Question

我对Kubernetes很陌生。但是到目前为止，已经能够配置AKS（Azure Kubernetes Services）集群。我的服务有多个命名空间（Dev，stage，prod）。并使用nginx配置了Ingress服务（设置为自己的命名空间“ ingress-nginx” ）。该设置与HTTP完美配合。

当我尝试使用HTTPS时，我的问题开始了。首先使用this脚本安装了cert-manager。它已经再次创建了自己的名称空间：“ cert-manager” 我不是仅使用常规清单作为HELM 。还遵循了MS Azure DNS config。

一切似乎正确，我有我的服务，机密信息，clusterIssuer等。甚至在Azure DNS区域中创建了挑战。您可以在Azure门户上看到它。但是我没有得到任何证书。

ClusterIssuer配置：

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: 8b3s-org-letsencrypt
spec:
  acme:
    #server: https://acme-v02.api.letsencrypt.org/directory
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: <...@gmail.com>
    privateKeySecretRef:
      name: 8b3s-org-letsencrypt-key
    solvers:
    - selector:
      dns01:
        azuredns:
          clientID: ....
          clientSecretSecretRef:
          # The following is the secret we created in Kubernetes. Issuer will use this to present challenge to Azure DNS.
            name: azuredns-config
            key: client-secret
          subscriptionID: ....
          tenantID: "...."
          resourceGroupName: Web
          hostedZoneName: 8b3s.org
          # Azure Cloud Environment, default to AzurePublicCloud
          environment: AzurePublicCloud

入口配置：

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: 8b3s-virtual-host-ingress
  namespace: ingress-nginx
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: "8b3s-org-letsencrypt"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/tls-acme: "true"
spec:
  tls:
  - hosts:
     - '*.8b3s.org'
    secretName: 8b3s-org-letsencrypt-tls
  rules:
  - host: dev.8b3s.org
    http:
      paths:
      - path: /
        backend:
          serviceName: the8b3swebsite-development-ext
          servicePort: 8080

所以问题是每个配置似乎都可以，但是根本没有证书。 我只有一个'Opaque''tls.key： 1679个字节”作为“证书管理器”名称空间中的“ 8b3s-org-letsencrypt-key”。

已为“ ingress-nginx”命名空间“ 8b3s-org-letsencrypt-tls”创建了类型为“ kubernetes.io/tls”的证书。但是“ ca.crt：0个字节”和“ tls.crt：0个字节” 。

我也正在研究cert-manager pod的输出。发现那两个奇怪的日志（如果需要，我有完整的日志）：

I0222 22:51:00.067791       1 acme.go:201] cert-manager/controller/certificaterequests-issuer-acme/sign "msg"="acme Order resource is not in a ready state, waiting..." "related_resource_kind"="Order" "related_resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645" "related_resource_namespace"="ingress-nginx" "resource_kind"="CertificateRequest" "resource_name"="8b3s-org-letsencrypt-tls-1807766204" "resource_namespace"="ingress-nginx" 

I0222 22:51:00.068069       1 sync.go:129] cert-manager/controller/orders "msg"="Creating additional Challenge resources to complete Order" "resource_kind"="Order" "resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645" "resource_namespace"="ingress-nginx" 

E0222 22:51:01.876182       1 sync.go:184] cert-manager/controller/challenges "msg"="propagation check failed" "error"="DNS record for \"8b3s.org\" not yet propagated" "dnsName"="8b3s.org" "resource_kind"="Challenge" "resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645-481622463" "resource_namespace"="ingress-nginx" "type"="dns-01"

有什么问题吗？

更新：根据建议将Azure NS记录添加到我的域DNS中。等待了一个小时左右，但没有效果...删除了现有的CA机密，重新启动了所有Nginx，cert-manager Pods。并注意到以下错误：

E0225 10:14:03.671099       1 util.go:71] cert-manager/controller/certificaterequests/handleOwnedResource "msg"="error getting order referenced by resource" "error"="certificaterequest.cert-manager.io \"8b3s-org-letsencrypt-tls-1807766204\" not found" "related_resource_kind"="CertificateRequest" "related_resource_name"="8b3s-org-letsencrypt-tls-1807766204" "related_resource_namespace"="ingress-nginx" "resource_kind"="Order" "resource_name"="8b3s-org-letsencrypt-tls-1807766204-3808299645" "resource_namespace"="ingress-nginx" 
E0225 10:14:03.674679       1 util.go:71] cert-manager/controller/certificates/handleOwnedResource "msg"="error getting order referenced by resource" "error"="certificate.cert-manager.io \"8b3s-org-letsencrypt-tls\" not found" "related_resource_kind"="Certificate" "related_resource_name"="8b3s-org-letsencrypt-tls" "related_resource_namespace"="ingress-nginx" "resource_kind"="CertificateRequest" "resource_name"="8b3s-org-letsencrypt-tls-1807766204" "resource_namespace"="ingress-nginx"

Answer 1

您域的whois record显示它仍然指向NS57.DOMAINCONTROL.COM，而不是您在屏幕快照中显示的4个Azure DNS解析器。因此，Let's Encrypt无法得知他们应该使用Azure来查找该_acme-challenge记录，但记录失败。

无法使用Azure DNS区域使用Kubernetes和Letsencrypt创建通配符（*）证书

1 个答案: