ssl - Google 托管 SSL 证书卡在 FAILED_NOT_VISIBLE

Question

我正在尝试使用 GKE 配置 HTTPS/第 7 层负载均衡器。我正在关注 SSL certificates overview和 GKE Ingress for HTTP(S) Load Balancing .

我的配置。已经工作了一段时间。我想测试 Google 的托管服务。

到目前为止我是这样设置的:

k8s/staging/staging-ssl.yml:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-staging-lb-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "my-staging-global"
    ingress.gcp.kubernetes.io/pre-shared-cert: "staging-google-managed-ssl"
    kubernetes.io/ingress.allow-http: "false"
spec:
  rules:
  - host: staging.my-app.no
    http:
      paths:
      - path: /*
        backend:
          serviceName: my-svc
          servicePort: 3001

gcloud compute addresses list

#=>

NAME                   REGION  ADDRESS          STATUS
my-staging-global              35.244.160.NNN  RESERVED

host staging.my-app.no 

#=>

35.244.160.NNN

但它卡在 FAILED_NOT_VISIBLE 上:

gcloud beta compute ssl-certificates describe staging-google-managed-ssl

#=>

creationTimestamp: '2018-12-20T04:59:39.450-08:00'
id: 'NNNN'
kind: compute#sslCertificate
managed:
  domainStatus:
    staging.my-app.no: FAILED_NOT_VISIBLE
  domains:
  - staging.my-app.no
  status: PROVISIONING
name: staging-google-managed-ssl
selfLink: https://www.googleapis.com/compute/beta/projects/my-project/global/sslCertificates/staging-google-managed-ssl
type: MANAGED

关于如何进一步修复或调试此问题的任何想法？

---

我在帖子开头链接到的文档中找到了一个部分 将 SSL 证书资源与目标代理相关联:

Use the following gcloud command to associate SSL certificate resources with a target proxy, whether the SSL certificates are self-managed or Google-managed.

gcloud compute target-https-proxies create [NAME] \
--url-map=[URL_MAP] \
--ssl-certificates=[SSL_CERTIFICATE1][,[SSL_CERTIFICATE2], [SSL_CERTIFICATE3],...]

当我在 k8s/staging/staging-ssl.yml 中有这一行时是否有必要？

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    . . .
    ingress.gcp.kubernetes.io/pre-shared-cert: "staging-google-managed-ssl"
    . . .

Answer 1

我最近遇到了这个问题。您需要检查您的 A Record 是否正确指向 Ingress 静态 IP。

如果您使用的是 Cloudflare 之类的服务，请禁用 Cloudflare 代理设置，这样对域的 ping 操作将给出 Ingress 的实际 IP。这将在 10 到 15 分钟内正确创建 Google 托管的 SSL 证书。

证书启动后，您可以再次启用 Cloudflare 代理设置。