no-store, must-revalidate
< date: Wed, 13 Jan 2021 08:54:23 GMT
< content-length: 87
< content-type: text/plain; charset=utf-8
< x-envoy-upstream-service-time: 1
< server: istio-envoy
< 
* Connection #0 to host jenkins.xyz.in left intact
AoV9UtBq1rwPLDXWjrq85G5Peg_Z6rLKSZyYL_VfT4I.EZvkP5Fpi6EYc_-tWTQgvaQxrrbSr2MEJkuXJaywatk

我的设置是：

1. Istio Ingress load balancer running on node (192.168.14.118)
2. I am pointing my external IP and domain jenkins.xyz.in 
to 192.168.14.118 through an another load balancer

request -> public IP -> load balancer -> 192.168.14.118

从外面看效果很好。但是当我从节点本身/从集群内的 pod 尝试这个时，我得到：

$ curl -v http://jenkins.xyz.in/
* About to connect() to jenkins.xyz.in port 80 (#0)
*   Trying 103.66.96.201...

我在某处读到过发夹

由于我的 kubernetes 节点 IP 和 istio ingress loadbalacer 外部 IP 相同，请求可能正在循环。

额外：我是运行裸机上的 k8s

有解决办法吗？

Answer 1

我找到了解决方法。

由于我的节点无法访问 URL（循环），我向集群添加了另一个节点并将 Cert-Manager pods affinity 设置为新节点。

Cert-Manager 能够从新节点访问 URL。虽然不是一个好的解决方案，但对我有用。

等待 HTTP-01 挑战传播：执行自检 GET 请求失败 - ISTIO

Waiting for HTTP-01 challenge propagation: failed to perform self check GET request - ISTIO

kubernetes

istio

cert-manager