404查询响应与cert-manager和Nginx入口

Question

$ k get challenge -o wide
NAME                                                      STATE     DOMAIN                 REASON                                                                               AGE
myapp-cert-2315925673-2905389610-1118496475   pending   myapp.example.com   Waiting for http-01 challenge propagation: wrong status code '404', expected '200'   7m55s

当TLS块注释掉时，入口可以在端口80处正常工作。但是，当我定义TLS时，端口80上的请求返回404，这可能是挑战失败的原因。

注意：在使用我的产品clusterissuer时，我会得到相同的响应。

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: myapp-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-staging
  labels:
    app: myapp
spec:
  rules:
  - host: myapp.example.com
    http:
      paths:
      - backend:
          serviceName: myapp
          servicePort: 80
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-cert

：：编辑以添加更多配置：：

---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [e-mail]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: [e-mail]
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    - http01:
        ingress:
          class: nginx

服务清单：

---
apiVersion: v1
kind: Service
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  ports:
    - port: 80
  selector:
    app: myapp
    tier: fe
  type: NodePort

Nginx日志：

2019/12/08 14:45:44[emerg]62#62:无法加载证书“/etc/NGINX/secrets/default-myapp-cert”:PEM_read_bio_X509_AUX()失败（SSL：Error：0909006c:pem例程:get_name:no开始行：expected：TRUSTED certificate）I1208 14:45:44.934644 1 Event.go:209]事件(V1.objectreference{kint:“ingress”,namespace：“default”,name：“s/v1beta1”,resourceversion：“319124”,fieldpath：“}）：类型：”warning“原因：”addedorupdatedwitherror“默认/myapp-ingress配置已添加或更新，但未应用：错误为默认/myapp-ingress重新加载NGINX：NGINX重新加载失败：Command/usr/sbin/nginx-s重新加载stdout：”stderr：“NGINX:[emerg]不能加载证书\”/etc/NGINX/default-myapp-cert\“应为：可信证书）\n”已完成，但错误为：退出状态1

Answer 1

尽管复制了文档，但结果是入口上的注释键是错误的。

它应该是:certmanager.k8s.io/cluster-issurier（而不是文档中的cert-manager.io/cluster-issurier)

在进行此更改时，404消失了，证书被正确地颁发和配置。