amazon-web-services - LetsEncrypt 未通过 AWS EKS 中的 Kubernetes 入口和负载均衡器进行验证

Question

LetsEncrypt 未通过 AWS EKS 中的 Kubernetes 入口和负载均衡器进行验证

客户端发行者

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: my@email.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    # Enable the HTTP-01 challenge provider
    solvers:
      - http01:
          ingress:
            class:  nginx

入口.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: echo-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-staging"
spec:
  tls:
  - hosts:
    - echo0.site.com
    secretName: echo-tls
  rules:
    - host: echo0.site.com
      http:
        paths:
        - backend:
            serviceName: echo0
            servicePort: 80

事件

12m         Normal    IssuerNotReady         certificaterequest/echo-tls-3171246787   Referenced issuer does not have a Ready status condition
12m         Normal    GeneratedKey           certificate/echo-tls                     Generated a new private key
12m         Normal    Requested              certificate/echo-tls                     Created new CertificateRequest resource "echo-tls-3171246787"
4m29s       Warning   ErrVerifyACMEAccount   clusterissuer/letsencrypt-staging        Failed to verify ACME account: context deadline exceeded
4m29s       Warning   ErrInitIssuer          clusterissuer/letsencrypt-staging        Error initializing issuer: context deadline exceeded

kubectl 描述证书

Name:         echo-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha3
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-04-04T23:57:22Z
  Generation:          1
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  echo-ingress
    UID:                   1018290f-d7bc-4f7c-9590-b8924b61c111
  Resource Version:        425968
  Self Link:               /apis/cert-manager.io/v1alpha3/namespaces/default/certificates/echo-tls
  UID:                     0775f965-22dc-4053-a6c2-a87b46b3967c
Spec:
  Dns Names:
    echo0.site.com
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt-staging
  Secret Name:  echo-tls
Status:
  Conditions:
    Last Transition Time:  2020-04-04T23:57:22Z
    Message:               Waiting for CertificateRequest "echo-tls-3171246787" to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  GeneratedKey  18m   cert-manager  Generated a new private key
  Normal  Requested     18m   cert-manager  Created new CertificateRequest resource "echo-tls-3171246787"

这几天一直在做这个。我尝试过不同的域，但结果相同。我在这里遗漏了什么/步骤吗？它基于本教程 here

如有任何帮助，我们将不胜感激。

Answer 1

通常对于 golang 应用程序，错误 context deadline exceeded 意味着连接超时。这听起来像是 cert-manager pod 无法访问 ACME API，如果您的集群有出站防火墙和/或没有连接到子网的 NAT 或互联网网关，就会发生这种情况