我继承了一个 GKE Kubernetes 环境,并且几天来一直在尝试解决这个问题,但不幸的是,我不知道下一步该尝试什么。
集群设置为使用 cert-manager(通过 helm 安装)将 Let's Encrypt 证书应用于集群。出于某种原因,这在两年多的时间里一直运行良好,但从 4 月 16 日开始,我开始在浏览器中看到有关集群所有节点的 SSL 警告。
当我运行时,kubectl describe certificates site-cloud-tls
证书似乎已经更新但尚未应用于入口流量。
Name: site-cloud-tls
Namespace: cs
Labels: <none>
Annotations: <none>
API Version: certmanager.k8s.io/v1alpha1
Kind: Certificate
Metadata:
Creation Timestamp: 2019-06-02T09:55:05Z
Generation: 34
Owner References:
API Version: extensions/v1beta1
Block Owner Deletion: true
Controller: true
Kind: Ingress
Name: cs-nginx
UID: 7f312326-851c-11e9-8bf0-4201ac10000c
Resource Version: 541365011
UID: 7f36cc40-851c-11e9-8bf0-4201ac10000c
Spec:
Dns Names:
site.cloud (changed name but is correct)
Issuer Ref:
Kind: ClusterIssuer
Name: letsencrypt-dns
Secret Name: site-cloud-tls
Status:
Conditions:
Last Transition Time: 2022-04-24T05:26:13Z
Message: Certificate is up to date and has not expired
Reason: Ready
Status: True
Type: Ready
Not After: 2022-06-15T17:01:48Z
Events: <none>
kubectl describe ingress
Name: cs-nginx
Namespace: cs
Address: 192.168.1.32
Default backend: default-http-backend:80 (10.16.3.12:8080)
TLS:
site-cloud-tls terminates site.cloud (changed naming but seems correct)
Rules:
Host Path Backends
---- ---- --------
site.cloud
/ site:8080 (10.10.10.10:8080)
Annotations: certmanager.k8s.io/cluster-issuer: letsencrypt-dns
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/ssl-redirect: true
nginx.org/websocket-services: datahub
Events: <none>
我们确实有一个临时环境也受到了影响。我尝试重新安装 cert-manager,重新安装 nginx-ingress,但不幸的是无法恢复正常运行(可能是由于我犯了配置错误)。
3 天后,我不知道该怎么做,也不太了解 Kubernetes,不知道下一步该怎么做。有什么指导吗?我可以提供其他可能有用的信息吗?
谢谢你!
答案1
这里的问题是您指的是cluster-issuer
Ingress 定义中的一种:
Annotations: certmanager.k8s.io/cluster-issuer: letsencrypt-dns
但是你定义的对象是一种Certificate
:
Name: site-cloud-tls
Namespace: cs
Labels: <none>
Annotations: <none>
API Version: certmanager.k8s.io/v1alpha1
Kind: Certificate
这就是为什么它不适用于 Ingress。你需要创建一个发行人Kubernetes 中的资源来处理证书。您可以在此处找到一个基本示例尖端 ClusterIssuer
清单文件:
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
# You must replace this email address with your own.
# Let's Encrypt will use this to contact you about expiring
# certificates, and issues related to your account.
email: [email protected]
server: https://acme-staging-v02.api.letsencrypt.org/directory
privateKeySecretRef:
# Secret resource that will be used to store the account's private key.
name: example-issuer-account-key
# Add a single challenge solver, HTTP01 using nginx
solvers:
- http01:
ingress:
class: nginx