Question

我无法使用证书管理器创建通配符ssl，我将域添加到cloudflare，但是证书管理器无法验证ACME帐户。我该如何解决这个问题？

我想为我的域使用wilcard ssl并使用任何部署方式怎么办？

我发现错误，但我如何解决，错误是我的k8s无法解决dns acme-v02.api.letsencrypt.org

错误是k8s dns找不到我的k8s是

Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3-k3s.1", GitCommit:"8343999292c55c807be4406fcaa9f047e8751ffd", GitTreeState:"clean", BuildDate:"2019-06-12T04:56+00:00Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}

错误日志：

I0716 13:06:11.712878       1 controller.go:153] cert-manager/controller/issuers "level"=0 "msg"="syncing item" "key"="default/issuer-letsencrypt" 
I0716 13:06:11.713218       1 setup.go:162] cert-manager/controller/issuers "level"=0 "msg"="ACME server URL host and ACME private key registration host differ. Re-checking ACME account registration" "related_resource_kind"="Secret" "related_resource_name"="issuer-letsencrypt" "related_resource_namespace"="default" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
I0716 13:06:11.713245       1 logger.go:88] Calling GetAccount
E0716 13:06:16.714911       1 setup.go:172] cert-manager/controller/issuers "msg"="failed to verify ACME account" "error"="Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "related_resource_kind"="Secret" "related_resource_name"="issuer-letsencrypt" "related_resource_namespace"="default" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
I0716 13:06:16.715527       1 sync.go:76] cert-manager/controller/issuers "level"=0 "msg"="Error initializing issuer: Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "resource_kind"="Issuer" "resource_name"="issuer-letsencrypt" "resource_namespace"="default" 
E0716 13:06:16.715609       1 controller.go:155] cert-manager/controller/issuers "msg"="re-queuing item  due to error processing" "error"="Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: i/o timeout" "key"="default/issuer-letsencrypt"

我的发行人

apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: issuer-letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: yusufkaan142@gmail.com
    privateKeySecretRef:
      name: issuer-letsencrypt
    dns01:
      providers:
      - name: cf-dns
        cloudflare:
          email: mail@gmail.com
          apiKeySecretRef:
            name: cloudflare-api-key
            key: api-key.txt

秘密：

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-key
  namespace: cert-manager
type: Opaque
data:
  api-key.txt: base64encoded

我的证书：

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: wilcard-theykk-net
  namespace: cert-manager
spec:
  secretName: wilcard-theykk-net
  issuerRef:
    name: issuer-letsencrypt
    kind: Issuer
  commonName: '*.example.net'
  dnsNames:
  - '*.example.net'
  acme:
    config:
    - dns01:
        provider: cf-dns
      domains:
      - '*.example.net'
      - 'example.net'

Dns for k8s

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kube-dns
  namespace: kube-system
data:
  upstreamNameservers: |
    ["1.1.1.1","8.8.8.8"]

Answer 1

我将首先在您的K8s群集中调试DNS解析功能：

使用板上的基本网络工具启动一些容器：

kubectl run -i -t busybox --image=radial/busyboxplus:curl --restart=Never

从busybox容器中检查/etc/resolv.conf文件，并确保您可以解析Kubernetes DNS service kube-dns：

$ cat /etc/resolv.conf 
nameserver 10.96.0.10
search default.svc.cluster.local svc.cluster.local cluster.local c.org-int.internal google.internal
options ndots:5

向kubernetes.default发出查找请求，该请求应使用DNS名称服务器获得输出，而不会出现任何问题：

$ nslookup kubernetes.default
Server:    10.96.0.10
Address 1: 10.96.0.10 kube-dns.kube-system.svc.cluster.local

Name:      kubernetes.default
Address 1: 10.96.0.1 kubernetes.default.svc.cluster.local

由于您已经在相应的upstreamNameservers ConfigMap中定义了kube-dns，因此请检查是否可以ping通应该访问的上游名称服务器：1.1.1.1和8.8.8.8从Pod内。

验证DNS荚日志中是否存在每个容器（kubedns，dnsmasq，sidecar）的任何可疑事件：

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c kubedns

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c dnsmasq

kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c sidecar

如果您满意所有先例步骤，则DNS发现正常运行，因此，您还可以检查Cloudflare DNS防火墙配置，以排除潜在的限制。有关对DNS问题进行故障排除的更多相关信息，您可以在官方的K8 documentation中找到。

Kubernetes证书管理器SSL错误验证ACME帐户

1 个答案: