[英]How do I test a ClusterIssuer solver?
我正在嘗試在 DigitalOcean 上使用 LetsEncrypt 部署帶有 SSL 證書的 Kubernetes 集群。 我按照這些說明進行操作,直到 ClusterIssuer 創建挑戰訂單之前一切正常。 然后我得到這個錯誤:
cert-manager/controller/orders "msg"="Failed to determine the list of Challenge resources needed for the Order" "error"="no configured challenge solvers can be used for this challenge" "resource_kind"="Order" "resource_name"="letsencrypt-prod-cert-458163912-1173127706"
我已經嘗試過使用 http 並嘗試配置 DigitalOcean 的dns01
解析器,但都不起作用,並且出現了類似的錯誤。 該網站由 ip 和 dns 名稱直播(盡管我收到了無 ssl 證書警告)。 這是 ClusterIssuer 描述:
Name: letsencrypt-issuer
Namespace:
Labels: app/instance=webapp
app/managed-by=Tiller
app/name=webapp
app/version=0.1.0
helm.sh/chart=webapp-0.1.0
Annotations: cert-manager.io/cluster-issuer: letsencrypt-issuer
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: true
API Version: cert-manager.io/v1alpha2
Kind: ClusterIssuer
Metadata:
Creation Timestamp: 2019-10-16T23:24:47Z
Generation: 2
Resource Version: 10300992
Self Link: /apis/cert-manager.io/v1alpha2/clusterissuers/letsencrypt-issuer
UID: 2ee08cd4-5781-4126-9e6d-6b9d108a1eb2
Spec:
Acme:
Email: <redacted>
Private Key Secret Ref:
Name: letsencrypt-prod-cert
Server: https://acme-v02.api.letsencrypt.org/directory
Status:
Acme:
Last Registered Email: <redacted>
Uri: https://acme-v02.api.letsencrypt.org/acme/acct/69503670
Conditions:
Last Transition Time: 2019-10-16T23:24:48Z
Message: The ACME account was registered with the ACME server
Reason: ACMEAccountRegistered
Status: True
Type: Ready
Events: <none>
有沒有辦法查看求解器本身來驗證它們的配置是否正確? 有沒有辦法鍛煉它們來證明它們有效? 有沒有其他方法可以診斷情況是什么? 我完全被卡住了,因為似乎沒有很多在線支持?
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: certificate-name
spec:
secretName: tls-cert
duration: 24h
renewBefore: 12h
commonName: hostname
dnsNames:
- hostname
issuerRef:
name: letsencrypt
kind: ClusterIssuer
apiVersion: certmanager.k8s.io/v1alpha2
kind: ClusterIssuer
metadata:
name: letsencrypt
spec:
acme:
email: myemail@email.com
privateKeySecretRef:
name: letsencrypt-private-key
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- http01:
ingress:
class: nginx
selector: {}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
certmanager.k8s.io/acme-challenge-type: http01
certmanager.k8s.io/cluster-issuer: letsencrypt
name: ingress-rule
namespace: default
spec:
rules:
- host: hostname
http:
paths:
- backend:
serviceName: backend-service
servicePort: 8080
tls:
- hosts:
- hostname
secretName: tls-cert
上面引用的方法對我有用,tls-cert 是在預期的命名空間中自動生成的,密鑰和證書都是。 為此,您應該將 nginx 負載均衡器的 IP 指向 DNS
它對我有用,acme 挑戰將得到自動測試,一旦完成,證書會將其狀態從 false 更改為 true
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.