帶有 nginx 入口和證書管理器的 ArgoCD 無法正常工作

Question

我正在嘗試在 GKE 集群（版本 1.21.5-gke.1302）中使用入口和證書管理器公開 ArgoCD，但未頒發證書。

重現步驟：

• 安裝應用此yaml 的證書管理器

• 在 helm 運行的情況下安裝 nginx ingress-controller： helm install my-release nginx-stable/nginx-ingress

• 創建 clusterIssuer 應用以下內容：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    email: example@email.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-cluster-issuer-key
    solvers:
    - http01:
       ingress:
         class: nginx

• 使用本指南和文件應用入口：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-ingress
  namespace: argocd
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    # If you encounter a redirect loop or are getting a 307 response code 
    # then you need to force the nginx ingress to connect to the backend using HTTPS.
    #
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - host: argocd.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: 
            name: argocd-server
            port:
              name: https
  tls:
  - hosts:
    - argocd.example.com
    secretName: argocd-secret # do not change, this is provided by Argo CD

• Map 將入口控制器的 ip 設置為您的主機名。

預期行為：我希望成功創建證書並可以訪問該應用程序。

當前狀態：

證書描述給了我這個：

  Conditions:
    Last Transition Time:        2022-01-18T14:10:14Z
    Message:                     Existing issued Secret is not up to date for spec: [spec.dnsNames]
    Observed Generation:         3
    Reason:                      SecretMismatch
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2022-01-18T14:10:14Z
    Message:                     Issuing certificate as Secret was previously issued by Issuer.cert-manager.io/
    Observed Generation:         1
    Reason:                      IncorrectIssuer
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  argocd-secret-ccjtv
  Not After:                     2023-01-18T13:39:24Z
  Not Before:                    2022-01-18T13:39:24Z
  Renewal Time:                  2022-09-18T21:39:24Z
Events:
  Type    Reason     Age                  From          Message
  ----    ------     ----                 ----          -------
  Normal  Requested  16m                  cert-manager  Created new CertificateRequest resource "argocd-secret-qm469"
  Normal  Requested  15m                  cert-manager  Created new CertificateRequest resource "argocd-secret-9ctn4"
  Normal  Reused     7m19s (x2 over 45h)  cert-manager  Reusing private key stored in existing Secret resource "argocd-secret"

最后，我可以通過質詢訪問提供的 url，但狀態處於未決狀態，原因是： Waiting for HTTP-01 challenge propagation: failed to perform self check GET request

有誰知道可能出了什么問題？ 將不勝感激。

謝謝！

Answer 1

我認為您需要指定：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    email: example@email.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: argocd-secret # HERE use secrets created by ArgoCD
    solvers:
    - http01:
       ingress:
         class: nginx

Answer 2

看起來您在 ArgoCD 的入口規則中有一個不同的集群問題名稱。 從您在 ClusterIssuer 清單中的示例：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer

從入口規則

  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod