程序员经验分享-hwhale

让我们加密证书颁发

2024-05-16

我正在尝试获取 Let's Encrypt 颁发的证书，已经过去了 3 个半小时。

我不小心最初将我的 SecretName 设置为“echo-tls”，然后将其切换到我想使用的正确的“pandaist-tls”。

我目前有这个：

kubectl get CertificateRequest -o wide
NAME                      READY   ISSUER             STATUS                                                                                             AGE
pandaist-tls-1926992011   False   letsencrypt-prod   Waiting on certificate issuance from order default/pandaist-tls-1926992011-2163900139: "pending"   3h26m

当我描述证书时，我得到以下信息：

Deployment kubectl describe CertificateRequest pandaist-tls-1926992011
Name:         pandaist-tls-1926992011
Namespace:    default
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: pandaist-tls
              cert-manager.io/private-key-secret-name: pandaist-tls
API Version:  cert-manager.io/v1alpha2
Kind:         CertificateRequest
Metadata:
  Creation Timestamp:  2020-04-07T15:41:13Z
  Generation:          1
  Owner References:
    API Version:           cert-manager.io/v1alpha2
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Certificate
    Name:                  pandaist-tls
    UID:                   25c3ff31-447f-4abf-a23e-ec48f5a591a9
  Resource Version:        500795
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/default/certificaterequests/pandaist-tls-1926992011
  UID:                     8295836d-fb99-4ebf-8803-a344d6edb574
Spec:
  Csr:  ABUNCHOFVALUESTHATIWILLNOTDESCRIBE
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   ClusterIssuer
    Name:   letsencrypt-prod
Status:
  Conditions:
    Last Transition Time:  2020-04-07T15:41:13Z
    Message:               Waiting on certificate issuance from order default/pandaist-tls-1926992011-2163900139: "pending"
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:                    <none>

然后我查看我的证书管理器 pod 的日志 - 以下是每个日志的一小部分：

I0407 19:01:35.499469       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-2fp58" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:01:35.499513       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="auth.pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-xhjsr" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:01:35.499534       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-pd9fh" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:01:35.499578       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="auth.pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-b6zr2" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
E0407 19:03:46.571074       1 sync.go:184] cert-manager/controller/challenges "msg"="propagation check failed" "error"="failed to perform self check GET request 'http://pandaist.com/.well-known/acme-challenge/6Wduj2Ejr59OZ9SFy_Rw4jnozE50xspK-a5OIvCwYsc': Get http://pandaist.com/.well-known/acme-challenge/6Wduj2Ejr59OZ9SFy_Rw4jnozE50xspK-a5OIvCwYsc: dial tcp 178.128.132.218:80: connect: connection timed out" "dnsName"="pandaist.com" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
E0407 19:03:46.571109       1 sync.go:184] cert-manager/controller/challenges "msg"="propagation check failed" "error"="failed to perform self check GET request 'http://auth.pandaist.com/.well-known/acme-challenge/gO91--fK0SGG15aS3ALOHXXYtCSly2Q9pbVO8OJW2aE': Get http://auth.pandaist.com/.well-known/acme-challenge/gO91--fK0SGG15aS3ALOHXXYtCSly2Q9pbVO8OJW2aE: dial tcp 178.128.132.218:80: connect: connection timed out" "dnsName"="auth.pandaist.com" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.571382       1 controller.go:135] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="default/pandaist-tls-1926992011-2163900139-832917849" 
I0407 19:03:46.571528       1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="default/pandaist-tls-1926992011-2163900139-832917849" 
I0407 19:03:46.571193       1 controller.go:135] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="default/pandaist-tls-1926992011-2163900139-2157075729" 
I0407 19:03:46.572009       1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="default/pandaist-tls-1926992011-2163900139-2157075729" 
I0407 19:03:46.572338       1 pod.go:58] cert-manager/controller/challenges/http01/selfCheck/http01/ensurePod "level"=0 "msg"="found one existing HTTP01 solver pod" "dnsName"="auth.pandaist.com" "related_resource_kind"="Pod" "related_resource_name"="cm-acme-http-solver-scqtx" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.572600       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="auth.pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-xhjsr" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.572860       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="auth.pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-b6zr2" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-832917849" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.573128       1 pod.go:58] cert-manager/controller/challenges/http01/selfCheck/http01/ensurePod "level"=0 "msg"="found one existing HTTP01 solver pod" "dnsName"="pandaist.com" "related_resource_kind"="Pod" "related_resource_name"="cm-acme-http-solver-jn65v" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.573433       1 service.go:43] cert-manager/controller/challenges/http01/selfCheck/http01/ensureService "level"=0 "msg"="found one existing HTTP01 solver Service for challenge resource" "dnsName"="pandaist.com" "related_resource_kind"="Service" "related_resource_name"="cm-acme-http-solver-2fp58" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01" 
I0407 19:03:46.573749       1 ingress.go:91] cert-manager/controller/challenges/http01/selfCheck/http01/ensureIngress "level"=0 "msg"="found one existing HTTP01 solver ingress" "dnsName"="pandaist.com" "related_resource_kind"="Ingress" "related_resource_name"="cm-acme-http-solver-pd9fh" "related_resource_namespace"="default" "resource_kind"="Challenge" "resource_name"="pandaist-tls-1926992011-2163900139-2157075729" "resource_namespace"="default" "type"="http-01"

然后在这里，我仍然看到 echo-tls，尽管我将入口更改为使用 pandaist-tls：

I0407 15:34:37.115159       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="validatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
I0407 15:34:37.118246       1 controller.go:170] cert-manager/inject-controller "level"=1 "msg"="updated object" "resource_kind"="ValidatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" 
I0407 15:34:37.118520       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="validatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
I0407 15:34:37.119415       1 sources.go:176] cert-manager/inject-controller "level"=0 "msg"="Extracting CA from Secret resource" "resource_kind"="ValidatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" "secret"="cert-manager/cert-manager-webhook-tls"
I0407 15:34:37.120959       1 controller.go:170] cert-manager/inject-controller "level"=1 "msg"="updated object" "resource_kind"="MutatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" 
I0407 15:34:37.121399       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="mutatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
I0407 15:34:37.124545       1 controller.go:170] cert-manager/inject-controller "level"=1 "msg"="updated object" "resource_kind"="ValidatingWebhookConfiguration" "resource_name"="cert-manager-webhook" "resource_namespace"="" 
I0407 15:34:37.125160       1 controller.go:242] cert-manager/controller-runtime/controller "level"=1 "msg"="Successfully Reconciled"  "controller"="validatingwebhookconfiguration" "request"={"Namespace":"","Name":"cert-manager-webhook"}
E0407 16:19:36.762436       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"} 
E0407 16:19:36.762573       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"} 
E0407 16:19:36.762753       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"} 
E0407 16:19:36.762766       1 indexers.go:93] cert-manager/secret-for-certificate-mapper "msg"="unable to fetch certificate that owns the secret" "error"="Certificate.cert-manager.io \"echo-tls\" not found" "certificate"={"Namespace":"default","Name":"echo-tls"} "secret"={"Namespace":"default","Name":"echo-tls"}

我的入口：

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: pandaist-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - pandaist.com
    - auth.pandaist.com
    secretName: pandaist-tls
  rules:
  - host: pandaist.com
    http:
      paths:
      - backend:
          serviceName: pandaist-main
          servicePort: 80
  - host: auth.pandaist.com
    http:
      paths:
      - backend:
          serviceName: pandaist-keycloak
          servicePort: 80

这个入口绝对是在回声入口之后应用的。

这只是正常的证书批准时间（3.5 小时）还是意外包含 echo-tls 扰乱了我的证书颁发？如果是这样，我该如何修复它？


由于负载均衡器在 Digital Ocean 上的工作方式存在错误：

https://www.digitalocean.com/community/questions/how-do-i- Correct-a-connection-timed-out-error-during-http-01-challenge-propagation-with-cert-manager https://www.digitalocean.com/community/questions/how-do-i-correct-a-connection-timed-out-error-during-http-01-challenge-propagation-with-cert-manager

这将解决这个问题：

kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  annotations: 
    # See https://github.com/digitalocean/digitalocean-cloud-controller-manager/blob/master/docs/controllers/services/examples/README.md#accessing-pods-over-a-managed-load-balancer-from-inside-the-cluster
    service.beta.kubernetes.io/do-loadbalancer-hostname: "kube.mydomain.com"
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)

SSL

Kubernetes

sslcertificate

让我们加密证书颁发 的相关文章

随机推荐

  • Eclipse 中选定单词的括号

    几天前 我觉得这个问题很愚蠢 所以不要将其发布在这里 但即使在搜索了很多之后 我也没有找到合适的解决方案 对于那些使用过的人TextEdit 在 Mac 上 他们会完全知道我在说什么 在编码时 我只想在单词或一行上加上引号或括号 为此 我必

  • 如何从除自身之外的其他（blazor）库引用js/css文件？

    我如何引用 使用位于引用的 blazor 项目中的 css cs 文件 该文件与 host cshtml 中的当前项目不同 我的意思是

  • 与 Entity Framework Core 2.0 的一对零关系

    我正在使用 C 和 NET Framework 4 7 将 Entity Framework 6 1 3 Code First 库迁移到 Entity Framework Core 我一直在用 Google 搜索 Entity Framew

  • 寻找完美的正方形

    我有这个Python代码 def sqrt x ans 0 if x gt 0 while ans ans lt x ans ans 1 if ans ans x print x is not a perfect square return

  • 西库里间歇性故障

    我已将 Sikuli 与我的 Selenium 项目集成 为了学习 我使用简单的 gmail 登录应用程序使用 Sikuli 来实现自动化 好吧 我能够执行脚本 现在假设我正在用户名字段中输入一些内容 有时 鼠标不会悬停在用户名字段上 所以

  • Android UnityPlayerActivity 操作栏

    我正在构建一个 Android 应用程序 其中包含 Unity 3d 交互体验 我已将 Unity 项目导入 Android Studio 但启动时该 Activity 是全屏的 并且不显示 Android 操作栏 我怎样才能做到这一点 整

  • 当我使用 ListView 时，ListTile OnTap 正在工作。但是当我使用 ListWheelScrollView 时它不起作用

    当我使用 ListView 时 ListTile OnTap 正在工作 但是当我使用 ListWheelScrollView 时它不起作用 我的意思是它不会被窃听 观点发生变化 但我似乎无法点击它 我在很多地方和链接中寻找解决方案 但仍然找

  • 在 React Web 应用程序中使用 createjs-soundjs

    我想用https www npmjs com package createjs soundjs https www npmjs com package createjs soundjs在 React Web 应用程序上播放声音 我正常安装了

  • 使用 PC/SC 读卡器验证 Ultralight EV1

    我在尝试使用 Java 中的 PC SC 读卡器 特别是 ACR1222L 验证 Ultralight EV1 卡时遇到问题 我能够使用 ISO 14443 3 标签的相应 APDU 在不受保护的标签上进行写入和读取 但是 我找不到运行 P

  • 如何在haskell中获取变量名称

    我来到 haskell 时有一些 c 背景知识 想知道是否有类似的 define print a printf s d n a a int a 5 print a 应该打印 a 5 这是 augustss 提到的 TH 解决方案 LANGU

  • [WebCoreSharedBufferData getBytes:range:]: 范围 {0, 8} 超出数据长度 0'

    我正在更新我的 iOs 7 应用程序 我为 cordova 电话间隙 开发了这个应用程序 当我运行这个应用程序时 我收到错误 FirstDemo 175

  • 如果选中复选框则显示 div

    我正在尝试构建类似 WordPress 选项的东西 用于在创建文章时切换字段可见性 我所构建的依赖于 click函数使用相应的字段名称切换父项 我想知道如果选中该复选框 执行此操作的最佳方法是什么 因为如果您选中一个框并重新加载页面 因为它

  • 如何制作一个makefile只用于编译一些java文件？

    我有三个java文件 名为A java B java C java A将创建对象B B将创建对象C 但我以前从未构建过makefile 有谁可以帮我构建一个 makefile 来编译这三个 java 文件吗 我应该使用什么工具来制作 mak

  • 当 Verb="runas" 时设置 ProcessStartInfo.EnvironmentVariables

    我正在开发一个 C 应用程序 我需要创建变量并将其传递给新进程 我正在使用ProcessStartInfo EnvironmentVariables 新进程必须提升运行 因此我使用 Verb runas var startInfo new

  • 升级到 Spring boot 1.4 后服务无法启动

    我刚刚升级了所有 Spring Boot 服务1 3 6 RELEASE to 1 4 0 RELEASE 现在它们都在启动时崩溃 Caused by java lang NoClassDefFoundError org springfra

  • wavfile.read python 文件意外结束

    我正在尝试通过以下代码读取 wav 音频文件 from scipy io import wavfile file PC1 20090513 050000 0010 wav rate audio wavfile read file 但它显示以

  • asp.net 视图状态加密

    我有几个关于何时以及如何在 ASP NET 3 5 中加密视图状态的问题 例如 如果我的 web config 中有一个机器密钥条目 例如 解密Key 自动生成 IsolateApps 验证 AES 解密 自动 gt 此时视图状态是否已加密

  • 使用“禁止：/*？”在 robots.txt 文件中

    I used Disallow 在 robots txt 文件中禁止所有可能包含 的页面在网址中 该语法是否正确 或者我是否也阻止了其他页面 这取决于机器人 遵循原始 robots txt 规范的机器人不会给出 任何特殊含义 这些机器人会阻

  • 在二进制数据文件的标头中放入什么

    我有一个模拟 可以读取我们创建的大型二进制数据文件 10 到 100 GB 出于速度原因 我们使用二进制 这些文件依赖于系统 是从我们运行的每个系统上的文本文件转换而来的 所以我不关心可移植性 当前的文件是 POD 结构的许多实例 使用 f

  • 让我们加密证书颁发

    我正在尝试获取 Let s Encrypt 颁发的证书 已经过去了 3 个半小时 我不小心最初将我的 SecretName 设置为 echo tls 然后将其切换到我想使用的正确的 pandaist tls 我目前有这个 kubectl g

热门标签