如何测试ClusterIssuer求解器? [英] How do I test a ClusterIssuer solver?

问题描述

我正在尝试使用DigitalOcean上的LetsEncrypt使用SSL证书部署Kubernetes集群.我关注了

I'm attempting to deploy a Kubernetes cluster with an SSL certificate using LetsEncrypt on DigitalOcean. I followed these instructions, and everything works right up until the challenge order is created by the ClusterIssuer. Then I get this error:

cert-manager/controller/orders "msg"="Failed to determine the list of Challenge resources needed for the Order" "error"="no configured challenge solvers can be used for this challenge" "resource_kind"="Order" "resource_name"="letsencrypt-prod-cert-458163912-1173127706"

我已经用http尝试过，并且尝试配置DigitalOcean的dns01解析器，但是都没有用，并且出现类似的错误.该站点是通过ip，dns名称(虽然我收到no-ssl cert警告)运行的.这是ClusterIssuer的描述:

I've tried it both with http, and trying to configure DigitalOcean's dns01 resolver, but neither work, and with a similar error. The site is live by ip, by dns name (though I get the no-ssl cert warning). This is the ClusterIssuer description:

Name:         letsencrypt-issuer
Namespace:
Labels:       app/instance=webapp
              app/managed-by=Tiller
              app/name=webapp
              app/version=0.1.0
              helm.sh/chart=webapp-0.1.0
Annotations:  cert-manager.io/cluster-issuer: letsencrypt-issuer
              kubernetes.io/ingress.class: nginx
              kubernetes.io/tls-acme: true
API Version:  cert-manager.io/v1alpha2
Kind:         ClusterIssuer
Metadata:
  Creation Timestamp:  2019-10-16T23:24:47Z
  Generation:          2
  Resource Version:    10300992
  Self Link:           /apis/cert-manager.io/v1alpha2/clusterissuers/letsencrypt-issuer
  UID:                 2ee08cd4-5781-4126-9e6d-6b9d108a1eb2
Spec:
  Acme:
    Email:  <redacted>
    Private Key Secret Ref:
      Name:  letsencrypt-prod-cert
    Server:  https://acme-v02.api.letsencrypt.org/directory
Status:
  Acme:
    Last Registered Email:  <redacted>
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/69503670
  Conditions:
    Last Transition Time:  2019-10-16T23:24:48Z
    Message:               The ACME account was registered with the ACME server
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

是否可以查看求解器本身以验证其配置正确?有没有办法锻炼他们以证明他们的工作能力?还有其他方法可以诊断情况如何吗?我完全被困住了，因为似乎对此没有很多在线支持?

Is there a way to see the solvers themselves to validate they're configured correctly? Is there a way to exercise them to prove they work? Is there some other way to diagnose what the situation is? I'm completely stuck, as there doesn't seem to be a lot of support online for this?

推荐答案

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
 metadata:
  name: certificate-name
spec:
  secretName: tls-cert
  duration: 24h
  renewBefore: 12h
  commonName: hostname
  dnsNames:
  - hostname
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer

---

apiVersion: certmanager.k8s.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    email: [e-mail]
    http01: {}
    privateKeySecretRef:
      name: letsencrypt-private-key
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress:
          class: nginx
      selector: {}

---

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/acme-challenge-type: http01
    certmanager.k8s.io/cluster-issuer: letsencrypt
  name: ingress-rule
  namespace: default
spec:
  rules:
  - host: hostname
    http:
      paths:
      - backend:
          serviceName: backend-service
          servicePort: 8080
  tls:
  - hosts:
    - hostname
    secretName: tls-cert

---

上面引用的方法对我有用，tls-cert是在预期的名称空间中自动生成的，密钥和证书都自动生成.为此，您应该将nginx loadbalancer的IP指向DNS

---

The above cited approach worked for me, tls-cert is automatically generated in the intended namespace, the key and certificate both. For this to happen, you should point the IP of nginx loadbalancer to DNS

它对我有用，一旦完成，acme挑战将得到自动测试，并且证书会将其状态从false更改为true

It worked for me, the acme challenge will get auto tested and the certificate will change it status from false to true, once this gets done

这篇关于如何测试ClusterIssuer求解器?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！