入口中的托管证书，域状态失败不可见

Question

我只是按照这里的教程进行操作：https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#creating_an_ingress_with_a_managed_certificate

在部署证书并等待20分钟后，证书显示为：

Status:
  Certificate Name:    daojnfiwlefielwrfn
  Certificate Status:  Provisioning
  Domain Status:
    Domain:  moviedecisionengine.com
    Status:  FailedNotVisible

这一领域显然是可行的，那么我遗漏了什么呢？

编辑：

这是证书：

apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
    name: moviedecisionengine
spec:
    domains:
        - moviedecisionengine.com

入口：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.gcp.kubernetes.io/pre-shared-cert: mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
    ingress.kubernetes.io/backends: '{"k8s-be-31721--1cd1f38313af9089":"HEALTHY"}'
    ingress.kubernetes.io/forwarding-rule: k8s-fw-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/https-forwarding-rule: k8s-fws-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/https-target-proxy: k8s-tps-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/ssl-cert: mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
    ingress.kubernetes.io/target-proxy: k8s-tp-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/url-map: k8s-um-default-showcase-mde-ingress--1cd1f38313af9089
    kubernetes.io/ingress.global-static-ip-name: 34.107.208.110
    networking.gke.io/managed-certificates: moviedecisionengine
  creationTimestamp: "2020-01-16T19:44:13Z"
  generation: 4
  name: showcase-mde-ingress
  namespace: default
  resourceVersion: "1039270"
  selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/showcase-mde-ingress
  uid: 92a2f91f-3898-11ea-b820-42010a800045
spec:
  backend:
    serviceName: showcase-mde
    servicePort: 80
  rules:
  - host: moviedecisionengine.com
    http:
      paths:
      - backend:
          serviceName: showcase-mde
          servicePort: 80
  - host: www.moviedecisionengine.com
    http:
      paths:
      - backend:
          serviceName: showcase-mde
          servicePort: 80
status:
  loadBalancer:
    ingress:
    - ip: 34.107.208.110

最后，负载平衡器：

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2020-01-13T22:41:27Z"
  labels:
    app: showcase-mde
  name: showcase-mde
  namespace: default
  resourceVersion: "2298"
  selfLink: /api/v1/namespaces/default/services/showcase-mde
  uid: d5a77d7b-3655-11ea-af7f-42010a800157
spec:
  clusterIP: 10.31.251.46
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 31721
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: showcase-mde
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 35.232.156.172

对于kubectl的完整输出，请描述managedcertificate moviedecisionengine：

Name:         moviedecisionengine
Namespace:    default
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"networking.gke.io/v1beta1","kind":"ManagedCertificate","metadata":{"annotations":{},"name":"moviedecisionengine","namespace...
API Version:  networking.gke.io/v1beta1
Kind:         ManagedCertificate
Metadata:
  Creation Timestamp:  2020-01-17T16:47:19Z
  Generation:          3
  Resource Version:    1042869
  Self Link:           /apis/networking.gke.io/v1beta1/namespaces/default/managedcertificates/moviedecisionengine
  UID:                 06c97b69-3949-11ea-b820-42010a800045
Spec:
  Domains:
    moviedecisionengine.com
Status:
  Certificate Name:    mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
  Certificate Status:  Provisioning
  Domain Status:
    Domain:  moviedecisionengine.com
    Status:  FailedNotVisible
Events:      <none>

Answer 1

我成功地使用了Managed证书和GKE入口资源。

让我详细说明一下：

复制步骤：

• 使用gcloud
创建IP地址
• 更新DNS条目
• 创建部署
• 创建服务
• 创建证书
• 创建入口资源

调用以下命令创建静态ip地址：

$gcloud计算地址创建示例地址--global

使用以下命令检查新创建的IP地址：

$gcloud计算地址描述示例地址--global

转到GCP-

使用与上面创建的地址相同的记录编辑区域。

等待它应用。

请使用$nslookup域进行检查。如果条目指向适当的地址，则输入名称。

下面是响应流量的部署示例：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  selector:
    matchLabels:
      app: hello
      version: 1.0.0
  replicas: 3
  template:
    metadata:
      labels:
        app: hello
        version: 1.0.0
    spec:
      containers:
      - name: hello
        image: "gcr.io/google-samples/hello-app:1.0"
        env:
        - name: "PORT"
          value: "50001"

使用命令$kubectl应用-fFILE_NAME. yaml

您可以更改此部署以适合您的应用程序，但请注意应用程序将响应的端口。

使用节点端口，因为它与提供的链接中的相同：

apiVersion: v1
kind: Service
metadata:
  name: hello-service
spec:
  type: NodePort
  selector:
    app: hello
    version: 1.0.0
  ports:
  - name: hello-port
    protocol: TCP
    port: 50001
    targetPort: 50001

使用命令$kubectl应用-fFILE_NAME. yaml

如指南所示，您可以使用下面的示例创建Managed证书：

apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: example-certificate 
spec:
  domains:
    - DOMAIN.NAME

使用命令$kubectl应用-fFILE_NAME. yaml

状态“FAILED\u NOT\u VISIBLE”表示由于DNS或负载平衡配置问题，域的证书设置失败。确保已配置DNS，以便证书的域解析为负载平衡器的IP地址。-谷歌云文档

此证书的创建应受到您之前提供的DNS条目的影响。

下面是将使用Managed证书的入口资源的示例：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: example-address
    networking.gke.io/managed-certificates: example-certificate
spec:
  rules:
  - host: DOMAIN.NAME
    http:
      paths:
      - path: /
        backend:
          serviceName: hello-service
          servicePort: hello-port

使用命令$kubectl应用-fFILE_NAME. yaml

它需要大约20-25分钟才能完全工作。