Question

我正在尝试为单独的开发、暂存和生产环境设置一个带有 HTTPS 入口控制器的 Azure Kubernetes 集群。我遵循了关于如何 Create an HTTPS ingress controller on Azure Kubernetes Service (AKS) 的 Microsoft Azure 指南，它允许我为单个命名空间设置 HTTPS 入口控制器，但我的最终目标是为开发、登台和生产环境拥有单独的命名空间。根据对 this question 的回答，这样做的方法是将入口控制器放在一个命名空间（在我的例子中为 ingress），然后为每个命名空间（dev就我而言）。

因此，我在 ingress 命名空间上设置了 nginx 入口控制器和证书管理器：

# Add the ingress-nginx repository
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

# Use Helm to deploy an NGINX ingress controller
helm install nginx-ingress ingress-nginx/ingress-nginx \
    --namespace ingress \
    --set controller.replicaCount=2 \
    --set controller.nodeSelector."beta\.kubernetes\.io/os"=linux \
    --set defaultBackend.nodeSelector."beta\.kubernetes\.io/os"=linux \
    --set controller.admissionWebhooks.patch.nodeSelector."beta\.kubernetes\.io/os"=linux

# Label the ingress-basic namespace to disable resource validation
kubectl label namespace ingress cert-manager.io/disable-validation=true

# Add the Jetstack Helm repository
helm repo add jetstack https://charts.jetstack.io

# Update your local Helm chart repository cache
helm repo update

# Install the cert-manager Helm chart
helm install cert-manager jetstack/cert-manager \
  --namespace ingress \
  --version v0.16.1 \
  --set installCRDs=true \
  --set nodeSelector."kubernetes\.io/os"=linux \
  --set webhook.nodeSelector."kubernetes\.io/os"=linux \
  --set cainjector.nodeSelector."kubernetes\.io/os"=linux

然后我用以下内容创建一个 cluster-issuer.yml 文件：

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: email@address.com
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
        ingress:
          class: nginx
          podTemplate:
            spec:
              nodeSelector:
                "kubernetes.io/os": linux

我申请的

$ kubectl apply -f cluster-issuer.yml

接下来，我使用以下 dev 文件在 ingress.yml 命名空间上创建入口规则：

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-dev
  namespace: dev
  annotations:
    kubernetes.io/ingress.class: nginx
    ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    cert-manager.io/cluster-issuer: letsencrypt
    
spec:
  tls:
  - hosts:
    - domain.azure.com
    secretName: tls-secret-dev
  rules:
  - host: domain.azure.com
    http:
      paths:
      - backend:
          serviceName: my-service
          servicePort: 80
        path: /dev/my-service(/|$)(.*)

并应用它：

$ kubectl apply -f ingress.yml

现在我检查是否已经创建了一个秘密：

$ kubectl get certificate -n dev
NAME             READY   SECRET           AGE
tls-secret-dev   False   tls-secret-dev   61s

所以似乎在创建秘密时出了点问题。如果我查看证书，似乎需要一个证书，但它永远不会比这更进一步：

$ kubectl describe certificate tls-secret -n dev
Name:         tls-secret-dev
Namespace:    dev
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1beta1
Kind:         Certificate
...
Status:
  Conditions:
    Last Transition Time:        2021-02-16T13:47:33Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2021-02-16T13:47:33Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  tls-secret-dev-6ngw8
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Issuing    70s   cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  70s   cert-manager  Stored new private key in temporary Secret resource "tls-secret-dev-6ngw8"
  Normal  Requested  70s   cert-manager  Created new CertificateRequest resource "tls-secret-dev-vtlbd"

查看证书请求，创建订单：

$ kubectl describe certificaterequest tls-secret-dev-vtlbd -n dev
Name:         tls-secret-dev-vtlbd
Namespace:    dev
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: tls-secret-dev
              cert-manager.io/certificate-revision: 1
              cert-manager.io/private-key-secret-name: tls-secret-dev-6ngw8
API Version:  cert-manager.io/v1beta1
Kind:         CertificateRequest
...
Status:
  Conditions:
    Last Transition Time:  2021-02-16T13:47:33Z
    Message:               Waiting on certificate issuance from order dev/tls-secret-dev-vtlbd-526778456: ""
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  OrderCreated  3m3s  cert-manager  Created Order resource dev/tls-secret-dev-vtlbd-526778456

检查订单是线索似乎变冷的地方：

$ kubectl describe order tls-secret-dev-vtlbd-526778456 -n dev
Name:         tls-secret-dev-vtlbd-526778456
Namespace:    dev
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: tls-secret-dev
              cert-manager.io/certificate-revision: 1
              cert-manager.io/private-key-secret-name: tls-secret-dev-6ngw8
API Version:  acme.cert-manager.io/v1beta1
Kind:         Order
...
Status:
Events:  <none>

问题：如何让证书管理器停止等待证书颁发，以便我可以完成 HTTPS 入口控制器的设置？

Kubernetes 证书管理器与 letencrypt 等待证书颁发

0 个答案: