我设置了一个 kubernetes 集群,目前有两个节点和 metallb 作为负载均衡器。
目前我想使用 Ingress 并通过 ssl 保护它。为此,我决定将 nginx ingress 与 cert-manager 一起使用,并在教程结束后将其放在他们的网站上。
但现在我收到错误“等待 http-01 挑战传播:无法执行自检 GET 请求‘http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs’:获取”http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs ": 调用 tcp 94.130.150.125:80: connect: 连接超时 "
我当前的 ClusterIssuer 如下所示:
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
namespace: cert-manager
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: letsencrypt@mymail.de
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: nginx
我正在尝试自动提供证书
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: web-ingress
annotations:
kubernetes.io/ingress.class: "nginx"
cert-manager.io/cluster-issuer: "letsencrypt-prod"
cert-manager.io/acme-challenge-type: http01
spec:
tls:
- hosts:
- example.....zone
secretName: example-...-zone-tls
rules:
- host: example.....zone
http:
paths:
- path: /
backend:
serviceName: nginx-service
servicePort: 80
手动我可以完美地到达任何地址。
最佳答案
这个对我有用。
更改 ingress-nginx
服务中的 LoadBalancer
。
添加/更改 externalTrafficPolicy: Cluster
。
原因是,带有证书颁发者的 pod 与负载均衡器在不同的节点上结束,因此它无法通过入口与自己对话。
下面是取自 https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.26.1/deploy/static/provider/cloud-generic.yaml 的完整 block
kind: Service
apiVersion: v1
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
#CHANGE/ADD THIS
externalTrafficPolicy: Cluster
type: LoadBalancer
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
ports:
- name: http
port: 80
targetPort: http
- name: https
port: 443
targetPort: https
---
关于kubernetes - 等待 http-01 挑战传播 : failed to perform self timed out,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/60855891/